Skip to content

Conversation

mrajagopal
Copy link
Collaborator

Proposed changes

This PR addresses GitHub Issue 213.
When a customer deploys an NGINX Ingress Controller (NIC) pod with NGINX App-Protect (NAP) the exec commands such as nginx -T and ./nginx-ingress version throw an error when run in containers that are not nginx-ingress such as waf-enforcer and waf-config-mgr.

This PR fixes it by running the exec commands against the target container instead of all containers in the pod.
This fix only addresses the scenario for NGINX Ingress Controller (NIC), other products to follow in later PRs with further testing.

Checklist

Before creating a PR, run through this checklist and mark each as complete.

  • I have read the CONTRIBUTING guide
  • I have proven my fix is effective or that my feature works
  • I have checked that all unit tests pass after adding my changes
  • I have ensured the README is up to date
  • I have rebased my branch onto main
  • I will ensure my PR is targeting the main branch and pulling from my branch on my own fork

@mrajagopal mrajagopal self-assigned this Oct 8, 2025
@mrajagopal mrajagopal linked an issue Oct 8, 2025 that may be closed by this pull request
@mrajagopal mrajagopal requested review from Copilot and dareste October 8, 2025 21:08
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR fixes an issue where exec commands were being run against all containers in NGINX Ingress Controller pods, causing errors when executed in non-nginx-ingress containers like waf-enforcer and waf-config-mgr. The fix adds a container name check to ensure commands only run against the nginx-ingress container.

  • Added container name filtering to restrict exec commands to the nginx-ingress container only
  • Fixed missing closing braces in the control flow structure
  • Applied the fix consistently across all four job definitions in the NIC job list

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Copy link
Collaborator

@dareste dareste left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All good. I am getting a permission denied for the job that outputs the content of /etc/nginx-agent/nginx-agent.cat, but there is little we can do. In scenarios where the instance is connected, we will be able to capture the configuration from the corresponding ConfigMap containing the agent config.

@mrajagopal mrajagopal merged commit 41a9a76 into main Oct 9, 2025
6 checks passed
@mrajagopal mrajagopal deleted the 213-run-targeted-exec-commands branch October 9, 2025 16:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Run exec commands on targeted containers instead of all in a pod
2 participants