Skip to content

Commit 9b705a4

Browse files
haywoodshhaywoodsh
authored
Merge branch 'main' into feat/7427-sni-in-jwt-policy
2 parents 5cf8aa9 + 745bfa8 commit 9b705a4

File tree

8 files changed

+70
-63
lines changed

8 files changed

+70
-63
lines changed

‎.github/workflows/ci.yml

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,11 @@ on:
1414
description: "Force rebuild"
1515
required: false
1616
default: false
17+
run_tests:
18+
type: boolean
19+
description: "Run unit & e2e tests"
20+
required: false
21+
default: true
1722

1823
defaults:
1924
run:
@@ -35,7 +40,7 @@ jobs:
3540
id-token: write
3641
outputs:
3742
docs_only: ${{ github.event.pull_request && steps.docs.outputs.docs_only == 'true' }}
38-
k8s_latest: "1.32.0"
43+
k8s_latest: ${{ steps.vars.outputs.k8s_latest }}
3944
go_path: ${{ steps.vars.outputs.go_path }}
4045
go_code_md5: ${{ steps.vars.outputs.go_code_md5 }}
4146
binary_cache_hit: ${{ steps.binary-cache.outputs.cache-hit }}
@@ -215,25 +220,25 @@ jobs:
215220
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
216221
with:
217222
go-version-file: go.mod
218-
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' }}
223+
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' && (inputs.run_tests && inputs.run_tests || true) }}
219224

220225
- name: Run Tests
221226
run: make cover
222-
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' }}
227+
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' && (inputs.run_tests && inputs.run_tests || true) }}
223228

224229
- name: Upload coverage to Codecov
225230
uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
226231
with:
227232
files: ./coverage.txt
228233
token: ${{ secrets.CODECOV_TOKEN }} # required
229-
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' }}
234+
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' && (inputs.run_tests && inputs.run_tests || true) }}
230235

231236
- name: Run static check
232237
uses: dominikh/staticcheck-action@024238d2898c874f26d723e7d0ff4308c35589a2 # v1.4.0
233238
with:
234239
version: "v0.6.0"
235240
install-go: false
236-
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' }}
241+
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' && (inputs.run_tests && inputs.run_tests || true) }}
237242

238243
binaries:
239244
name: Build Binaries
@@ -253,7 +258,7 @@ jobs:
253258
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
254259
with:
255260
go-version-file: go.mod
256-
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' }}
261+
if: ${{ (inputs.force && inputs.force || false) || needs.checks.outputs.binary_cache_hit != 'true' }}
257262

258263
- name: Build binaries
259264
uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
@@ -272,14 +277,14 @@ jobs:
272277
AWS_NAP_WAF_DOS_PRODUCT_CODE: ${{ secrets.AWS_NAP_WAF_DOS_PRODUCT_CODE }}
273278
AWS_NAP_WAF_DOS_PUB_KEY: ${{ secrets.AWS_NAP_WAF_DOS_PUB_KEY }}
274279
GORELEASER_CURRENT_TAG: "v${{ needs.checks.outputs.ic_version }}"
275-
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' }}
280+
if: ${{ (inputs.force && inputs.force || false) || needs.checks.outputs.binary_cache_hit != 'true' }}
276281

277282
- name: Store Artifacts in Cache
278283
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
279284
with:
280285
path: ${{ github.workspace }}/dist
281286
key: nginx-ingress-${{ needs.checks.outputs.go_code_md5 }}
282-
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' }}
287+
if: ${{ (inputs.force && inputs.force || false) || needs.checks.outputs.binary_cache_hit != 'true' }}
283288

284289
build-docker:
285290
name: Build Docker OSS
@@ -373,7 +378,7 @@ jobs:
373378
if: ${{ inputs.force || (needs.checks.outputs.forked_workflow == 'true' && needs.checks.outputs.docs_only == 'false') || (needs.checks.outputs.forked_workflow == 'false' && needs.checks.outputs.stable_image_exists != 'true' && needs.checks.outputs.docs_only == 'false') }}
374379

375380
helm-tests:
376-
if: ${{ needs.checks.outputs.docs_only != 'true' }}
381+
if: ${{ needs.checks.outputs.docs_only != 'true' && (inputs.run_tests && inputs.run_tests || true) }}
377382
name: Helm Tests ${{ matrix.base-os }}
378383
runs-on: ubuntu-22.04
379384
needs: [checks, binaries, build-docker, build-docker-plus]
@@ -512,7 +517,7 @@ jobs:
512517
if: ${{ steps.stable_exists.outputs.exists != 'true' && needs.checks.outputs.docs_only == 'false' }}
513518

514519
setup-matrix:
515-
if: ${{ inputs.force || needs.checks.outputs.docs_only != 'true' }}
520+
if: ${{ inputs.force || (inputs.run_tests && inputs.run_tests || true) || needs.checks.outputs.docs_only != 'true' }}
516521
name: Setup Matrix for Smoke Tests
517522
runs-on: ubuntu-22.04
518523
needs: [binaries, checks]
@@ -574,7 +579,7 @@ jobs:
574579
if: ${{ steps.check-image.outcome == 'failure' && needs.checks.outputs.docs_only == 'false' }}
575580

576581
smoke-tests-oss:
577-
if: ${{ inputs.force || needs.checks.outputs.docs_only != 'true' }}
582+
if: ${{ inputs.force || (inputs.run_tests && inputs.run_tests || true) || needs.checks.outputs.docs_only != 'true' }}
578583
name: ${{ matrix.images.label }} ${{ matrix.images.image }} ${{ matrix.k8s }} smoke tests
579584
needs:
580585
- checks
@@ -601,7 +606,7 @@ jobs:
601606
k8s-version: ${{ matrix.k8s }}
602607

603608
smoke-tests-plus:
604-
if: ${{ inputs.force || needs.checks.outputs.docs_only != 'true' }}
609+
if: ${{ inputs.force || (inputs.run_tests && inputs.run_tests || true) || needs.checks.outputs.docs_only != 'true' }}
605610
name: ${{ matrix.images.label }} ${{ matrix.images.image }} ${{ matrix.k8s }} smoke tests
606611
needs:
607612
- checks
@@ -628,7 +633,7 @@ jobs:
628633
k8s-version: ${{ matrix.k8s }}
629634

630635
smoke-tests-nap:
631-
if: ${{ inputs.force || needs.checks.outputs.docs_only != 'true' }}
636+
if: ${{ inputs.force || (inputs.run_tests && inputs.run_tests || true) || needs.checks.outputs.docs_only != 'true' }}
632637
name: ${{ matrix.images.label }} ${{ matrix.images.image }} ${{ matrix.k8s }} smoke tests
633638
needs:
634639
- checks

‎.github/workflows/image-promotion.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -669,7 +669,7 @@ jobs:
669669
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
670670

671671
- name: Create/Update Draft
672-
uses: lucacome/draft-release@38def8b74645796e9743b53e0f187d4a8915ea3e # v1.2.3
672+
uses: lucacome/draft-release@00f74370c044c322da6cb52acc707d62c7762c71 # v1.2.4
673673
id: release-notes
674674
with:
675675
minor-label: "enhancement"

‎.github/workflows/release.yml

Lines changed: 41 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -469,48 +469,50 @@ jobs:
469469
key: nginx-ingress-release-${{ needs.variables.outputs.go_code_md5 }}
470470
if: ${{ needs.variables.outputs.binary_cache_sign_hit != 'true' }}
471471

472-
# azure-upload:
473-
# if: ${{ ! cancelled() && ! failure() && ! contains(inputs.skip_step, 'azure-upload') }}
474-
# name: Upload packages to Azure
475-
# runs-on: ubuntu-22.04
476-
# needs: [variables, binaries]
477-
# permissions:
478-
# id-token: write
479-
# contents: read
480-
# steps:
481-
# - name: Checkout Repository
482-
# uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
483-
# with:
484-
# ref: ${{ inputs.release_branch }}
472+
# Upload packages, sboms & checksums to release storage
473+
azure-upload:
474+
if: ${{ ! cancelled() && ! failure() && ! contains(inputs.skip_step, 'azure-upload') }}
475+
name: Upload packages to Azure
476+
runs-on: ubuntu-22.04
477+
needs: [variables, binaries]
478+
permissions:
479+
id-token: write
480+
contents: read
481+
environment: release
482+
steps:
483+
- name: Checkout Repository
484+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
485+
with:
486+
ref: ${{ inputs.release_branch }}
485487

486-
# - name: Fetch Cached Tarball Artifacts
487-
# uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
488-
# with:
489-
# key: nginx-ingress-release-${{ needs.variables.outputs.go_code_md5 }}
490-
# path: ${{ github.workspace }}/tarballs
491-
# fail-on-cache-miss: true
488+
- name: Fetch Cached Tarball Artifacts
489+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
490+
with:
491+
key: nginx-ingress-release-${{ needs.variables.outputs.go_code_md5 }}
492+
path: ${{ github.workspace }}/tarballs
493+
fail-on-cache-miss: true
492494

493-
# - name: Azure login
494-
# uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
495-
# with:
496-
# client-id: ${{ secrets.AZURE_CLIENT_ID }}
497-
# tenant-id: ${{ secrets.AZURE_TENANT_ID }}
498-
# subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
495+
- name: Azure login
496+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
497+
with:
498+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
499+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
500+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
499501

500-
# - name: Azure Upload Release Packages
501-
# uses: azure/CLI@089eac9d8cc39f5d003e94f8b65efc51076c9cbd # v2.1.0
502-
# with:
503-
# inlineScript: |
504-
# for i in $(find tarballs -type f); do
505-
# echo -n "Uploading ${i} to kubernetes-ingress/v${{ inputs.nic_version }}/${i##*/} ... "
506-
# if ${{ ! inputs.dry_run}}; then
507-
# az storage blob upload --auth-mode=login -f "$i" -c ${{ secrets.AZURE_BUCKET_NAME }} \
508-
# --account-name ${{ secrets.AZURE_STORAGE_ACCOUNT }} --overwrite -n kubernetes-ingress/v${{ inputs.nic_version }}/${i##*/}
509-
# echo "done"
510-
# else
511-
# echo "skipped, dry_run."
512-
# fi
513-
# done
502+
- name: Azure Upload Release Packages
503+
uses: azure/CLI@089eac9d8cc39f5d003e94f8b65efc51076c9cbd # v2.1.0
504+
with:
505+
inlineScript: |
506+
for i in $(find tarballs -type f); do
507+
echo -n "Uploading ${i} to kubernetes-ingress/v${{ inputs.nic_version }}/${i##*/} ... "
508+
if ${{ ! inputs.dry_run}}; then
509+
az storage blob upload --auth-mode=login -f "$i" -c ${{ secrets.AZURE_BUCKET_NAME }} \
510+
--account-name ${{ secrets.AZURE_STORAGE_ACCOUNT }} --overwrite -n kubernetes-ingress/v${{ inputs.nic_version }}/${i##*/}
511+
echo "done"
512+
else
513+
echo "skipped, dry_run."
514+
fi
515+
done
514516
515517
github-release:
516518
if: ${{ ! cancelled() && ! failure() && ! contains(inputs.skip_step, 'github-release') }}

‎.github/workflows/update-release-draft.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ jobs:
6161
ref: ${{ inputs.branch }}
6262

6363
- name: Create/Update Draft
64-
uses: lucacome/draft-release@38def8b74645796e9743b53e0f187d4a8915ea3e # v1.2.3
64+
uses: lucacome/draft-release@00f74370c044c322da6cb52acc707d62c7762c71 # v1.2.4
6565
id: release-notes
6666
with:
6767
minor-label: "enhancement"

‎build/Dockerfile

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,12 @@ ARG PACKAGE_REPO=pkgs.nginx.com
1010

1111

1212
############################################# Base images containing libs for FIPS #############################################
13-
FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi8@sha256:bd9f3b78bc8932fcb3ffdaa4f4901c512439be6e5bec7762715092fea348cb17 AS ubi8-packages
14-
FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi9@sha256:daea8e91cc5f00b21f086f017cfe6f9d04784d4f3c1af39743c8af3861919e6b AS ubi9-packages
13+
FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi8@sha256:ea2f5d57c65b1682418708b6f6c234ba4ace4e48ecceeda97e7bb3a560601efb AS ubi8-packages
14+
FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi9@sha256:7dc715d51c9664d892376fada482f29a95023dc81657f89fa4cf7a62fd98d837 AS ubi9-packages
1515
FROM ghcr.io/nginx/alpine-fips:0.3.0-alpine3.19@sha256:449f1a149e81e36bb929ebd362433a06a158ff2a7e3ba05b4b8d9ea96d59ae91 AS alpine-fips-3.19
1616
FROM ghcr.io/nginx/alpine-fips:0.3.0-alpine3.21@sha256:5e5033f34ae7147ce8df928fa58c485bc08ded8ace22428b4c16df30e3b39901 AS alpine-fips-3.21
17-
FROM redhat/ubi9-minimal:9.6@sha256:383329bf9c4f968e87e85d30ba3a5cb988a3bbde28b8e4932dcd3a025fd9c98c AS ubi-minimal
18-
FROM golang:1.24-alpine@sha256:68932fa6d4d4059845c8f40ad7e654e626f3ebd3706eef7846f319293ab5cb7a AS golang-builder
17+
FROM redhat/ubi9-minimal:9.6@sha256:11db23b63f9476e721f8d0b8a2de5c858571f76d5a0dae2ec28adf08cbaf3652 AS ubi-minimal
18+
FROM golang:1.24-alpine@sha256:ddf52008bce1be455fe2b22d780b6693259aaf97b16383b6372f4b22dd33ad66 AS golang-builder
1919

2020
############################################# NGINX files #############################################
2121
FROM scratch AS nginx-files
@@ -469,7 +469,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
469469

470470

471471
############################################# Base image for UBI8 with NGINX Plus and App Protect WAF #############################################
472-
FROM redhat/ubi8@sha256:312668d24dfec2e2869ab11b679728745a2745835a12aafda8e77f42aec666cb AS ubi-8-plus-nap
472+
FROM redhat/ubi8@sha256:c0b07294568b8c1281d3ad89616ce036095da770a4410147c1755d930b562682 AS ubi-8-plus-nap
473473
ARG NGINX_PLUS_VERSION
474474
ARG BUILD_OS
475475

@@ -508,7 +508,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
508508

509509

510510
############################################# Base image for UBI8 with NGINX Plus and App Protect WAFv5 #############################################
511-
FROM redhat/ubi8@sha256:312668d24dfec2e2869ab11b679728745a2745835a12aafda8e77f42aec666cb AS ubi-8-plus-nap-v5
511+
FROM redhat/ubi8@sha256:c0b07294568b8c1281d3ad89616ce036095da770a4410147c1755d930b562682 AS ubi-8-plus-nap-v5
512512
ARG NGINX_PLUS_VERSION
513513

514514
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}

‎build/dependencies/Dockerfile.ubi8

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# syntax=docker/dockerfile:1.16
2-
FROM redhat/ubi8@sha256:312668d24dfec2e2869ab11b679728745a2745835a12aafda8e77f42aec666cb AS rpm-build
2+
FROM redhat/ubi8@sha256:c0b07294568b8c1281d3ad89616ce036095da770a4410147c1755d930b562682 AS rpm-build
33
RUN mkdir -p /rpms/ \
44
&& dnf install rpm-build gcc make cmake -y \
55
&& rpmbuild --rebuild --nodebuginfo https://mirror.stream.centos.org/9-stream/BaseOS/source/tree/Packages/c-ares-1.19.1-1.el9.src.rpm \

‎build/dependencies/Dockerfile.ubi9

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# syntax=docker/dockerfile:1.16
2-
FROM redhat/ubi9:9.6@sha256:c73e2517941b384059eba8ea4b6ac68dad39a0a2cf0e65c753c778c87c87c321 AS rpm-build
2+
FROM redhat/ubi9:9.6@sha256:e5ab898b4f3e91e31b4d202e92b4ca409ac18c2de77c4813807b3761332bf556 AS rpm-build
33
RUN mkdir -p /rpms/ \
44
&& dnf install rpm-build gcc make cmake -y \
55
&& rpmbuild --rebuild --nodebuginfo https://mirror.stream.centos.org/9-stream/BaseOS/source/tree/Packages/c-ares-1.19.1-1.el9.src.rpm \

‎tests/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ FROM kindest/node:v1.33.1@sha256:050072256b9a903bd914c0b2866828150cb229cea0efe58
55
# this is here so we can grab the latest version of skopeo and have dependabot keep it up to date
66
FROM quay.io/skopeo/stable:v1.19.0
77

8-
FROM python:3.13@sha256:a6af772cf98267c48c145928cbeb35bd8e89b610acd70f93e3e8ac3e96c92af8
8+
FROM python:3.13@sha256:28f60ab75da2183870846130cead1f6af30162148d3238348f78f89cf6160b5d
99

1010
RUN apt-get update \
1111
&& apt-get install -y curl git apache2-utils \

0 commit comments

Comments
 (0)