AppProtect function not work

[Wonderingkaho]

Describe the bug
I'm having an issue trying to enable appprotect.

To Reproduce

  ## Support for App Protect
  appprotect:
    ## Enable the App Protect module in the Ingress Controller.
    enable: true

  ## Enable the custom resources.
  enableCustomResources: true

Expected behavior

[root@master1 ~]# kubectl logs -n ingress-nginx-plus   pod/nginx-plus-ingress-nc4dj
I1018 04:18:01.647935       1 main.go:195] Starting NGINX Ingress controller Version=v2.0.2-SNAPSHOT-bb8ec62 GitCommit=bb8ec62f683d4477ccf6de925c3b5b6902c77160 Date=2021-10-18T02:40:06Z PlusFlag=true
I1018 04:18:01.660217       1 utils.go:163] Kubernetes version: 1.21.5
I1018 04:18:01.665140       1 main.go:397] Using nginx version: nginx/1.21.3 (nginx-plus-r25)
I1018 04:18:01.668937       1 manager.go:465] Starting AppProtect Agent
F1018 04:18:01.669166       1 manager.go:469] Failed to start AppProtect Agent: fork/exec /opt/app_protect/bin/bd_agent: no such file or directory

Your environment

• Version of the Ingress Controller : helm.sh/chart: nginx-ingress-0.11.2
• Version of Kubernetes : v1.21.5
• Kubernetes platform : Self deploy
• Using NGINX or NGINX Plus : NGINX Plus

Additional context
F1018 04:18:01.669166 1 manager.go:469] Failed to start AppProtect Agent: fork/exec /opt/app_protect/bin/bd_agent: no such file or directory

[github-actions[bot]]

Hi @Wonderingkaho thanks for reporting!

Be sure to check out the docs while you wait for a human to take a look at this 🙂

Cheers!

[lucacome]

Hi @Wonderingkaho

did you enable App Protect in the command arguments? https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/#-enable-app-protect

[Wonderingkaho]

Hi @lucacome
Yeah, I had install Ingress nginx-plus with Helm Chart and already enable App Protect with this values.yaml:

controller:
  ## The name of the Ingress controller daemonset or deployment.
  ## Autogenerated if not set or set to "".
  name: nginx-plus-ingress

  ## The kind of the Ingress controller installation - deployment or daemonset.
  kind: daemonset

  ## Deploys the Ingress controller for NGINX Plus.
  nginxplus: true

  # Timeout in milliseconds which the Ingress Controller will wait for a successful NGINX reload after a change or at the initial start.
  nginxReloadTimeout: 60000

  ## Support for App Protect
  appprotect:
    ## Enable the App Protect module in the Ingress Controller.
    enable: true

  ## Enables the Ingress controller pods to use the host's network namespace.
  hostNetwork: true

  ## Enables debugging for NGINX. Uses the nginx-debug binary. Requires error-log-level: debug in the ConfigMap via `controller.config.entries`.
  nginxDebug: false

  ## The log level of the Ingress Controller.
  logLevel: 3

  ## A list of custom ports to expose on the NGINX ingress controller pod. Follows the conventional Kubernetes yaml syntax for container ports.
  customPorts: []

  image:
    ## The image repository of the Ingress controller.
    repository: kaho801/xxx-nginx-plus

    ## The tag of the Ingress controller image.
    tag: "2.0.2-SNAPSHOT-bb8ec62"

    ## The pull policy for the Ingress controller image.
    pullPolicy: IfNotPresent

  config:
    ## The name of the ConfigMap used by the Ingress controller.
    ## Autogenerated if not set or set to "".
    # name: nginx-config

    ## The annotations of the Ingress Controller configmap.
    annotations: {}

    ## The entries of the ConfigMap for customizing NGINX configuration.
    entries: {}
.........................
  ## Enable the custom resources.
  enableCustomResources: true

Without App Protect, Ingress nginx-plus pods can run normally with access nginx-plus dashboard:

[brianehlert]

Based on this line in your log:
Failed to start AppProtect Agent: fork/exec /opt/app_protect/bin/bd_agent: no such file or directory

Did you pull a pre-built image that has NAP WAF already installed? Or did you build the image yourself using a Dockerfile we provided?

bd_agent is one of the components of the AppProtect module and does no appear to be present.

[lucacome]

Hi @Wonderingkaho

Sorry, I missed that you were using helm in your first message.

The error you're seeing usually means that you have App Protect enabled with an image that doesn't have it installed, can you double-check that you built/pulled the right Docker image?

You can do something like this with your current image to get the info

docker inspect --format '{{ json .Config.Labels }}' <docker image> | jq

[Wonderingkaho]

THX @brianehlert @lucacome
I know where the problem is....
I used following commands to build the image:
make debian-image-plus PREFIX=myregistry.example.com/nginx-plus-ingress TARGET=container
instead of:
make debian-image-nap-plus PREFIX=myregistry.example.com/nginx-plus-ingress TARGET=container

thx a lot :D

[jasonwilliams14]

Yes, exactly @Wonderingkaho . That make option will build Ingress with NAP. 👍