Skip to content

Commit 88c2590

Browse files
haywoodshhaywoodsh
authored
Merge branch 'main' into feat/7427-sni-in-jwt-policy
2 parents 9b705a4 + eafa060 commit 88c2590

File tree

20 files changed

+1703
-30
lines changed

20 files changed

+1703
-30
lines changed

‎.github/workflows/ci.yml

Lines changed: 69 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -377,6 +377,66 @@ jobs:
377377
secrets: inherit
378378
if: ${{ inputs.force || (needs.checks.outputs.forked_workflow == 'true' && needs.checks.outputs.docs_only == 'false') || (needs.checks.outputs.forked_workflow == 'false' && needs.checks.outputs.stable_image_exists != 'true' && needs.checks.outputs.docs_only == 'false') }}
379379

380+
package-tests:
381+
if: ${{ needs.checks.outputs.docs_only != 'true' && (inputs.run_tests && inputs.run_tests || true) }}
382+
name: Package Tests
383+
runs-on: ubuntu-22.04
384+
needs: [checks, binaries, build-docker, build-docker-plus, build-docker-nap]
385+
permissions:
386+
contents: read
387+
pull-requests: write # for package report
388+
id-token: write
389+
steps:
390+
- name: Checkout Repository
391+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
392+
393+
- name: Setup QEMU
394+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
395+
with:
396+
platforms: arm64
397+
if: ${{ needs.checks.outputs.forked_workflow == 'false' || needs.checks.outputs.docs_only == 'false' }}
398+
399+
- name: Authenticate to Google Cloud
400+
id: auth
401+
uses: google-github-actions/auth@ba79af03959ebeac9769e648f473a284504d9193 # v2.1.10
402+
with:
403+
token_format: access_token
404+
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
405+
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
406+
if: ${{ needs.checks.outputs.forked_workflow == 'false' || needs.checks.outputs.docs_only == 'false' }}
407+
408+
- name: Login to GCR
409+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
410+
with:
411+
registry: gcr.io
412+
username: oauth2accesstoken
413+
password: ${{ steps.auth.outputs.access_token }}
414+
if: ${{ needs.checks.outputs.forked_workflow == 'false' || needs.checks.outputs.docs_only == 'false' }}
415+
416+
- name: Install Python dependencies
417+
run: |
418+
make -f tests/Makefile setup-venv
419+
if: ${{ needs.checks.outputs.forked_workflow == 'false' || needs.checks.outputs.docs_only == 'false' }}
420+
421+
- name: Run tests
422+
id: packages
423+
run: |
424+
source tests/venv/bin/activate
425+
python tests/scripts/check_container_packages.py --tag ${{ needs.checks.outputs.build_tag }} --log package_output.txt
426+
if: ${{ needs.checks.outputs.forked_workflow == 'false' || needs.checks.outputs.docs_only == 'false' }}
427+
428+
- name: Add comment
429+
run: |
430+
# make sure the comment is formatted correctly, as a code block
431+
echo '### Package Report' > output.txt
432+
echo '```' >> output.txt
433+
cat package_output.txt >> output.txt
434+
echo '```' >> output.txt
435+
gh pr comment --edit-last --create-if-none ${{ github.event.pull_request.number }} -F output.txt
436+
env:
437+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
438+
if: ${{ ( needs.checks.outputs.forked_workflow == 'false' || needs.checks.outputs.docs_only == 'false' ) && github.event.pull_request }}
439+
380440
helm-tests:
381441
if: ${{ needs.checks.outputs.docs_only != 'true' && (inputs.run_tests && inputs.run_tests || true) }}
382442
name: Helm Tests ${{ matrix.base-os }}
@@ -677,10 +737,12 @@ jobs:
677737
if: ${{ !cancelled() }}
678738
runs-on: ubuntu-22.04
679739
name: Final CI Results
680-
needs: [tag-stable, build-docker, build-docker-plus, build-docker-nap, smoke-tests-oss, smoke-tests-plus, smoke-tests-nap]
740+
needs: [tag-stable, build-docker, build-docker-plus, build-docker-nap, smoke-tests-oss, smoke-tests-plus, smoke-tests-nap, package-tests, helm-tests]
681741
steps:
682742
- run: |
683743
tagResult="${{ needs.tag-stable.result }}"
744+
packageResult="${{ needs.package-tests.result }}"
745+
helmResult="${{ needs.helm-tests.result }}"
684746
smokeOSSResult="${{ needs.smoke-tests-oss.result }}"
685747
smokePlusResult="${{ needs.smoke-tests-plus.result }}"
686748
smokeNAPResult="${{ needs.smoke-tests-nap.result }}"
@@ -708,6 +770,12 @@ jobs:
708770
if [[ $buildNAPResult != "success" && $buildNAPResult != "skipped" ]]; then
709771
exit 1
710772
fi
773+
if [[ $helmResult != "success" && $helmResult != "skipped" ]]; then
774+
exit 1
775+
fi
776+
if [[ $packageResult != "success" && $packageResult != "skipped" ]]; then
777+
exit 1
778+
fi
711779
712780
trigger-image-promotion:
713781
name: Promote images on Force Run

‎.pre-commit-config.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ repos:
2727
args: [--fix=lf]
2828
- id: name-tests-test
2929
args: [--pytest-test-first]
30-
exclude: ^(tests/suite/utils|tests/suite/fixtures|tests/suite/grpc|tests/settings.py)
30+
exclude: ^(tests/suite/utils|tests/suite/fixtures|tests/suite/grpc|tests/settings.py|tests/scripts)
3131
- id: no-commit-to-branch
3232
- id: requirements-txt-fixer
3333
- id: fix-byte-order-marker
@@ -44,7 +44,7 @@ repos:
4444
pass_filenames: false
4545

4646
- repo: https://github.com/golangci/golangci-lint
47-
rev: v2.2.1
47+
rev: v2.2.2
4848
hooks:
4949
- id: golangci-lint
5050
args: [--new-from-patch=/tmp/diff.patch]

‎README.md

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,12 +33,11 @@ We value community input and would love to see you at the next community call. A
3333

3434
| **Community Call Dates** |
3535
| ------------------------ |
36-
| **2025-05-06** |
37-
| **2025-05-19** |
38-
| **2025-06-03** |
39-
| **2025-06-16** |
40-
| **2025-06-30** |
41-
| **2025-07-14** |
36+
| **2025-07-28** |
37+
| **2025-08-11** |
38+
| **2025-08-25** |
39+
| **2025-09-08** |
40+
| **2025-09-22** |
4241

4342
---
4443

‎build/Dockerfile

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@ FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi8@sha256:ea2f5d57c65b1682418708b6f6
1414
FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi9@sha256:7dc715d51c9664d892376fada482f29a95023dc81657f89fa4cf7a62fd98d837 AS ubi9-packages
1515
FROM ghcr.io/nginx/alpine-fips:0.3.0-alpine3.19@sha256:449f1a149e81e36bb929ebd362433a06a158ff2a7e3ba05b4b8d9ea96d59ae91 AS alpine-fips-3.19
1616
FROM ghcr.io/nginx/alpine-fips:0.3.0-alpine3.21@sha256:5e5033f34ae7147ce8df928fa58c485bc08ded8ace22428b4c16df30e3b39901 AS alpine-fips-3.21
17-
FROM redhat/ubi9-minimal:9.6@sha256:11db23b63f9476e721f8d0b8a2de5c858571f76d5a0dae2ec28adf08cbaf3652 AS ubi-minimal
18-
FROM golang:1.24-alpine@sha256:ddf52008bce1be455fe2b22d780b6693259aaf97b16383b6372f4b22dd33ad66 AS golang-builder
17+
FROM redhat/ubi9-minimal:9.6@sha256:6d5a6576c83816edcc0da7ed62ba69df8f6ad3cbe659adde2891bfbec4dbf187 AS ubi-minimal
18+
FROM golang:1.24-alpine@sha256:9c4b616be9d26e4762219223331bab5db98649e4be1f6badeac3f7c00a340e3f AS golang-builder
1919

2020
############################################# NGINX files #############################################
2121
FROM scratch AS nginx-files
@@ -164,7 +164,7 @@ RUN --mount=type=bind,from=nginx-files,src=nginx_signing.key,target=/tmp/nginx_s
164164
&& ubi-clean.sh
165165

166166
############################################# Base image for Alpine with NGINX Plus ##############################################
167-
FROM alpine:3.21@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c AS alpine-plus
167+
FROM alpine:3.21@sha256:b6a6be0ff92ab6db8acd94f5d1b7a6c2f0f5d10ce3c24af348d333ac6da80685 AS alpine-plus
168168
ARG NGINX_PLUS_VERSION
169169
ARG PACKAGE_REPO
170170

@@ -201,7 +201,7 @@ RUN --mount=type=bind,from=alpine-fips-3.21,target=/tmp/fips/ \
201201

202202

203203
############################################# Base image for Alpine with NGINX Plus, App Protect WAF and FIPS #############################################
204-
FROM alpine:3.19@sha256:e5d0aea7f7d2954678a9a6269ca2d06e06591881161961ea59e974dff3f12377 AS alpine-plus-nap-fips
204+
FROM alpine:3.19@sha256:3be987e6cde1d07e873c012bf6cfe941e6e85d16ca5fc5b8bedc675451d2de67 AS alpine-plus-nap-fips
205205
ARG NGINX_PLUS_VERSION
206206
ARG PACKAGE_REPO
207207

@@ -234,7 +234,7 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
234234

235235

236236
############################################# Base image for Alpine with NGINX Plus, App Protect WAFv5 and FIPS #############################################
237-
FROM alpine:3.19@sha256:e5d0aea7f7d2954678a9a6269ca2d06e06591881161961ea59e974dff3f12377 AS alpine-plus-nap-v5-fips
237+
FROM alpine:3.19@sha256:3be987e6cde1d07e873c012bf6cfe941e6e85d16ca5fc5b8bedc675451d2de67 AS alpine-plus-nap-v5-fips
238238
ARG NGINX_PLUS_VERSION
239239
ARG PACKAGE_REPO
240240

@@ -469,7 +469,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
469469

470470

471471
############################################# Base image for UBI8 with NGINX Plus and App Protect WAF #############################################
472-
FROM redhat/ubi8@sha256:c0b07294568b8c1281d3ad89616ce036095da770a4410147c1755d930b562682 AS ubi-8-plus-nap
472+
FROM redhat/ubi8@sha256:e2ebb79368f8691bc4324d75040c0b0c34a97f4a9c430cf7d8866b310ab9c38e AS ubi-8-plus-nap
473473
ARG NGINX_PLUS_VERSION
474474
ARG BUILD_OS
475475

@@ -508,7 +508,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
508508

509509

510510
############################################# Base image for UBI8 with NGINX Plus and App Protect WAFv5 #############################################
511-
FROM redhat/ubi8@sha256:c0b07294568b8c1281d3ad89616ce036095da770a4410147c1755d930b562682 AS ubi-8-plus-nap-v5
511+
FROM redhat/ubi8@sha256:e2ebb79368f8691bc4324d75040c0b0c34a97f4a9c430cf7d8866b310ab9c38e AS ubi-8-plus-nap-v5
512512
ARG NGINX_PLUS_VERSION
513513

514514
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}

‎build/dependencies/Dockerfile.ubi8

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# syntax=docker/dockerfile:1.16
2-
FROM redhat/ubi8@sha256:c0b07294568b8c1281d3ad89616ce036095da770a4410147c1755d930b562682 AS rpm-build
2+
FROM redhat/ubi8@sha256:e2ebb79368f8691bc4324d75040c0b0c34a97f4a9c430cf7d8866b310ab9c38e AS rpm-build
33
RUN mkdir -p /rpms/ \
44
&& dnf install rpm-build gcc make cmake -y \
55
&& rpmbuild --rebuild --nodebuginfo https://mirror.stream.centos.org/9-stream/BaseOS/source/tree/Packages/c-ares-1.19.1-1.el9.src.rpm \

‎build/dependencies/Dockerfile.ubi9

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# syntax=docker/dockerfile:1.16
2-
FROM redhat/ubi9:9.6@sha256:e5ab898b4f3e91e31b4d202e92b4ca409ac18c2de77c4813807b3761332bf556 AS rpm-build
2+
FROM redhat/ubi9:9.6@sha256:4e5d4250bfb3ee9a8b32449dfe68c3dcb2307e6df4a4c4173d75f77b1c03df71 AS rpm-build
33
RUN mkdir -p /rpms/ \
44
&& dnf install rpm-build gcc make cmake -y \
55
&& rpmbuild --rebuild --nodebuginfo https://mirror.stream.centos.org/9-stream/BaseOS/source/tree/Packages/c-ares-1.19.1-1.el9.src.rpm \

‎charts/nginx-ingress/templates/controller-daemonset.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,13 +86,30 @@ spec:
8686
{{- if .Values.controller.readyStatus.enable }}
8787
- name: readiness-port
8888
containerPort: {{ .Values.controller.readyStatus.port }}
89+
{{- end }}
90+
{{- if .Values.controller.startupStatus.enable }}
91+
- name: startup-port
92+
containerPort: {{ .Values.controller.startupStatus.port }}
93+
{{- end }}
94+
{{- if .Values.controller.readyStatus.enable }}
8995
readinessProbe:
9096
httpGet:
9197
path: /nginx-ready
9298
port: readiness-port
9399
periodSeconds: 1
94100
initialDelaySeconds: {{ .Values.controller.readyStatus.initialDelaySeconds }}
95101
{{- end }}
102+
{{- if .Values.controller.startupStatus.enable }}
103+
startupProbe:
104+
httpGet:
105+
path: {{ .Values.controller.startupStatus.path }}
106+
port: startup-port
107+
initialDelaySeconds: {{ .Values.controller.startupStatus.initialDelaySeconds }}
108+
periodSeconds: {{ .Values.controller.startupStatus.periodSeconds }}
109+
timeoutSeconds: {{ .Values.controller.startupStatus.timeoutSeconds }}
110+
successThreshold: {{ .Values.controller.startupStatus.successThreshold }}
111+
failureThreshold: {{ .Values.controller.startupStatus.failureThreshold }}
112+
{{- end }}
96113
{{- if .Values.controller.securityContext }}
97114
securityContext:
98115
{{ toYaml .Values.controller.securityContext | indent 10 }}

‎charts/nginx-ingress/templates/controller-deployment.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,12 +93,29 @@ spec:
9393
{{- if .Values.controller.readyStatus.enable }}
9494
- name: readiness-port
9595
containerPort: {{ .Values.controller.readyStatus.port }}
96+
{{- end }}
97+
{{- if .Values.controller.startupStatus.enable }}
98+
- name: startup-port
99+
containerPort: {{ .Values.controller.startupStatus.port }}
100+
{{- end }}
101+
{{- if .Values.controller.readyStatus.enable }}
96102
readinessProbe:
97103
httpGet:
98104
path: /nginx-ready
99105
port: readiness-port
100106
periodSeconds: 1
101107
initialDelaySeconds: {{ .Values.controller.readyStatus.initialDelaySeconds }}
108+
{{- end }}
109+
{{- if .Values.controller.startupStatus.enable }}
110+
startupProbe:
111+
httpGet:
112+
path: {{ .Values.controller.startupStatus.path }}
113+
port: startup-port
114+
initialDelaySeconds: {{ .Values.controller.startupStatus.initialDelaySeconds }}
115+
periodSeconds: {{ .Values.controller.startupStatus.periodSeconds }}
116+
timeoutSeconds: {{ .Values.controller.startupStatus.timeoutSeconds }}
117+
successThreshold: {{ .Values.controller.startupStatus.successThreshold }}
118+
failureThreshold: {{ .Values.controller.startupStatus.failureThreshold }}
102119
{{- end }}
103120
resources:
104121
{{ toYaml .Values.controller.resources | indent 10 }}

‎charts/nginx-ingress/values.schema.json

Lines changed: 95 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1758,6 +1758,98 @@
17581758
}
17591759
]
17601760
},
1761+
"startupStatus": {
1762+
"type": "object",
1763+
"default": {},
1764+
"title": "The startupStatus",
1765+
"required": [],
1766+
"properties": {
1767+
"enable": {
1768+
"type": "boolean",
1769+
"default": false,
1770+
"title": "Enable the startup probe",
1771+
"examples": [
1772+
true
1773+
]
1774+
},
1775+
"port": {
1776+
"type": "integer",
1777+
"default": 0,
1778+
"title": "The port for the startup probe",
1779+
"examples": [
1780+
9999
1781+
]
1782+
},
1783+
"path": {
1784+
"type": "string",
1785+
"default": "",
1786+
"title": "The path for the startup probe",
1787+
"examples": [
1788+
"/"
1789+
]
1790+
},
1791+
"initialDelaySeconds": {
1792+
"type": "integer",
1793+
"default": 0,
1794+
"title": "Initial delay seconds for the startup probe",
1795+
"$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.33.1/_definitions.json#/definitions/io.k8s.api.core.v1.Probe/properties/initialDelaySeconds"
1796+
},
1797+
"periodSeconds": {
1798+
"type": "integer",
1799+
"default": 0,
1800+
"title": "Period seconds for the startup probe",
1801+
"$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.33.1/_definitions.json#/definitions/io.k8s.api.core.v1.Probe/properties/periodSeconds"
1802+
},
1803+
"timeoutSeconds": {
1804+
"type": "integer",
1805+
"default": 0,
1806+
"title": "Timeout seconds for the startup probe",
1807+
"$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.33.1/_definitions.json#/definitions/io.k8s.api.core.v1.Probe/properties/timeoutSeconds"
1808+
},
1809+
"successThreshold": {
1810+
"type": "integer",
1811+
"default": 0,
1812+
"title": "Success threshold for the startup probe",
1813+
"$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.33.1/_definitions.json#/definitions/io.k8s.api.core.v1.Probe/properties/successThreshold"
1814+
},
1815+
"failureThreshold": {
1816+
"type": "integer",
1817+
"default": 0,
1818+
"title": "Failure threshold for the startup probe",
1819+
"$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.33.1/_definitions.json#/definitions/io.k8s.api.core.v1.Probe/properties/failureThreshold"
1820+
}
1821+
},
1822+
"allOf": [
1823+
{
1824+
"if": {
1825+
"properties": {
1826+
"enable": {
1827+
"const": true
1828+
}
1829+
}
1830+
},
1831+
"then": {
1832+
"required": [
1833+
"enable",
1834+
"port",
1835+
"path"
1836+
]
1837+
}
1838+
}
1839+
],
1840+
"examples": [
1841+
{
1842+
"enable": true,
1843+
"port": 9999,
1844+
"path": "/",
1845+
"initialDelaySeconds": 5,
1846+
"periodSeconds": 1,
1847+
"timeoutSeconds": 1,
1848+
"successThreshold": 1,
1849+
"failureThreshold": 30
1850+
}
1851+
]
1852+
},
17611853
"enableLatencyMetrics": {
17621854
"type": "boolean",
17631855
"default": false,
@@ -2333,10 +2425,10 @@
23332425
},
23342426
"endpointHost": {
23352427
"type": "string",
2336-
"default": "product.connect.nginx.com",
2337-
"title": "FQDN or IP for connecting to NGINX One SaaS Console",
2428+
"default": "agent.connect.nginx.com",
2429+
"title": "FQDN or IP for connecting to NGINX One Console",
23382430
"examples": [
2339-
"product.connect.nginx.com"
2431+
"agent.connect.nginx.com"
23402432
]
23412433
},
23422434
"endpointPort": {

0 commit comments

Comments
 (0)