Update base nginx

[ElvinEfendi]

maybe will help with #7080

the premise of this PR is to make our nginx base image to look more like https://github.com/openresty/openresty which is presumably better tested

the patches are exact copies from https://github.com/openresty/openresty

[tao12345666333]

I'm not sure if we want to downgrade the version of NGINX

[ElvinEfendi]

I'd not want to downgrade either, but then we would have to adjust the Openresty patches for 1.20.1 which I personally don't feel capable of doing in a reasonable time.

[strongjz]

Talked with @ElvinEfendi in slack, we're going to downgrade to 1.19.9 nginx and patch openrusty to test to see if it fixes the coredump issue.

[ElvinEfendi]

added the 1.19.9 related security patch too from openresty: e0cea12

[longwuyuan]

Only s390x uses will benefit, and the non s390x users will be forced to use 1.19 ? Maybe we can creae a new /image/nginx_oldlua_image directory ? Thanks, ; Long

…

On 8/27/21 1:16 PM, Jintao Zhang wrote: ***@***.**** commented on this pull request. ------------------------------------------------------------------------ In images/nginx/rootfs/build.sh <#7552 (comment)>: > @@ -18,7 +18,7 @@ set -o errexit set -o nounset set -o pipefail -export NGINX_VERSION=1.20.1 +export NGINX_VERSION=1.19.9 I'm not sure if we want to downgrade the version of NGINX — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#7552 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGZVWQJWXF4SVNJS74T7BTT647G5ANCNFSM5C4VTHEQ>. Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[ElvinEfendi]

Only s390x uses will benefit

@longwuyuan why?

[longwuyuan]

My comment was a really bad mistake, please ignore. Very sorry. I wrongly assumed that the downgrade was aimed at solving #6504 (wrongly assumed lua downgrade or something required lowering he nginx version) Thanks, ; Long

…

On 8/27/21 6:34 PM, Elvin Efendi wrote: Only s390x uses will benefit @longwuyuan <https://github.com/longwuyuan> why? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#7552 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGZVWSZ3DEXNI6PQJHICNTT66EOXANCNFSM5C4VTHEQ>. Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[strongjz]

/kind bug
/triage accepted
/priority critical-urgent

This is related to #6896

[strongjz]

/lgtm
/approve

Let's see if this addresses the core dump issues. If not we can always back out these changes.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ElvinEfendi, strongjz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• images/OWNERS [ElvinEfendi,strongjz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[longwuyuan]

Saw a related note. #7552 (comment)

No segfault in 2 days on 0.49.0 with high number of ingress objects.

[BloodyIron]

Considering this is a downgrade from NGINX base 1.20.x to 1.19.x, I don't know why this is being framed as upgrade, since 0.47 implemented 1.20.1 to mitigate CVE-2021-23017. So... is ingress-nginx 1.0.1/onwards now vulnerable to CVE-2021-23017? This whole history around NGINX base version is so muddy I can't reliably tell. 0.49.1/onward (0.x branch) sure looks to be CVE-2021-23017 vulnerable too... was any of this considered for any of these NGINX base changes??? #7164 is relevant.