Generate all CRDs, update RBAC, fix Alpine tag

Author: ciarams87

apis/v1alpha1/wafpolicy_types.go

@@ -35,6 +35,10 @@ type WAFPolicyList struct {
 }
 
 // WAFPolicySpec defines the desired state of a WAFPolicy.
+//
+// +kubebuilder:validation:XValidation:message="policySource is required when securityLogs are specified",rule="!has(self.securityLogs) || has(self.policySource)"
+//
+//nolint:lll
 type WAFPolicySpec struct {
 	// PolicySource defines the source location and configuration for the compiled WAF policy bundle.
 	//

build/Dockerfile.nginxplus

@@ -1,4 +1,8 @@
 # syntax=docker/dockerfile:1.17
+
+# renovate: datasource=docker depName=alpine
+ARG ALPINE_VERSION=3.21
+
 FROM scratch AS nginx-files
 
 # the following links can be replaced with local files if needed, i.e. ADD --chown=101:1001 <local_file> <container_file>

charts/nginx-gateway-fabric/templates/clusterrole.yaml

@@ -109,6 +109,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - wafpolicies
   {{- if .Values.nginxGateway.snippetsFilters.enable }}
   - snippetsfilters
   {{- end }}
@@ -122,6 +123,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - wafpolicies/status
   {{- if .Values.nginxGateway.snippetsFilters.enable }}
   - snippetsfilters/status
   {{- end }}

config/crd/bases/gateway.nginx.org_wafpolicies.yaml

@@ -384,6 +384,9 @@ spec:
             required:
             - targetRef
             type: object
+            x-kubernetes-validations:
+            - message: policySource is required when securityLogs are specified
+              rule: '!has(self.securityLogs) || has(self.policySource)'
           status:
             description: Status defines the state of the WAFPolicy.
             properties:

config/crd/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - bases/gateway.nginx.org_observabilitypolicies.yaml
   - bases/gateway.nginx.org_snippetsfilters.yaml
   - bases/gateway.nginx.org_upstreamsettingspolicies.yaml
+  - bases/gateway.nginx.org_wafpolicies.yaml

deploy/azure/deploy.yaml

@@ -145,6 +145,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - wafpolicies
   verbs:
   - list
   - watch
@@ -155,6 +156,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - wafpolicies/status
   verbs:
   - update
 - apiGroups:

deploy/crds.yaml

@@ -145,6 +145,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - wafpolicies
   verbs:
   - list
   - watch
@@ -155,6 +156,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - wafpolicies/status
   verbs:
   - update
 - apiGroups:

deploy/default/deploy.yaml

@@ -149,6 +149,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - wafpolicies
   verbs:
   - list
   - watch
@@ -159,6 +160,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - wafpolicies/status
   verbs:
   - update
 - apiGroups:

deploy/experimental-nginx-plus/deploy.yaml

@@ -149,6 +149,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - wafpolicies
   verbs:
   - list
   - watch
@@ -159,6 +160,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - wafpolicies/status
   verbs:
   - update
 - apiGroups:

deploy/experimental/deploy.yaml

@@ -145,6 +145,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - wafpolicies
   verbs:
   - list
   - watch
@@ -155,6 +156,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - wafpolicies/status
   verbs:
   - update
 - apiGroups:

deploy/nginx-plus/deploy.yaml

@@ -145,6 +145,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - wafpolicies
   verbs:
   - list
   - watch
@@ -155,6 +156,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - wafpolicies/status
   verbs:
   - update
 - apiGroups:

deploy/nodeport/deploy.yaml

@@ -145,6 +145,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - wafpolicies
   verbs:
   - list
   - watch
@@ -155,6 +156,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - wafpolicies/status
   verbs:
   - update
 - apiGroups:

deploy/openshift/deploy.yaml

@@ -145,6 +145,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - wafpolicies
   - snippetsfilters
   verbs:
   - list
@@ -156,6 +157,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - wafpolicies/status
   - snippetsfilters/status
   verbs:
   - update

deploy/snippets-filters-nginx-plus/deploy.yaml

@@ -145,6 +145,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - wafpolicies
   - snippetsfilters
   verbs:
   - list
@@ -156,6 +157,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - wafpolicies/status
   - snippetsfilters/status
   verbs:
   - update