10BC0 Merge branch 'main' into helm-controler-service-name · nginx/kubernetes-ingress@942a5f2 · GitHub
[go: up one dir, main page]
Skip to content

Commit 942a5f2

Browse files
ciarams87ciarams87
authored
Merge branch 'main' into helm-controler-service-name
2 parents 482a602 + 268b00b commit 942a5f2

22 files changed

+227
-190
lines changed

‎.github/workflows/build-oss.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ jobs:
6666
if: ${{ github.event_name != 'pull_request' && ! startsWith(github.ref, 'refs/heads/release-') }}
6767

6868
- name: Configure AWS Credentials
69-
uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # v2.0.0
69+
uses: aws-actions/configure-aws-credentials@5727f247b64f324ec403ac56ae05e220fd02b65f # v2.1.0
7070
with:
7171
aws-region: us-east-1
7272
role-to-assume: ${{ secrets.AWS_ROLE_PUBLIC_ECR }}
@@ -148,7 +148,7 @@ jobs:
148148
IC_VERSION=${{ (github.event_name == 'pull_request' || startsWith(github.ref, 'refs/heads/release-')) && 'CI' || steps.meta.outputs.version }}
149149
150150
- name: Run Trivy vulnerability scanner
151-
uses: aquasecurity/trivy-action@e5f43133f6e8736992c9f3c1b3296e24b37e17f2 # 0.10.0
151+
uses: aquasecurity/trivy-action@b43daad0c3c96202fc5800b511dfae8e6ecce864 # 0.11.0
152152
continue-on-error: true
153153
with:
154154
image-ref: nginx/nginx-ingress:${{ steps.meta.outputs.version }}
@@ -157,7 +157,7 @@ jobs:
157157
ignore-unfixed: "true"
158158

159159
- name: Upload Trivy scan results to GitHub Security tab
160-
uses: github/codeql-action/upload-sarif@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.3.3
160+
uses: github/codeql-action/upload-sarif@83f0fe6c4988d98a455712a27f0255212bba9bd4 # v2.3.6
161161
continue-on-error: true
162162
with:
163163
sarif_file: "trivy-results-${{ inputs.image }}.sarif"

‎.github/workflows/build-plus.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ jobs:
6969
if: github.event_name != 'pull_request'
7070

7171
- name: Configure AWS Credentials
72-
uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # v2.0.0
72+
uses: aws-actions/configure-aws-credentials@5727f247b64f324ec403ac56ae05e220fd02b65f # v2.1.0
7373
with:
7474
aws-region: us-east-1
7575
role-to-assume: ${{ secrets.AWS_ROLE_MARKETPLACE }}
@@ -162,7 +162,7 @@ jobs:
162162
${{ inputs.nap_modules != '' && contains(inputs.image, 'ubi') && format('"rhel_license={0}"', secrets.RHEL_LICENSE) || '' }}
163163
164164
- name: Run Trivy vulnerability scanner
165-
uses: aquasecurity/trivy-action@e5f43133f6e8736992c9f3c1b3296e24b37e17f2 # 0.10.0
165+
uses: aquasecurity/trivy-action@b43daad0c3c96202fc5800b511dfae8e6ecce864 # 0.11.0
166166
continue-on-error: true
167167
with:
168168
image-ref: docker.io/${{ inputs.image }}:${{ steps.meta.outputs.version }}
@@ -171,7 +171,7 @@ jobs:
171171
ignore-unfixed: 'true'
172172

173173
- name: Upload Trivy scan results to GitHub Security tab
174-
uses: github/codeql-action/upload-sarif@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.3.3
174+
uses: github/codeql-action/upload-sarif@83f0fe6c4988d98a455712a27f0255212bba9bd4 # v2.3.6
175175
continue-on-error: true
176176
with:
177177
sarif_file: 'trivy-results-${{ inputs.image }}.sarif'

‎.github/workflows/ci.yml‎

Lines changed: 35 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66
- main
77
- release-*
88
tags:
9-
- 'v[0-9]+.[0-9]+.[0-9]+'
9+
- "v[0-9]+.[0-9]+.[0-9]+"
1010
pull_request:
1111
branches:
1212
- main
@@ -16,7 +16,7 @@ on:
1616
- reopened
1717
- synchronize
1818
schedule:
19-
- cron: '0 4 * * *' # run every day at 04:00 UTC
19+
- cron: "0 4 * * *" # run every day at 04:00 UTC
2020

2121
defaults:
2222
run:
@@ -27,7 +27,6 @@ concurrency:
2727
cancel-in-progress: true
2828

2929
jobs:
30-
3130
checks:
3231
name: Checks and variables
3332
runs-on: ubuntu-22.04
@@ -92,16 +91,16 @@ jobs:
9291
- name: Create/Update Draft
9392
uses: lucacome/draft-release@b79be3ff634f771230b2b6ee9f47308c5793671a # v0.2.0
9493
with:
95-
minor-label: 'enhancement'
96-
major-label: 'change'
94+
minor-label: "enhancement"
95+
major-label: "change"
9796
publish: ${{ startsWith(github.ref, 'refs/tags/') }}
9897
collapse-after: 50
9998
variables: |
10099
helm-chart=${{ needs.checks.outputs.chart_version }}
101100
notes-footer: |
102101
## Upgrade
103-
- For NGINX, use the {{version}} image from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name={{version-number}}), [GitHub Container](https://github.com/nginxinc/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
104-
- For NGINX Plus, use the {{version}} image from the F5 Container registry or the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE) or build your own image using the {{version}} source code.
102+
- For NGINX, use the {{version}} images from our [DockerHub](https://hub.docker.com/r/nginx/ng 8B92 inx-ingress/tags?page=1&ordering=last_updated&name={{version-number}}), [GitHub Container](https://github.com/nginxinc/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
103+
- For NGINX Plus, use the {{version}} images from the F5 Container registry, the [AWS Marketplace](https://aws.amazon.com/marketplace/search/?CREATOR=741df81b-dfdc-4d36-b8da-945ea66b522c&FULFILLMENT_OPTION_TYPE=CONTAINER&filters=CREATOR%2CFULFILLMENT_OPTION_TYPE), the [GCP Marketplace](https://console.cloud.google.com/marketplace/browse?filter=partner:F5,%20Inc.&filter=solution-type:k8s&filter=category:networking) or build your own image using the {{version}} source code.
105104
- For Helm, use version {{helm-chart}} of the chart.
106105
107106
## Resources
@@ -163,10 +162,10 @@ jobs:
163162
strategy:
164163
matrix:
165164
include:
166-
- image: debian
167-
type: oss
168-
- image: debian-plus
169-
type: plus
165+
- image: debian
166+
type: oss
167+
- image: debian-plus
168+
type: plus
170169
steps:
171170
- name: Checkout Repository
172171
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
@@ -181,7 +180,7 @@ jobs:
181180
uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 # v4.0.0
182181
with:
183182
file: build/Dockerfile
184-
context: '.'
183+
context: "."
185184
cache-from: type=gha,scope=${{ matrix.image }}
186185
target: goreleaser
187186
tags: ${{ matrix.type }}:${{ github.sha }}
@@ -270,7 +269,7 @@ jobs:
270269
uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 # v4.0.0
271270
with:
272271
file: tests/docker/Dockerfile
273-
context: '.'
272+
context: "."
274273
cache-from: type=gha,scope=test-runner
275274
cache-to: type=gha,scope=test-runner,mode=max
276275
tags: test-runner:${{ github.sha }}
@@ -308,13 +307,14 @@ jobs:
308307
name: Build Docker OSS
309308
needs: smoke-tests
310309
strategy:
311-
fail-fast: false
312-
matrix:
313-
image: [debian, alpine]
314-
platforms: ["linux/arm, linux/arm64, linux/amd64, linux/ppc64le, linux/s390x"]
315-
include:
316-
- image: ubi
317-
platforms: "linux/arm64, linux/amd64, linux/ppc64le, linux/s390x"
310+
fail-fast: false
311+
matrix:
312+
image: [debian, alpine]
313+
platforms:
314+
["linux/arm, linux/arm64, linux/amd64, linux/ppc64le, linux/s390x"]
315+
include:
316+
- image: ubi
317+
platforms: "linux/arm64, linux/amd64, linux/ppc64le, linux/s390x"
318318
uses: ./.github/workflows/build-oss.yml
319319
with:
320320
platforms: ${{ matrix.platforms }}
@@ -325,15 +325,15 @@ jobs:
325325
name: Build Docker Plus
326326
needs: build-docker
327327
strategy:
328-
fail-fast: false
329-
matrix:
330-
image: [debian-plus, alpine-plus]
331-
platforms: ["linux/arm64, linux/amd64"]
332-
target: [goreleaser, aws]
333-
include:
334-
- image: ubi-plus
335-
platforms: "linux/arm64, linux/amd64, linux/s390x"
336-
target: goreleaser
328+
fail-fast: false
329+
matrix:
330+
image: [debian-plus, alpine-plus]
331+
platforms: ["linux/arm64, linux/amd64"]
332+
target: [goreleaser, aws]
333+
include:
334+
- image: ubi-plus
335+
platforms: "linux/arm64, linux/amd64, linux/s390x"
336+
target: goreleaser
337337
uses: ./.github/workflows/build-plus.yml
338338
with:
339339
platforms: ${{ matrix.platforms }}
@@ -345,12 +345,12 @@ jobs:
345345
name: Build Docker NAP
346346
needs: build-docker-plus
347347
strategy:
348-
fail-fast: false
349-
matrix:
350-
image: [debian-plus-nap, ubi-plus-nap]
351-
platforms: ["linux/amd64"]
352-
target: [goreleaser, aws]
353-
nap_modules: [dos, waf, "waf,dos"]
348+
fail-fast: false
349+
matrix:
350+
image: [debian-plus-nap, ubi-plus-nap]
351+
platforms: ["linux/amd64"]
352+
target: [goreleaser, aws]
353+
nap_modules: [dos, waf, "waf,dos"]
354354
uses: ./.github/workflows/build-plus.yml
355355
with:
356356
platforms: ${{ matrix.platforms }}

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636

3737
# Initializes the CodeQL tools for scanning.
3838
- name: Initialize CodeQL
39-
uses: github/codeql-action/init@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.3.3
39+
uses: github/codeql-action/init@83f0fe6c4988d98a455712a27f0255212bba9bd4 # v2.3.6
4040
with:
4141
languages: ${{ matrix.language }}
4242
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -47,7 +47,7 @@ jobs:
4747
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
4848
# If this step fails, then you should remove it and run the build manually (see below)
4949
- name: Autobuild
50-
uses: github/codeql-action/autobuild@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.3.3
50+
uses: github/codeql-action/autobuild@83f0fe6c4988d98a455712a27f0255212bba9bd4 # v2.3.6
5151

5252
# ℹ️ Command-line programs to run using the OS shell.
5353
# 📚 https://git.io/JvXDl
@@ -61,4 +61,4 @@ jobs:
6161
# make release
6262

6363
- name: Perform CodeQL Analysis
64-
uses: github/codeql-action/analyze@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.3.3
64+
uses: github/codeql-action/analyze@83f0fe6c4988d98a455712a27f0255212bba9bd4 # v2.3.6

‎.github/workflows/lint.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
with:
3535
go-version-file: go.mod
3636
- name: Lint Code
37-
uses: golangci/golangci-lint-action@08e2f20817b15149a52b5b3ebe7de50aff2ba8c5 # v3.4.0
37+
uses: golangci/golangci-lint-action@5f1fec7010f6ae3b84ea4f7b2129beb8639b564f # v3.5.0
3838
with:
3939
only-new-issues: true
4040

‎.github/workflows/scorecards.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,6 @@ jobs:
5353

5454
# Upload the results to GitHub's code scanning dashboard.
5555
- name: "Upload to code-scanning"
56-
uses: github/codeql-action/upload-sarif@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.3.3
56+
uses: github/codeql-action/upload-sarif@83f0fe6c4988d98a455712a27f0255212bba9bd4 # v2.3.6
5757
with:
5858
sarif_file: results.sarif

‎.pre-commit-config.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ repos:
4040
types: [go]
4141
pass_filenames: false
4242
- repo: https://github.com/golangci/golangci-lint
43-
rev: v1.52.2
43+
rev: v1.53.2
4444
hooks:
4545
- id: golangci-lint
4646
args: [--new-from-patch=/tmp/diff.patch]
@@ -57,7 +57,7 @@ repos:
5757
hooks:
5858
- id: black
5959
- repo: https://github.com/python-jsonschema/check-jsonschema
60-
rev: 0.23.0
60+
rev: 0.23.1
6161
hooks:
6262
- id: check-jsonschema
6363
name: "Check Helm Chart JSON Schema"

‎build/Dockerfile‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,12 @@ ARG DOWNLOAD_TAG=edge
55

66

77
############################################# Base images containing libs for Opentracing #############################################
8-
FROM opentracing/nginx-opentracing:nginx-1.23.4 as opentracing-lib
9-
FROM opentracing/nginx-opentracing:nginx-1.23.4-alpine as alpine-opentracing-lib
8+
FROM opentracing/nginx-opentracing:nginx-1.25.0 as opentracing-lib
9+
FROM opentracing/nginx-opentracing:nginx-1.25.0-alpine as alpine-opentracing-lib
1010

1111

1212
############################################# Base image for Debian #############################################
13-
FROM nginx:1.23.4 AS debian
13+
FROM nginx:1.25.0 AS debian
1414

1515
RUN --mount=type=bind,from=opentracing-lib,target=/tmp/ot/ \
1616
apt-get update \
@@ -24,7 +24,7 @@ RUN --mount=type=bind,from=opentracing-lib,target=/tmp/ot/ \
2424

2525

2626
############################################# Base image for Alpine #############################################
27-
FROM nginx:1.23.4-alpine AS alpine
27+
FROM nginx:1.25.0-alpine AS alpine
2828

2929
RUN --mount=type=bind,from=alpine-opentracing-lib,target=/tmp/ot/ \
3030
apk add --no-cache libcap libstdc++ \
@@ -110,7 +110,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
110110

111111

112112
############################################# Base image for UBI #############################################
113-
FROM nginxcontrib/nginx:1.23.4-ubi AS ubi
113+
FROM nginxcontrib/nginx:1.25.0-ubi AS ubi
114114
ARG IC_VERSION
115115

116116
LABEL name="NGINX Ingress Controller" \

‎deployments/daemon-set/nginx-ingress.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ spec:
2222
securityContext:
2323
seccompProfile:
2424
type: RuntimeDefault
25-
# fsGroup: 101 #nginx
2625
# volumes:
2726
# - name: nginx-etc
2827
# emptyDir: {}
@@ -63,6 +62,7 @@ spec:
6362
allowPrivilegeEscalation: false
6463
# readOnlyRootFilesystem: true
6564
runAsUser: 101 #nginx
65+
runAsNonRoot: true
6666
capabilities:
6767
drop:
6868
- ALL

‎deployments/daemon-set/nginx-plus-ingress.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ spec:
2222
securityContext:
2323
seccompProfile:
2424
type: RuntimeDefault
25-
# fsGroup: 101 #nginx
2625
# volumes:
2726
# - name: nginx-etc
2827
# emptyDir: {}
@@ -63,6 +62,7 @@ spec:
6362
allowPrivilegeEscalation: false
6463
# readOnlyRootFilesystem: true
6564< B72 /code>
runAsUser: 101 #nginx
65+
runAsNonRoot: true
6666
capabilities:
6767
drop:
6868
- ALL

0 commit comments

Comments
 (0)
0