ingress-nginx/controller - Error loading shared library libjwt.so.0

[bartul]

I'm attempting to utilize this module in the k8s Nginx Ingress controller.
To achieve this, I'm creating a custom controller image as follows:

ARG VERSION=1.11.3
FROM registry.k8s.io/ingress-nginx/controller:v${VERSION}

USER root

# Install ngx_http_auth_jwt_module.so dependencies
RUN apk -U upgrade && apk add --no-cache \
    jansson \
    openssl \ 
    libjwt

# Copy the ngx_http_auth_jwt_module.so file to the /etc/nginx/modules/ folder
COPY modules/ngx_http_auth_jwt_module.so /etc/nginx/modules/

# Change the ownership of the copied file to www-data
RUN chown www-data:www-data /etc/nginx/modules/ngx_http_auth_jwt_module.so

USER www-data

When I execute it in the k8s cluster, I encounter the following error:

nginx: [emerg] dlopen() "/etc/nginx/modules/ngx_http_auth_jwt_module.so" failed (Error loading shared library libjwt.so.0: No such file or directory (needed by /etc/nginx/modules/ngx_http_auth_jwt_module.so))

Versions

• module version: ngx_http_auth_jwt_module_2.2.0_nginx_1.25.4
• nginx version: nginx/1.25.5

[simonhammes]

Unfortunately I don't have a solution, just some thoughts:

It seems like the GitHub releases are compiled on Debian-based images. libjwt0 is installed during the build process, even though this refers to version 1.10.x (see https://packages.debian.org/bookworm/libjwt0). I don't know enough about dynamic libraries to determine why this "mismatch" occurs.

Because the package is linked against libjwt0, the following stuff is compiled into the .so file:

0x0000000000000001 (NEEDED)             Shared library: [libjwt.so.0]
0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]

As a result, the .so file thinks it requires libjwt v0, which Alpine does not provide. Installing libjwt with apk only yields libjwt.so.2 and libjwt.so.2.10.2.

[JoshMcCullough]

Related branch for experimentation (WIP): https://github.com/TeslaGov/ngx-http-auth-jwt-module/tree/issue-143

[JoshMcCullough]

Have you tried adding a symlink to get around this?

ln -s /path/to//libjwt0 /usr/lib64/libjwt.so.0

[bartul]

After adding the following lines to the Dockerfile, the original error did not occur:

RUN ln -s /usr/lib/libjwt.so.2 /usr/lib/libjwt0 
RUN ln -s /usr/lib/libjwt.so.2 /usr/lib/libjwt.so.0

But now I'm experiencing the following error:

Module "/etc/nginx/modules/ngx_http_auth_jwt_module.so" version 1025004 instead of 1025005 in /tmp/nginx/nginx-cfg965746 │
│ nginx: [emerg] module "/etc/nginx/modules/ngx_http_auth_jwt_module.so" version 1025004 instead of 1025005 in /tmp/nginx/nginx-cfg965746117:15               │
│ nginx: configuration file /tmp/nginx/nginx-cfg965746117 test failed

I assume this is due to a mismatch of the nginx version in the k8s controller and the one the module is compiled against.
Note, I'm using the ngx_http_auth_jwt_module_2.2.0_nginx_1.25.4 version of the module.