ingress-nginx-controller-1.12.yaml

#nolint:valid-pipeline-fetch-digest,valid-pipeline-git-checkout-commit,valid-pipeline-git-checkout-tag
package:
  name: ingress-nginx-controller-1.12
  version: 1.12.0
  # There are manual changes to review between each package update. See 'vars:' section
  epoch: 14
  description: "Ingress-NGINX Controller for Kubernetes"
  copyright:
    - license: Apache-2.0
  resources:
    cpu: 16
    memory: 16Gi
  dependencies:
    provides:
      - ingress-nginx-controller=${{package.full-version}}
    runtime:
      - ca-certificates-bundle
      - ca-certificates
      - curl
      - dumb-init-privileged-netbindservice
      - openssh-client
      - openssl
      - openssl-dev
      - libcrypt1
      - msgpack
      - yaml-cpp
      - ssdeep
      - luajit
      - lua-cjson
      - lua-resty-balancer
      - lua-resty-cache
      - lua-resty-cookie
      - lua-resty-core
      - lua-resty-dns
      - lua-resty-global-throttle
      - lua-resty-http
      - lua-resty-ipmatcher
      - lua-resty-lock
      - lua-resty-memcached
      - lua-resty-redis
      - lua-resty-string
      - lua-resty-upload
      - brotli
      - gd
      - libmaxminddb
      - libxml2
      - libxslt
      - modsecurity
      - mimalloc
      - pcre

var-transforms:
  - from: ${{package.version}}
    match: ^(\d+\.\d+)\.\d+$
    replace: "$1"
    to: nginx-ingress-major-minor
  - from: ${{package.version}}
    match: ^(\d+)\.\d+\.\d+$
    replace: "$1"
    to: nginx-ingress-major

environment:
  contents:
    packages:
      - abseil-cpp-dev
      - autoconf
      - automake
      - bash
      - bison
      - brotli-dev
      - busybox
      - c-ares-dev
      - ca-certificates
      - ca-certificates-bundle
      - clang-15
      - cmake
      - curl
      - curl-dev
      - doxygen
      - findutils
      - flex
      - gcc
      - gd-dev
      - git
      - glibc-dev
      - go
      - grpc-dev
      - icu-dev
      - libaio-dev
      - libcap
      - libcap-utils
      - libedit-dev
      - libmaxminddb-dev
      - libprotobuf
      - libsrt
      - libtool
      - libxml2
      - libxml2-dev
      - libxslt-dev
      - linux-headers
      - lmdb-dev
      - lmdb-tools
      - lua-cjson
      - lua-resty-balancer
      - lua-resty-cache
      - lua-resty-cookie
      - lua-resty-core
      - lua-resty-dns
      - lua-resty-global-throttle
      - lua-resty-http
      - lua-resty-ipmatcher
      - lua-resty-lock
      - lua-resty-memcached
      - lua-resty-redis
      - lua-resty-string
      - lua-resty-upload
      - luajit
      - luajit-dev
      - make
      - mercurial
      - mimalloc
      - modsecurity
      - msgpack
      - openssh-client
      - openssl
      - openssl-dev
      - opentelemetry-cpp-dev
      - patch
      - pcre-dev
      - perl-dev
      - pkgconf
      - protobuf-dev
      - python3
      - re2-dev
      - scanelf
      - ssdeep
      - systemd-dev
      - util-linux
      - wget
      - wolfi-base
      - yajl-dev
      - yaml-cpp
      - zeromq-dev
      - zlib-dev

vars:
  # These environment variables need updated for each new release. Retrieve their
  # correct values from here, replacing <package-version> with the package version.
  #   - https://github.com/kubernetes/ingress-nginx/blob/controller-v<package-version>/images/nginx/rootfs/build.sh
  # On occasion, these versions may be bumped ahead of upstream (above link), to
  # remediate vulnerabilities.
  NGINX_VERSION: "1.25.5"
  NDK_VERSION: "0.3.3"
  SETMISC_VERSION: "0.33"
  MORE_HEADERS_VERSION: "0.37"
  NGINX_DIGEST_AUTH: "1.0.0"
  NGINX_SUBSTITUTIONS: "e12e965ac1837ca709709f9a26f572a54d83430e"
  OWASP_MODSECURITY_CRS_VERSION: "v4.4.0"
  LUA_NGX_VERSION: "0.10.28"
  LUA_STREAM_NGX_VERSION: "0.0.16"
  LUA_UPSTREAM_VERSION: "542be0893543a4e42d89f6dd85372972f5ff2a36"
  GEOIP2_VERSION: "a607a41a8115fecfc05b5c283c81532a3d605425"
  # Does not do versioning, and repo is seldom updated. Grab the latest master
  # branch git commit SHA: https://github.com/google/ngx_brotli/commits/master
  NGX_BROTLI_SHA: 63ca02abdcf79c9e788d2eedcc388d2335902e52
  # TODO: ModSecurity-nginx needs a release beyond v1.0.3 to work properly
  # see https://github.com/owasp-modsecurity/ModSecurity-nginx/issues/324
  MODSECURITY_NGINX_VERSION: "0b4f0cf38502f34a30c8543039f345cfc075670d"
  # Instrumentation for nginx plugin: https://github.com/open-telemetry/opentelemetry-cpp-contrib
  # NOTE: this is really really critical and the config can break in backwards compatible way!!
  # We should always use the SHA available in release-x.y branch of upstream project (e.g. https://github.com/kubernetes/ingress-nginx/blob/release-1.12/images/nginx/rootfs/build.sh#L532)
  # please check https://github.com/open-telemetry/opentelemetry-cpp-contrib/compare/8933841f0a7f8737f61404cf0a64acf6b079c8a5...main for regression
  OTEL_SHA: "8933841f0a7f8737f61404cf0a64acf6b079c8a5"

pipeline:
  - uses: git-checkout
    with:
      repository: https://github.com/kubernetes/ingress-nginx
      tag: controller-v${{package.version}}
      expected-commit: 8ee4384271e081578bb8f08eccf2f3b5a78ada25

  - uses: git-checkout
    with:
      repository: https://github.com/owasp-modsecurity/ModSecurity-nginx
      branch: master
      expected-commit: ${{vars.MODSECURITY_NGINX_VERSION}}
      destination: ModSecurity-nginx-${{vars.MODSECURITY_NGINX_VERSION}}

  - uses: go/bump
    with:
      deps: |-
        golang.org/x/oauth2@v0.27.0
        golang.org/x/net@v0.36.0

  - name: Build ingress-nginx controller from source
    runs: |
      export PKG="k8s.io/ingress-nginx"
      export COMMIT_SHA=$(git rev-parse --short HEAD)
      export REPO_INFO=$(git config --get remote.origin.url)$

      mkdir -p ${{targets.destdir}}

      export CGO_ENABLED=0

      go build -x -v \
      -trimpath -ldflags="-buildid= -w \
      -X ${PKG}/version.RELEASE=controller-v${{package.version}} \
      -X ${PKG}/version.COMMIT=${COMMIT_SHA} \
      -X ${PKG}/version.REPO=${REPO_INFO}" \
      -o "${{targets.destdir}}/usr/bin/nginx-dbg" ${PKG}/cmd/dbg

      go build -x -v \
      -trimpath -ldflags="-buildid= -w \
      -X ${PKG}/version.RELEASE=controller-v${{package.version}} \
      -X ${PKG}/version.COMMIT=${COMMIT_SHA} \
      -X ${PKG}/version.REPO=${REPO_INFO}" \
      -o "${{targets.destdir}}/usr/bin/waitshutdown" ${PKG}/cmd/waitshutdown

      go build -x -v \
      -trimpath -ldflags="-buildid= -w \
      -X ${PKG}/version.RELEASE=controller-v${{package.version}} \
      -X ${PKG}/version.COMMIT=${COMMIT_SHA} \
      -X ${PKG}/version.REPO=${REPO_INFO}" \
      -o "${{targets.destdir}}/usr/bin/nginx-ingress-controller" ${PKG}/cmd/nginx

      getcap ${{targets.destdir}}/usr/bin/nginx-ingress-controller

  - uses: fetch
    with:
      uri: https://nginx.org/download/nginx-${{vars.NGINX_VERSION}}.tar.gz
      expected-sha256: 2fe2294f8af4144e7e842eaea884182a84ee7970e11046ba98194400902bbec0
      strip-components: 0

  - uses: fetch
    with:
      uri: https://github.com/simpl/ngx_devel_kit/archive/v${{vars.NDK_VERSION}}.tar.gz
      expected-sha256: faa2fcd5168b10764d35081356511d5f84db5c526a1aa4b6add2db94b6853b2b
      strip-components: 0

  - uses: fetch
    with:
      uri: https://github.com/openresty/set-misc-nginx-module/archive/v${{vars.SETMISC_VERSION}}.tar.gz
      expected-sha256: cd5e2cc834bcfa30149e7511f2b5a2183baf0b70dc091af717a89a64e44a2985
      strip-components: 0

  - runs: |
      rm -rf v0.33.tar.gz

  - uses: fetch
    with:
      uri: https://github.com/openresty/headers-more-nginx-module/archive/v${{vars.MORE_HEADERS_VERSION}}.tar.gz
      expected-sha256: cf6e169d6b350c06d0c730b0eaf4973394026ad40094cddd3b3a5b346577019d
      strip-components: 0

  - uses: fetch
    with:
      uri: https://github.com/yaoweibin/ngx_http_substitutions_filter_module/archive/${{vars.NGINX_SUBSTITUTIONS}}.tar.gz
      expected-sha256: da2a26aa75884e1216941c7291b6e8b7fc4dd7163700a04191b92060b61fabb3
      strip-components: 0

  - uses: fetch
    with:
      uri: https://github.com/openresty/lua-nginx-module/archive/v${{vars.LUA_NGX_VERSION}}.tar.gz
      expected-sha256: 634827d54de6216cb0502d14f76610788b3a3e33160e91d5578d6db0d9a34a20
      strip-components: 0

  - uses: fetch
    with:
      uri: https://github.com/openresty/stream-lua-nginx-module/archive/v${{vars.LUA_STREAM_NGX_VERSION}}.tar.gz
      expected-sha256: 3b1103cf5ee940ea94711eae1a7ccc1a161273ec9a08eb415f1d45ad385f967d
      strip-components: 0

  - uses: fetch
    with:
      uri: https://github.com/openresty/lua-upstream-nginx-module/archive/${{vars.LUA_UPSTREAM_VERSION}}.tar.gz
      expected-sha256: 41fd8c0edcd53e61ed5694ac8460043cc58fbc367acd7bb73e9c1a44c470168e
      strip-components: 0

  - uses: fetch
    with:
      uri: https://github.com/atomx/nginx-http-auth-digest/archive/v${{vars.NGINX_DIGEST_AUTH}}.tar.gz
      expected-sha256: f09851e6309560a8ff3e901548405066c83f1f6ff88aa7171e0763bd9514762b
      strip-components: 0

  - uses: fetch
    with:
      uri: https://github.com/leev/ngx_http_geoip2_module/archive/${{vars.GEOIP2_VERSION}}.tar.gz
      expected-sha256: b6c9c09fd43eb34a71e706ad780b2ead26549a9a9f59280fe558f5b7b980b7c6
      strip-components: 0

  - runs: |
      git clone https://github.com/google/ngx_brotli.git
      cd ngx_brotli
      git checkout ${{vars.NGX_BROTLI_SHA}}
      git submodule init
      git submodule update

  - name: Build NGINX
    runs: |
      export BUILD_PATH="${PWD}"
      echo "BUILD_PATH $BUILD_PATH"
      echo "Arch: $(uname -m)"
      # improve compilation times
      CORES=$(($(grep -c ^processor /proc/cpuinfo) - 1))

      export LUAJIT_LIB="$(pkgconf --variable=libdir luajit)"
      export LUAJIT_INC="$(pkgconf --variable=includedir luajit)"
      export LUA_LIB_DIR="$LUAJIT_LIB/lua"
      ln -s "$LUAJIT_INC" /usr/include/lua
      export LUA_INCLUDE_DIR=/usr/include/luajit-2.1
      ln -s $LUA_INCLUDE_DIR /usr/include/lua5.1
      ARCH=$(uname -m)

      ls -lah ${BUILD_PATH}/lua-nginx-module-${{vars.LUA_NGX_VERSION}}

      mkdir -p ${{targets.destdir}}/etc/nginx/

      # Lua code copied into the target
      cp -ar rootfs/etc/nginx/. ${{targets.destdir}}/etc/nginx/

      # Download owasp modsecurity crs
      cd ${{targets.destdir}}/etc/nginx/

      git clone -b ${{vars.OWASP_MODSECURITY_CRS_VERSION}} https://github.com/coreruleset/coreruleset owasp-modsecurity-crs
      cd owasp-modsecurity-crs

      mv crs-setup.conf.example crs-setup.conf
      mv rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
      mv rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf

      # OWASP CRS v3 rules
      echo '
      Include /etc/nginx/owasp-modsecurity-crs/crs-setup.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-901-INITIALIZATION.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-905-COMMON-EXCEPTIONS.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-910-IP-REPUTATION.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-912-DOS-PROTECTION.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-950-DATA-LEAKAGES.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-959-BLOCKING-EVALUATION.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf
      Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
      ' > ${{targets.destdir}}/etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf


      echo "::::::::::::::::::::::::::::::::::::::"
      echo ":::: nginx-${{vars.NGINX_VERSION}} ::::"
      echo "::::::::::::::::::::::::::::::::::::::"

      cd "$BUILD_PATH/nginx-${{vars.NGINX_VERSION}}"

      for p in $(ls $BUILD_PATH/images/nginx-1.25/rootfs/patches/*.patch); do
        echo "Patching $p..."
        patch -p1 $p
      done

      WITH_FLAGS="--with-debug \
      --with-compat \
      --with-pcre-jit \
      --with-http_ssl_module \
      --with-http_stub_status_module \
      --with-http_realip_module \
      --with-http_auth_request_module \
      --with-http_addition_module \
      --with-http_gzip_static_module \
      --with-http_sub_module \
      --with-http_v2_module \
      --with-stream \
      --with-stream_ssl_module \
      --with-stream_realip_module \
      --with-stream_ssl_preread_module \
      --with-threads \
      --with-http_secure_link_module \
      --with-http_gunzip_module"

      WITH_MODULES=" \
      --add-module=${BUILD_PATH}/ngx_devel_kit-${{vars.NDK_VERSION}} \
      --add-module=${BUILD_PATH}/set-misc-nginx-module-${{vars.SETMISC_VERSION}} \
      --add-module=${BUILD_PATH}/headers-more-nginx-module-${{vars.MORE_HEADERS_VERSION}} \
      --add-module=${BUILD_PATH}/ngx_http_substitutions_filter_module-${{vars.NGINX_SUBSTITUTIONS}} \
      --add-module=${BUILD_PATH}/lua-nginx-module-${{vars.LUA_NGX_VERSION}} \
      --add-module=${BUILD_PATH}/stream-lua-nginx-module-${{vars.LUA_STREAM_NGX_VERSION}} \
      --add-module=${BUILD_PATH}/lua-upstream-nginx-module-${{vars.LUA_UPSTREAM_VERSION}}  \
      --add-dynamic-module=${BUILD_PATH}/nginx-http-auth-digest-${{vars.NGINX_DIGEST_AUTH}} \
      --add-dynamic-module=${BUILD_PATH}/ModSecurity-nginx-${{vars.MODSECURITY_NGINX_VERSION}}  \
      --add-dynamic-module=${BUILD_PATH}/ngx_http_geoip2_module-${{vars.GEOIP2_VERSION}}  \
      --add-dynamic-module=${BUILD_PATH}/ngx_brotli"

      # "Combining -flto with -g is currently experimental and expected to produce unexpected results."
      # https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html
      CC_OPT="-g -O2 -fPIE -fstack-protector-strong \
      -Wformat \
      -Werror=format-security \
      -Wno-deprecated-declarations \
      -fno-strict-aliasing \
      -D_FORTIFY_SOURCE=2 \
      --param=ssp-buffer-size=4 \
      -DTCP_FASTOPEN=23 \
      -fPIC \
      -Wno-cast-function-type"

      LD_OPT="-fPIE -fPIC -pie -Wl,-z,relro -Wl,-z,now"

      if [[ ${ARCH} != "aarch64" ]]; then
        WITH_FLAGS="${WITH_FLAGS} --with-file-aio"
      fi

      if [[ ${ARCH} == "x86_64" ]]; then
        CC_OPT="${CC_OPT} -m64 -mtune=generic"
      fi

      echo "::::::::::::::::::::::::::::::::::::::::::::::::::::"
      echo ":::: Configuring nginx-${{vars.NGINX_VERSION }} ::::"
      echo "::::::::::::::::::::::::::::::::::::::::::::::::::"

      ./configure \
      --prefix=/usr \
      --conf-path=/etc/nginx/nginx.conf \
      --modules-path=/etc/nginx/modules \
      --http-log-path=/var/log/nginx/access.log \
      --error-log-path=/var/log/nginx/error.log \
      --lock-path=/var/lock/nginx.lock \
      --pid-path=/run/nginx.pid \
      --http-client-body-temp-path=/var/lib/nginx/body \
      --http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
      --http-proxy-temp-path=/var/lib/nginx/proxy \
      --http-scgi-temp-path=/var/lib/nginx/scgi \
      --http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
      ${WITH_FLAGS} \
      --without-mail_pop3_module \
      --without-mail_smtp_module \
      --without-mail_imap_module \
      --without-http_uwsgi_module \
      --without-http_scgi_module \
      --with-cc-opt="${CC_OPT}" \
      --with-ld-opt="${LD_OPT}" \
      --user=www-data \
      --group=www-data \
      ${WITH_MODULES}

      echo "::::::::::::::::::::::::::::::::::::::::::::::"
      echo ":::: MAKE nginx-${{vars.NGINX_VERSION }} ::::"
      echo "::::::::::::::::::::::::::::::::::::::::::::"
      make -j$(nproc)

      echo ":::::::::::::::::::::::::::::::::::::::::::::::::"
      echo ":::: MODULES nginx-${{vars.NGINX_VERSION }}  ::::"
      echo ":::::::::::::::::::::::::::::::::::::::::::::::::"
      make DESTDIR="${{targets.destdir}}" modules

      echo "::::::::::::::::::::::::::::::::::::::::::::::::"
      echo ":::: INSTALL nginx-${{vars.NGINX_VERSION }} ::::"
      echo "::::::::::::::::::::::::::::::::::::::::::::::"
      make DESTDIR="${{targets.destdir}}" install

      mkdir -p ${{targets.destdir}}/usr/bin
      mv ${{targets.destdir}}/usr/sbin/nginx ${{targets.destdir}}/usr/bin/
      rm -rf ${{targets.destdir}}/usr/html
      rm -rf ${{targets.destdir}}/usr/sbin

      echo "::::::::::::::::::::::::::::::::::::::::::::"
      echo ":::::::::::::::: CLEANUP :::::::::::::::::::"
      echo "::::::::::::::::::::::::::::::::::::::::::::"

      echo "Clean up owasp-modsecurity-crs"
      rm -rf ${{targets.destdir}}/etc/nginx/owasp-modsecurity-crs/.git
      rm -rf ${{targets.destdir}}/etc/nginx/owasp-modsecurity-crs/util/regression-tests
      rm -rf ${{targets.destdir}}/etc/nginx/owasp-modsecurity-crs/tests

  - uses: strip

  - runs: |
      echo "::::::::::::::::::::::::::::::::::::::::::"
      echo ":::: SETCAP NGINX CONTROLLER           ::::"
      echo "::::::::::::::::::::::::::::::::::::::::::"

      setcap cap_net_bind_service=+ep ${{targets.destdir}}/usr/bin/nginx-ingress-controller \
      && setcap -v cap_net_bind_service=+ep ${{targets.destdir}}/usr/bin/nginx-ingress-controller

      echo "::::::::::::::::::::::::::::::::::::::::::"
      echo ":::: SETCAP NGINX                      ::::"
      echo "::::::::::::::::::::::::::::::::::::::::::"

      setcap cap_net_bind_service=+ep ${{targets.destdir}}/usr/bin/nginx \
        && setcap -v cap_net_bind_service=+ep ${{targets.destdir}}/usr/bin/nginx

subpackages:
  - name: ingress-nginx-controller-bitnami-compat-${{vars.nginx-ingress-major-minor}}
    description: Compatibility package with bitnami/nginx-ingress-controller image
    dependencies:
      provides:
        - ingress-nginx-controller-bitnami-compat=${{package.full-version}}
      runtime:
        - bash # https://github.com/bitnami/charts/blob/db53e622ecf1be5a78d1ce683cec8baa41110fa3/bitnami/nginx-ingress-controller/templates/controller-deployment.yaml#L89
        - coreutils
        - curl
        - findutils
        - gmp
        - gnutls
        - grep
        - ingress-nginx-controller-compat-${{vars.nginx-ingress-major-minor}} # We depend on generic compat because it ships some symlinks that also Bitnami needs, like symlinks to /nginx-ingress-controller, /dev/stdout and /dev/stderr.
        - libffi
        #- libhogweed6 missing pkg/so # https://github.com/bitnami/containers/blob/942861e0cea74a6a07bceafb299180a2733c0bfe/bitnami/nginx-ingress-controller/1/debian-12/Dockerfile#L29
        - libmaxminddb-dev
        - librtmp
        - libssh
        - libtasn1
        - nettle
        - p11-kit
        - procps
        - sed
    pipeline:
      - uses: bitnami/compat
        with:
          image: nginx-ingress-controller
          version-path: ${{vars.nginx-ingress-major}}/debian-12
      - name: Ensure symlinks
        runs: |
          mkdir -p ${{targets.subpkgdir}}/opt/bitnami/common/bin
          ln -s /usr/bin/mmdblookup ${{targets.subpkgdir}}/opt/bitnami/common/bin/mmdblookup
          ln -s /usr/lib ${{targets.subpkgdir}}/opt/bitnami/common/lib
          ln -s /usr/include ${{targets.subpkgdir}}/opt/bitnami/common/include
    test:
      environment:
        contents:
          packages:
            - libmaxminddb
            - ${{package.name}}
        environment:
          BITNAMI_APP_NAME: nginx-ingress-controller
      pipeline:
        - uses: test/tw/ldd-check
          with:
            packages: ${{subpkg.name}}
        - name: Test symlinks
          runs: |
            set -e
            test -f $(readlink -f /opt/bitnami/common/bin/mmdblookup)
            test -d $(readlink -f /opt/bitnami/common/lib)
            test -d $(readlink -f /opt/bitnami/common/include)
        - name: Run KwoK
          uses: test/kwok/cluster
        - name: Test entrypoint and controller logs
          uses: test/daemon-check-output
          with:
            start: |
              /nginx-ingress-controller --kubeconfig ~/.kube/config
            timeout: 30
            expected_output: |
              NGINX Ingress controller
              Release:       controller-v${{package.version}}
              nginx version: nginx/${{vars.NGINX_VERSION}}
              Running in Kubernetes cluster

  - name: ingress-nginx-controller-compat-${{vars.nginx-ingress-major-minor}}
    description: Compatibility package for ingress-nginx-controller
    dependencies:
      provides:
        - ingress-nginx-controller-compat=${{package.full-version}}
      runtime:
        - ingress-nginx-opentelemetry-plugin-${{vars.nginx-ingress-major-minor}}
        - modsecurity-config
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/usr/local/bin
          ln -s /usr/bin/nginx ${{targets.subpkgdir}}/usr/local/bin/nginx

          mkdir -p ${{targets.subpkgdir}}/usr/bin
          ln -s /usr/bin/nginx-ingress-controller ${{targets.subpkgdir}}/nginx-ingress-controller
          ln -s /usr/bin/waitshutdown ${{targets.subpkgdir}}/waitshutdown
          ln -s /usr/bin/nginx-dbg ${{targets.subpkgdir}}/dbg

          mkdir -p ${{targets.subpkgdir}}/etc/nginx/modsecurity
          ln -s /etc/modsecurity/modsecurity.conf-concurrent ${{targets.subpkgdir}}/etc/nginx/modsecurity/modsecurity.conf
          ln -s /etc/modsecurity/unicode.mapping ${{targets.subpkgdir}}/etc/nginx/modsecurity/unicode.mapping

          mkdir -p ${{targets.subpkgdir}}/var/log/nginx
          # Create symlinks to redirect nginx logs to stdout and stderr docker log collector
          ln -sf /dev/stdout ${{targets.subpkgdir}}/var/log/nginx/access.log
          ln -sf /dev/stderr ${{targets.subpkgdir}}/var/log/nginx/error.log

          # symlink to satisfy hard coded path to mimalloc
          # https://github.com/kubernetes/ingress-nginx/blob/8f54b538d9b32649411d9e507ca38fbee55ce51c/charts/ingress-nginx/templates/controller-daemonset.yaml#L99-L100
          mkdir -p ${{targets.subpkgdir}}/usr/local/lib
          ln -s /usr/lib/libmimalloc.so.1 ${{targets.subpkgdir}}/usr/local/lib/libmimalloc.so

  # This is a maintained fork of the unmaintained
  # https://github.com/jet/kube-webhook-certgen/. We keep it as a
  # subpackage of ingress-nginx-controller since the one use
  # (kube-prometheus-stack charts) points to a hybrid tag of the
  # $ingress-nginx-$kube-webhook-certgen version.    # $ingress-nginx-$kube-webhook-certgen version.
  - name: kube-webhook-certgen-${{vars.nginx-ingress-major-minor}}
    description: Tools to help with self signed cert generation for Kubernetes test environment
    dependencies:
      provides:
        - kube-webhook-certgen=${{package.full-version}}
    pipeline:
      - uses: go/build
        with:
          ldflags: -X 'github.com/jet/kube-webhook-certgen/core.Version=v${{package.version}}'
          output: kube-webhook-certgen
          modroot: ./images/kube-webhook-certgen/rootfs
          packages: .

  - name: ingress-nginx-opentelemetry-plugin-${{vars.nginx-ingress-major-minor}}
    description: OTel plugin for ingress nginx controller ${{vars.nginx-ingress-major-minor}}
    dependencies:
      provides:
        - ingress-nginx-opentelemetry-plugin=${{package.full-version}}
    pipeline:
      - uses: git-checkout
        with:
          repository: https://github.com/open-telemetry/opentelemetry-cpp-contrib
          branch: main
          expected-commit: ${{vars.OTEL_SHA}}
          depth: -1
      - working-directory: instrumentation/nginx
        runs: |
          mkdir build
          cd build

          # This must be set to whatever ingress nginx is using
          cmake -DNGINX_VERSION=${{vars.NGINX_VERSION}} ..
          make

          # Copy over plugin
          mkdir -p ${{targets.contextdir}}/etc/nginx/modules
          cp -p otel_ngx_module.so ${{targets.contextdir}}/etc/nginx/modules/
      - uses: strip
    test:
      pipeline:
        - uses: test/ldd-check
          with:
            packages: $(basename ${{targets.contextdir}})

  - name: ingress-nginx-custom-error-pages-${{vars.nginx-ingress-major-minor}}
    description: OTel plugin for ingress nginx controller ${{vars.nginx-ingress-major-minor}}
    dependencies:
      provides:
        - ingress-nginx-custom-error-pages=${{package.full-version}}
    pipeline:
      - working-directory: images/custom-error-pages/rootfs/
        pipeline:
          - runs: |
              mkdir -p ${{targets.contextdir}}/usr/bin
              mkdir -p /go/src/k8s.io/ingress-nginx/images/custom-error-pages
              cp -r * /go/src/k8s.io/ingress-nginx/images/custom-error-pages/
              cd /go/src/k8s.io/ingress-nginx/images/custom-error-pages
              go get . && \
              go build -o ${{targets.contextdir}}/usr/bin/nginx-errors .
    test:
      environment:
        contents:
          packages:
            - wait-for-it
            - curl
            - ingress-nginx-custom-error-pages-compat-${{vars.nginx-ingress-major-minor}}
      pipeline:
        - runs: |
            /usr/bin/nginx-errors &
            wait-for-it -t 10 localhost:8080

            # check healthz endpoint make sure it returns 200
            http_code=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/healthz)

            if [ "$http_code" != "200" ]; then
              echo "Healthz endpoint returned $http_code"
              exit 1
            fi

            # I already checked that the following error exists in the upstream custom error pages image
            # unexpected error reading return code: strconv.Atoi: parsing "": invalid syntax. Using 404
            # serving custom error response for code 404 and format text/html from file /www/404.html
            http_code=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/)

            if [ "$http_code" != "404" ]; then
              echo "Custom error page did not return 404"
              exit 1
            fi

            # also check the message
            message=$(curl -s http://localhost:8080/)

            # Trim message (removes leading/trailing spaces & newlines)
            message=$(echo "$message" | tr -d '\n' | sed 's/^[ \t]*//;s/[ \t]*$//')

            if [[ "$message" != "<span>The page you're looking for could not be found.</span>" ]]; then
                echo "Custom error page did not return expected message"
                exit 1
            fi

  - name: ingress-nginx-custom-error-pages-compat-${{vars.nginx-ingress-major-minor}}
    description: OTel plugin for ingress nginx controller ${{vars.nginx-ingress-major-minor}}
    dependencies:
      provides:
        - ingress-nginx-custom-error-pages-compat=${{package.full-version}}
    pipeline:
      - working-directory: images/custom-error-pages/rootfs/
        pipeline:
          - runs: |
              mkdir -p ${{targets.contextdir}}/www
              mkdir -p ${{targets.contextdir}}/etc/
              cp -r www/* ${{targets.contextdir}}/www/
              cp -r etc/* ${{targets.contextdir}}/etc/
              ln -sf /usr/bin/nginx-errors ${{targets.contextdir}}/nginx-errors
    test:
      pipeline:
        - runs: |
            ls -lah /www/404.html
            ls -lah /www/500.html
            ls -lah /www/404.json
            ls -lah /etc/mime.types

update:
  enabled: true
  manual: true
  github:
    identifier: kubernetes/ingress-nginx
    strip-prefix: controller-v
    tag-filter: "controller-v1.12"

test:
  environment:
    contents:
      packages:
        - ingress-nginx-controller-compat-${{vars.nginx-ingress-major-minor}}
        - libcap-utils
  pipeline:
    - runs: |
        /usr/bin/nginx -v
        /usr/bin/nginx-ingress-controller --version
        nginx -v
        nginx -h
        nginx-dbg --help
        nginx-ingress-controller --version
    - runs: |
        cat <<EOF > /etc/nginx/nginx.conf
        load_module /etc/nginx/modules/otel_ngx_module.so;

        http {
          opentelemetry_operation_name otel_example;
          opentelemetry_ignore_paths ignored.php;
          server {
            listen 80;
            server_name otel_example;

            root /var/www/html;

            location = / {
              opentelemetry_operation_name my_example_backend;
              opentelemetry_propagate;
              proxy_pass http://localhost:3501/;
            }
          }
        }
        events {}
        EOF

        # Not sure why this isn't included in main package.
        mkdir -p /var/lib/nginx/tmp/
        adduser -D -H -s /sbin/nologin www-data
    # -T: test the configuration file: nginx checks the configuration for correct syntax, and then tries to open files referred in the configuration.
    # additionally dump configuration files to standard output (1.9.2).
    - runs: nginx -T
    - uses: test/ldd-check
      with:
        packages: ${{package.name}}
    - name: Test file capabilities
      runs: |
        getcap /usr/bin/nginx-ingress-controller | cut -d ' ' -f2 | grep -q -E '^cap_net_bind_service=ep$'
        getcap /usr/bin/nginx | cut -d ' ' -f2 | grep -q -E '^cap_net_bind_service=ep$'
    - name: Run KwoK
      uses: test/kwok/cluster
    - name: Check controller logs
      uses: test/daemon-check-output
      with:
        start: |
          nginx-ingress-controller --kubeconfig ~/.kube/config
        timeout: 30
        expected_output: |
          NGINX Ingress controller
          Release:       controller-v${{package.version}}
          nginx version: nginx/${{vars.NGINX_VERSION}}
          Running in Kubernetes cluster