Skip to content

Add NGINX Agent 3.x WAF support #9740

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AlexFenlon wants to merge 33 commits into
base: main
Choose a base branch
from
Open

Add NGINX Agent 3.x WAF support #9740

Show file tree
Hide file tree
Changes from 26 commits
Commits
Show all changes
33 commits
Select commit Hold shift + click to select a range
ae0c824
WAF + Agent v3
AlexFenlon Apr 21, 2026
a283c07
reorder makefile, update security monitoring readmes
AlexFenlon Apr 27, 2026
f19cc21
Add WAF v5 and Agent v3 support for NGINX Secuirty Monitoring
AlexFenlon Apr 29, 2026
1a9c48e
remove unused files
AlexFenlon Apr 29, 2026
b411691
update agent v3 references in security monitoring examples
AlexFenlon Apr 29, 2026
d026b83
clean up examples
AlexFenlon Apr 29, 2026
657245b
Merge branch 'main' into feat/agent-v3-waf-v5
AlexFenlon Apr 29, 2026
903908d
fix snaps
AlexFenlon Apr 29, 2026
4174f33
Add support for 'agent' suffix in build and stable tags in smoke test…
AlexFenlon Apr 30, 2026
709c0c1
Merge branch 'main' into feat/agent-v3-waf-v5
AlexFenlon Apr 30, 2026
2844723
add missing secret
AlexFenlon Apr 30, 2026
1498c2e
update readmes
AlexFenlon Apr 30, 2026
7bc2b86
address copliot comments
AlexFenlon Apr 30, 2026
a8748b5
address readme changes
AlexFenlon May 1, 2026
aa078e3
remove readme change
AlexFenlon May 1, 2026
93ae9c8
Merge branch 'main' into feat/agent-v3-waf-v5
AlexFenlon May 1, 2026
85048bc
remove unused file
AlexFenlon May 1, 2026
0b4f6b9
add release and patching flow for agent images
AlexFenlon May 1, 2026
3873895
Merge branch 'main' into feat/agent-v3-waf-v5
AlexFenlon May 1, 2026
99b6845
Rename NGINX_AGENT vars to have better names, fix comments in dockerfile
AlexFenlon May 1, 2026
a4510d7
Merge branch 'main' into feat/agent-v3-waf-v5
AlexFenlon May 5, 2026
d7e07d0
Remove agent v2 additional fields in make targets.
AlexFenlon May 6, 2026
7d7edeb
Merge branch 'main' into feat/agent-v3-waf-v5
AlexFenlon May 6, 2026
3fa32a6
Merge branch 'main' into feat/agent-v3-waf-v5
AlexFenlon May 7, 2026
f9e4802
Merge branch 'main' into feat/agent-v3-waf-v5
AlexFenlon May 13, 2026
baa3319
fix snaps since merge
AlexFenlon May 13, 2026
ae7016e
refactor Dockerfile to make it cleaner which image is related to which.
AlexFenlon May 13, 2026
d028f56
add note about otel collector
AlexFenlon May 13, 2026
f9307a6
Merge branch 'main' into feat/agent-v3-waf-v5
AlexFenlon May 13, 2026
1da26a7
fix snap
AlexFenlon May 13, 2026
fb94122
address comments
AlexFenlon May 13, 2026
862dd1f
address commnets and fix snaps
AlexFenlon May 14, 2026
3f2399d
Merge branch 'main' into feat/agent-v3-waf-v5
AlexFenlon May 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/config/config-gcr-retag
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,8 @@ export TARGET_REGISTRY=gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev
# declare -a NAP_DOS_TAG_POSTFIX_LIST=("" "-ubi" "-mktpl")
# declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-ubi" "-mktpl")
declare -a PLUS_TAG_POSTFIX_LIST=("" "-ubi" "-alpine" "-alpine-fips")
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips")
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips")
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips" "-agent" "-ubi-agent" "-ubi8-agent" "-alpine-fips-agent")
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips" "-agent" "-ubi-agent" "-ubi8-agent" "-alpine-fips-agent")
declare -a NAP_DOS_TAG_POSTFIX_LIST=("" "-ubi")
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-ubi")
declare -a ADDITIONAL_TAGS=()
4 changes: 2 additions & 2 deletions .github/config/config-plus-gcr-release
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,8 @@ export TARGET_REGISTRY=gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release
# declare -a NAP_DOS_TAG_POSTFIX_LIST=("" "-ubi" "-mktpl")
# declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-ubi" "-mktpl")
declare -a PLUS_TAG_POSTFIX_LIST=("" "-ubi" "-alpine" "-alpine-fips")
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips")
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=("" "-ubi" "-alpine-fips" "-ubi8")
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips" "-agent" "-ubi-agent" "-ubi8-agent" "-alpine-fips-agent")
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=("" "-ubi" "-alpine-fips" "-ubi8" "-agent" "-ubi-agent" "-alpine-fips-agent" "-ubi8-agent")
declare -a NAP_DOS_TAG_POSTFIX_LIST=("" "-ubi")
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-ubi")
declare -a ADDITIONAL_TAGS=("latest" "${ADDITIONAL_TAG}")
Expand Down
4 changes: 2 additions & 2 deletions .github/config/config-plus-nginx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
export TARGET_REGISTRY=docker-mgmt.nginx.com
export TARGET_NAP_WAF_DOS_IMAGE_PREFIX="nginx-ic-nap-dos/nginx-plus-ingress"
declare -a PLUS_TAG_POSTFIX_LIST=("" "-ubi" "-alpine" "-alpine-fips")
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips")
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips")
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips" "-agent" "-ubi-agent" "-ubi8-agent" "-alpine-fips-agent")
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips" "-agent" "-ubi-agent" "-ubi8-agent" "-alpine-fips-agent")
declare -a NAP_DOS_TAG_POSTFIX_LIST=("" "-ubi")
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-ubi")
export PUBLISH_OSS=false
57 changes: 56 additions & 1 deletion .github/data/matrix-images-nap.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
{
"image": [
"debian-plus-nap"
"debian-plus-nap",
"debian-plus-nap-agent"
],
"platforms": [
"linux/amd64"
Expand All @@ -20,53 +21,107 @@
"platforms": "linux/amd64",
"nap_modules": "waf"
},
{
"image": "ubi-8-plus-nap-agent",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "waf"
},
{
"image": "ubi-8-plus-nap-v5",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "waf"
},
{
"image": "ubi-8-plus-nap-v5-agent",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "waf"
},
{
"image": "ubi-9-plus-nap",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "waf"
},
{
"image": "ubi-9-plus-nap-agent",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "waf"
},
{
"image": "ubi-9-plus-nap",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "dos"
},
{
"image": "ubi-9-plus-nap-agent",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "dos"
},
{
"image": "ubi-9-plus-nap",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "waf,dos"
},
{
"image": "ubi-9-plus-nap-agent",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "waf,dos"
},
{
"image": "alpine-plus-nap-fips",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "waf"
},
{
"image": "alpine-plus-nap-fips-agent",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "waf"
},
{
"image": "alpine-plus-nap-v5-fips",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "waf"
},
{
"image": "alpine-plus-nap-v5-fips-agent",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "waf"
},
{
"image": "debian-plus-nap-v5",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "waf"
},
{
"image": "debian-plus-nap-v5-agent",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "waf"
},
{
"image": "ubi-9-plus-nap-v5",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "waf"
},
{
"image": "ubi-9-plus-nap-v5-agent",
"target": "goreleaser",
"platforms": "linux/amd64",
"nap_modules": "waf"
}
]
}
8 changes: 8 additions & 0 deletions .github/data/matrix-smoke-nap.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,14 @@
"nap_modules": "waf",
"marker": "agentv2",
"platforms": "linux/amd64"
},
{
"label": "AGENT_V3_NAP 1/1",
"image": "debian-plus-nap-agent",
"type": "plus",
"nap_modules": "waf",
"marker": "agentv3",
"platforms": "linux/amd64"
}
],
"k8s": []
Expand Down
48 changes: 48 additions & 0 deletions .github/data/patch-images.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,5 +112,53 @@
"source_os": "ubi",
"target_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-dos-nap/nginx-plus-ingress",
"platforms": "linux/amd64"
},
{
"source_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-nap/nginx-plus-ingress",
"source_os": "debian-agent",
"target_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-nap/nginx-plus-ingress",
"platforms": "linux/amd64"
},
{
"source_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-nap/nginx-plus-ingress",
"source_os": "ubi-agent",
"target_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-nap/nginx-plus-ingress",
"platforms": "linux/amd64"
},
{
"source_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-nap/nginx-plus-ingress",
"source_os": "ubi8-agent",
"target_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-nap/nginx-plus-ingress",
"platforms": "linux/amd64"
},
{
"source_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-nap/nginx-plus-ingress",
"source_os": "alpine-fips-agent",
"target_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-nap/nginx-plus-ingress",
"platforms": "linux/amd64"
},
{
"source_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-nap-v5/nginx-plus-ingress",
"source_os": "debian-agent",
"target_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-nap-v5/nginx-plus-ingress",
"platforms": "linux/amd64"
},
{
"source_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-nap-v5/nginx-plus-ingress",
"source_os": "ubi-agent",
"target_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-nap-v5/nginx-plus-ingress",
"platforms": "linux/amd64"
},
{
"source_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-nap-v5/nginx-plus-ingress",
"source_os": "ubi8-agent",
"target_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-nap-v5/nginx-plus-ingress",
"platforms": "linux/amd64"
},
{
"source_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-nap-v5/nginx-plus-ingress",
"source_os": "alpine-fips-agent",
"target_image": "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-nap-v5/nginx-plus-ingress",
"platforms": "linux/amd64"
}
]
2 changes: 1 addition & 1 deletion .github/workflows/build-plus.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,7 +169,7 @@ jobs:
images: |
name=gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic${{ contains(inputs.nap-modules, 'dos') && '-dos' || '' }}${{ contains(inputs.nap-modules, 'waf') && '-nap' || '' }}${{ contains(inputs.image, 'v5') && '-v5' || '' }}/nginx-plus-ingress
flavor: |
suffix=${{ contains(inputs.image, 'ubi-9') && '-ubi' || '' }}${{ contains(inputs.image, 'ubi-8') && '-ubi8' || '' }}${{ contains(inputs.image, 'alpine') && '-alpine' || '' }}${{ contains(inputs.target, 'aws') && '-mktpl' || '' }}${{ contains(inputs.image, 'fips') && '-fips' || ''}}
suffix=${{ contains(inputs.image, 'ubi-9') && '-ubi' || '' }}${{ contains(inputs.image, 'ubi-8') && '-ubi8' || '' }}${{ contains(inputs.image, 'alpine') && '-alpine' || '' }}${{ contains(inputs.target, 'aws') && '-mktpl' || '' }}${{ contains(inputs.image, 'fips') && '-fips' || ''}}${{ contains(inputs.image, 'agent') && '-agent' || '' }}
Comment thread
AlexFenlon marked this conversation as resolved.
tags: |
type=raw,value=${{ inputs.tag }}
labels: |
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/setup-smoke.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,8 +62,8 @@ jobs:
id: image_details
run: |
echo "name=gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic${{ contains(inputs.nap-modules, 'dos') && '-dos' || '' }}${{ contains(inputs.nap-modules, 'waf') && '-nap' || '' }}${{ contains(inputs.image, 'v5') && '-v5' || '' }}/nginx${{ contains(inputs.image, 'plus') && '-plus' || '' }}-ingress" >> $GITHUB_OUTPUT
echo "build_tag=${{ inputs.build-tag }}${{ contains(inputs.image, 'ubi-9') && '-ubi' || '' }}${{ contains(inputs.image, 'ubi-8') && '-ubi8' || '' }}${{ contains(inputs.image, 'alpine') && '-alpine' || '' }}${{ contains(inputs.target, 'aws') && '-mktpl' || '' }}${{ contains(inputs.image, 'fips') && '-fips' || ''}}" >> $GITHUB_OUTPUT
echo "stable_tag=${{ inputs.stable-tag }}${{ contains(inputs.image, 'ubi-9') && '-ubi' || '' }}${{ contains(inputs.image, 'ubi-8') && '-ubi8' || '' }}${{ contains(inputs.image, 'alpine') && '-alpine' || '' }}${{ contains(inputs.target, 'aws') && '-mktpl' || '' }}${{ contains(inputs.image, 'fips') && '-fips' || ''}}" >> $GITHUB_OUTPUT
echo "build_tag=${{ inputs.build-tag }}${{ contains(inputs.image, 'ubi-9') && '-ubi' || '' }}${{ contains(inputs.image, 'ubi-8') && '-ubi8' || '' }}${{ contains(inputs.image, 'alpine') && '-alpine' || '' }}${{ contains(inputs.target, 'aws') && '-mktpl' || '' }}${{ contains(inputs.image, 'fips') && '-fips' || ''}}${{ contains(inputs.image, 'agent') && '-agent' || '' }}" >> $GITHUB_OUTPUT
echo "stable_tag=${{ inputs.stable-tag }}${{ contains(inputs.image, 'ubi-9') && '-ubi' || '' }}${{ contains(inputs.image, 'ubi-8') && '-ubi8' || '' }}${{ contains(inputs.image, 'alpine') && '-alpine' || '' }}${{ contains(inputs.target, 'aws') && '-mktpl' || '' }}${{ contains(inputs.image, 'fips') && '-fips' || ''}}${{ contains(inputs.image, 'agent') && '-agent' || '' }}" >> $GITHUB_OUTPUT
Comment thread
AlexFenlon marked this conversation as resolved.

- name: Azure login
uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
Expand Down
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,7 @@ examples/ingress-resources/proxy-set-headers/mergeable-ingress/cafe-secret.yaml
examples/ingress-resources/proxy-set-headers/standard-ingress/cafe-secret.yaml
examples/ingress-resources/rate-limit/cafe-secret.yaml
examples/ingress-resources/security-monitoring/cafe-secret.yaml
examples/ingress-resources/security-monitoring-v5/cafe-secret.yaml
examples/ingress-resources/cors/cafe-secret.yaml
examples/ingress-resources/ingress-mtls/cafe-secret.yaml
examples/ingress-resources/session-persistence/cafe-secret.yaml
Expand Down
Loading
Loading