Makefile

# VERSION defines the project version for the bundle.
# Update this value when you upgrade the version of your project.
# To re-generate a bundle for another specific version without changing the standard setup, you can:
# - use the VERSION as arg of the bundle target (e.g make bundle VERSION=0.0.2)
# - use environment variables to overwrite this value (e.g export VERSION=0.0.2)
VERSION ?= 0.0.1

# CHANNELS define the bundle channels used in the bundle.
# Add a new line here if you would like to change its default config. (E.g CHANNELS = "candidate,fast,stable")
# To re-generate a bundle for other specific channels without changing the standard setup, you can:
# - use the CHANNELS as arg of the bundle target (e.g make bundle CHANNELS=candidate,fast,stable)
# - use environment variables to overwrite this value (e.g export CHANNELS="candidate,fast,stable")
ifneq ($(origin CHANNELS), undefined)
BUNDLE_CHANNELS := --channels=$(CHANNELS)
endif

# DEFAULT_CHANNEL defines the default channel used in the bundle.
# Add a new line here if you would like to change its default config. (E.g DEFAULT_CHANNEL = "stable")
# To re-generate a bundle for any other default channel without changing the default setup, you can:
# - use the DEFAULT_CHANNEL as arg of the bundle target (e.g make bundle DEFAULT_CHANNEL=stable)
# - use environment variables to overwrite this value (e.g export DEFAULT_CHANNEL="stable")
ifneq ($(origin DEFAULT_CHANNEL), undefined)
BUNDLE_DEFAULT_CHANNEL := --default-channel=$(DEFAULT_CHANNEL)
endif
BUNDLE_METADATA_OPTS ?= $(BUNDLE_CHANNELS) $(BUNDLE_DEFAULT_CHANNEL)

# IMAGE_TAG_BASE defines the docker.io namespace and part of the image name for remote images.
# This variable is used to construct full image tags for bundle and catalog images.
#
# For example, running 'make bundle-build bundle-push catalog-build catalog-push' will build and push both
# bindplane.com/bindplane-operator-bundle:$VERSION and bindplane.com/bindplane-operator-catalog:$VERSION.
IMAGE_TAG_BASE ?= bindplane.com/bindplane-operator

# BUNDLE_IMG defines the image:tag used for the bundle.
# You can use it as an arg. (E.g make bundle-build BUNDLE_IMG=<some-registry>/<project-name-bundle>:<tag>)
BUNDLE_IMG ?= $(IMAGE_TAG_BASE)-bundle:v$(VERSION)

# BUNDLE_GEN_FLAGS are the flags passed to the operator-sdk generate bundle command
BUNDLE_GEN_FLAGS ?= -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS)

# USE_IMAGE_DIGESTS defines if images are resolved via tags or digests
# You can enable this value if you would like to use SHA Based Digests
# To enable set flag to true
USE_IMAGE_DIGESTS ?= false
ifeq ($(USE_IMAGE_DIGESTS), true)
	BUNDLE_GEN_FLAGS += --use-image-digests
endif

# Set the Operator SDK version to use. By default, what is installed on the system is used.
# This is useful for CI or a project to utilize a specific version of the operator-sdk toolkit.
OPERATOR_SDK_VERSION ?= v1.42.0
# Image URL to use all building/pushing image targets
IMG ?= bindplane-operator:local

# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
ifeq (,$(shell go env GOBIN))
GOBIN=$(shell go env GOPATH)/bin
else
GOBIN=$(shell go env GOBIN)
endif

# Setting SHELL to bash allows bash commands to be executed by recipes.
# Options are set to exit when a recipe line exits non-zero or a piped command fails.
SHELL = /usr/bin/env bash -o pipefail
.SHELLFLAGS = -ec

.PHONY: all
all: build

##@ General

# The help target prints out all targets with their descriptions organized
# beneath their categories. The categories are represented by '##@' and the
# target descriptions by '##'. The awk command is responsible for reading the
# entire set of makefiles included in this invocation, looking for lines of the
# file as xyz: ## something, and then pretty-format the target and help. Then,
# if there's a line with ##@ something, that gets pretty-printed as a category.
# More info on the usage of ANSI control characters for terminal formatting:
# https://en.wikipedia.org/wiki/ANSI_escape_code#SGR_parameters
# More info on the awk command:
# http://linuxcommand.org/lc3_adv_awk.php

.PHONY: help
help: ## Display this help.
	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)

##@ Development

.PHONY: manifests
manifests: ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
	$(CONTROLLER_GEN) rbac:roleName=manager-role crd:maxDescLen=0 webhook paths="./..." output:crd:artifacts:config=config/crd/bases

.PHONY: generate
generate: ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
	$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."

.PHONY: fmt
fmt: ## Run go fmt against code.
	go fmt ./...

.PHONY: vet
vet: ## Run go vet against code.
	go vet ./...

.PHONY: generate-api-docs
generate-api-docs: ## Generate CRD API reference documentation at docs/configuration/api.md.
	@mkdir -p docs/configuration
	$(CRD_REF_DOCS) \
		--source-path=$(CURDIR) \
		--config=docs/configuration/.crd-ref-docs-config.yaml \
		--renderer=markdown \
		--output-path=docs/configuration/api.md
	@perl -i -0pe 's/\n{3,}/\n\n/g' docs/configuration/api.md

.PHONY: test
test: setup-envtest ## Run tests.
	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test $$(go list ./... | grep -v /e2e) -coverprofile cover.out

# TODO(user): To use a different vendor for e2e tests, modify the setup under 'tests/e2e'.
# The default setup assumes Kind is pre-installed and builds/loads the Manager Docker image locally.
# CertManager is installed by default; skip with:
# - CERT_MANAGER_INSTALL_SKIP=true
# Argo Rollouts is NOT installed by default; enable for test-e2e-argo-rollouts by leaving
# ARGO_ROLLOUTS_INSTALL_SKIP unset (the test-e2e target sets it to "true" to skip).
KIND_CLUSTER ?= bindplane-operator-test-e2e
KIND_K8S_VERSION ?=
# The default go test timeout is 10m, which is too short for the license-backed
# e2e suite because it includes cluster bring-up, image pulls, and full workload
# reconciliation. Keep this overrideable for local tuning.
E2E_GO_TEST_FLAGS ?= -v -ginkgo.v -timeout 30m
E2E_LABEL_FILTER ?=
ARGO_ROLLOUTS_INSTALL_SKIP ?=

.PHONY: setup-test-e2e
setup-test-e2e: ## Set up a Kind cluster for e2e tests if it does not exist
	@case "$$($(KIND) get clusters)" in \
		*"$(KIND_CLUSTER)"*) \
			echo "Kind cluster '$(KIND_CLUSTER)' already exists. Skipping creation." ;; \
		*) \
			echo "Creating Kind cluster '$(KIND_CLUSTER)'..."; \
			$(if $(KIND_K8S_VERSION), \
				$(KIND) create cluster --name $(KIND_CLUSTER) --image kindest/node:v$(KIND_K8S_VERSION), \
				$(KIND) create cluster --name $(KIND_CLUSTER)) ;; \
	esac
	@$(KUBECTL) config use-context kind-$(KIND_CLUSTER)

.PHONY: verify-e2e-context
verify-e2e-context: ## Verify the current kubectl context is the expected Kind cluster for e2e tests
	@scripts/verify-e2e-context.sh "$(KIND_CLUSTER)"

.PHONY: run-test-e2e
run-test-e2e: verify-e2e-context
	KIND_CLUSTER=$(KIND_CLUSTER) ARGO_ROLLOUTS_INSTALL_SKIP=$(ARGO_ROLLOUTS_INSTALL_SKIP) go test ./test/e2e/ $(E2E_GO_TEST_FLAGS) $(if $(strip $(E2E_LABEL_FILTER)),-ginkgo.label-filter="$(E2E_LABEL_FILTER)")

.PHONY: test-e2e
test-e2e: setup-test-e2e ## Run smoke and webhook e2e tests in Kind.
	@status=0; $(MAKE) run-test-e2e E2E_LABEL_FILTER='!requires-license && !requires-argo-rollouts' ARGO_ROLLOUTS_INSTALL_SKIP=true || status=$$?; $(MAKE) cleanup-test-e2e; exit $$status

.PHONY: test-e2e-argo-rollouts
test-e2e-argo-rollouts: setup-test-e2e ## Run Argo Rollouts e2e tests in Kind.
	@status=0; $(MAKE) run-test-e2e E2E_LABEL_FILTER='requires-argo-rollouts' || status=$$?; $(MAKE) cleanup-test-e2e; exit $$status

.PHONY: test-e2e-bindplane
test-e2e-bindplane: setup-test-e2e ## Run license-backed Bindplane reconciliation e2e tests in Kind.
	@status=0; $(MAKE) run-test-e2e E2E_LABEL_FILTER='requires-license' || status=$$?; $(MAKE) cleanup-test-e2e; exit $$status

.PHONY: cleanup-test-e2e
cleanup-test-e2e: ## Tear down the Kind cluster used for e2e tests
	@$(KIND) delete cluster --name $(KIND_CLUSTER)

.PHONY: lint
lint: ## Run golangci-lint linter
	$(GOLANGCI_LINT) run

.PHONY: lint-fix
lint-fix: ## Run golangci-lint linter and perform fixes
	$(GOLANGCI_LINT) run --fix

.PHONY: lint-config
lint-config: ## Verify golangci-lint linter configuration
	$(GOLANGCI_LINT) config verify

.PHONY: shellcheck
shellcheck: ## Run shellcheck against all shell scripts
	shellcheck -x scripts/*.sh scripts/lib/*.sh .github/workflows/scripts/*.sh

.PHONY: gosec
gosec: ## Run gosec security scanner
	$(GOSEC) ./...

.PHONY: staticcheck
staticcheck: ## Run staticcheck static analysis
	$(STATICCHECK) ./...

.PHONY: govulncheck
govulncheck: ## Run govulncheck vulnerability scanner
	$(GOVULNCHECK) ./...

.PHONY: deadcode
deadcode: ## Find unreachable functions; exits non-zero if any are found
	@output=$$($(DEADCODE) -test ./...); \
	if [ -n "$$output" ]; then \
		echo "$$output"; \
		exit 1; \
	fi

ALLOWED_LICENSES := MIT,Apache-2.0,BSD-3-Clause,BSD-2-Clause,BSD-2-Clause-FreeBSD,Zlib,ISC,MPL-2.0

.PHONY: license-check
license-check: ## Check dependency licenses against allowlist
	$(GO_LICENSES) check ./... \
		--allowed_licenses=$(ALLOWED_LICENSES) \
		--ignore=github.com/observiq/bindplane-operator

.PHONY: build
build: manifests generate fmt vet ## Build manager binary.
	go build -o bin/manager cmd/main.go

.PHONY: docker-build
docker-build: manifests generate ## Build manager Docker image for local/e2e use (e.g. Kind). Production images are built by Goreleaser.
	CGO_ENABLED=0 GOOS=linux go build -o manager -a cmd/main.go
	docker build -t $(IMG) .
	rm -f manager

.PHONY: run
run: manifests generate fmt vet ## Run a controller from your host.
	go run ./cmd/main.go

.PHONY: run-minikube-destructive
run-minikube-destructive:
	@scripts/minikube.sh

.PHONY: build-installer
build-installer: manifests generate ## Generate a consolidated YAML with CRDs and deployment (imagePullPolicy: Never for local/minikube).
	mkdir -p tmp
	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
	$(KUSTOMIZE) build config/default > tmp/install.yaml

.PHONY: build-installer-release
build-installer-release: manifests generate ## Generate install manifest for releases (imagePullPolicy: Always). Use for release workflow.
	mkdir -p tmp
	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
	$(KUSTOMIZE) build config/overlays/release > tmp/install.yaml

.PHONY: build-installer-no-webhook
build-installer-no-webhook: manifests generate ## Generate install manifest without the validating webhook (no cert-manager required).
	mkdir -p tmp
	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
	$(KUSTOMIZE) build config/overlays/no-webhook > tmp/install-no-webhook.yaml

##@ Deployment

ifndef ignore-not-found
  ignore-not-found = false
endif

.PHONY: install
install: manifests ## Install CRDs into the K8s cluster specified in ~/.kube/config.
	@bash -c 'source scripts/lib/context-guard.sh && context_guard::require_minikube' || exit 1
	@$(KUSTOMIZE) build config/crd > /tmp/crds.yaml && \
	($(KUBECTL) create -f /tmp/crds.yaml 2>/dev/null || $(KUBECTL) replace -f /tmp/crds.yaml) && \
	rm -f /tmp/crds.yaml

.PHONY: uninstall
uninstall: manifests ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
	@bash -c 'source scripts/lib/context-guard.sh && context_guard::require_minikube' || exit 1
	$(KUSTOMIZE) build config/crd | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -

.PHONY: deploy
deploy: manifests ## Deploy controller to the K8s cluster specified in ~/.kube/config. Uses server-side apply to avoid CRD annotation size limit (262144 bytes).
	@bash -c 'source scripts/lib/context-guard.sh && context_guard::require_minikube' || exit 1
	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
	$(KUSTOMIZE) build config/default | $(KUBECTL) apply --server-side --force-conflicts -f -

.PHONY: undeploy
undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
	@bash -c 'source scripts/lib/context-guard.sh && context_guard::require_minikube' || exit 1
	$(KUSTOMIZE) build config/default | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -

.PHONY: deploy-no-webhook
deploy-no-webhook: manifests ## Deploy controller without the validating webhook (no cert-manager required).
	@bash -c 'source scripts/lib/context-guard.sh && context_guard::require_minikube' || exit 1
	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
	$(KUSTOMIZE) build config/overlays/no-webhook | $(KUBECTL) apply --server-side --force-conflicts -f -

.PHONY: install-postgres-operator
install-postgres-operator: ## Install CloudNativePG operator and deploy a test PostgreSQL cluster in the postgres namespace.
	@bash -c 'source scripts/lib/context-guard.sh && context_guard::require_minikube' || exit 1
	@scripts/install-postgres-operator.sh

##@ Dependencies

## Location for envtest Kubernetes API server binaries
LOCALBIN ?= $(shell pwd)/bin
$(LOCALBIN):
	mkdir -p $(LOCALBIN)

## Tool versions are pinned in tools/go.mod and tools/go.sum.
## To update a tool: cd tools && go get -tool <package>@<version> && go mod tidy
TOOLS_MOD := $(CURDIR)/tools/go.mod

## Tool commands - versions are locked in tools/go.mod
KUBECTL ?= kubectl
KIND = go tool -modfile=$(TOOLS_MOD) sigs.k8s.io/kind/cmd/kind
KUSTOMIZE = go tool -modfile=$(TOOLS_MOD) sigs.k8s.io/kustomize/kustomize/v5
CONTROLLER_GEN = go tool -modfile=$(TOOLS_MOD) sigs.k8s.io/controller-tools/cmd/controller-gen
ENVTEST = go tool -modfile=$(TOOLS_MOD) sigs.k8s.io/controller-runtime/tools/setup-envtest
CRD_REF_DOCS = go tool -modfile=$(TOOLS_MOD) github.com/elastic/crd-ref-docs
GOLANGCI_LINT = go tool -modfile=$(TOOLS_MOD) github.com/golangci/golangci-lint/v2/cmd/golangci-lint
GOSEC = go tool -modfile=$(TOOLS_MOD) github.com/securego/gosec/v2/cmd/gosec
GOVULNCHECK = go tool -modfile=$(TOOLS_MOD) golang.org/x/vuln/cmd/govulncheck
DEADCODE = go tool -modfile=$(TOOLS_MOD) golang.org/x/tools/cmd/deadcode
STATICCHECK = go tool -modfile=$(TOOLS_MOD) honnef.co/go/tools/cmd/staticcheck
GO_LICENSES = go tool -modfile=$(TOOLS_MOD) github.com/google/go-licenses/v2

#ENVTEST_K8S_VERSION is the version of Kubernetes to use for setting up ENVTEST binaries (i.e. 1.31)
ENVTEST_K8S_VERSION ?= $(shell go list -m -f "{{ .Version }}" k8s.io/api | awk -F'[v.]' '{printf "1.%d", $$3}')

.PHONY: setup-envtest
setup-envtest: $(LOCALBIN) ## Download the binaries required for ENVTEST in the local bin directory.
	@echo "Setting up envtest binaries for Kubernetes version $(ENVTEST_K8S_VERSION)..."
	@$(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path || { \
		echo "Error: Failed to set up envtest binaries for version $(ENVTEST_K8S_VERSION)."; \
		exit 1; \
	}

.PHONY: operator-sdk
OPERATOR_SDK ?= $(LOCALBIN)/operator-sdk
operator-sdk: ## Download operator-sdk locally if necessary.
ifeq (,$(wildcard $(OPERATOR_SDK)))
ifeq (, $(shell which operator-sdk 2>/dev/null))
	@{ \
	set -e ;\
	mkdir -p $(dir $(OPERATOR_SDK)) ;\
	OS=$(shell go env GOOS) && ARCH=$(shell go env GOARCH) && \
	curl -sSLo $(OPERATOR_SDK) https://github.com/operator-framework/operator-sdk/releases/download/$(OPERATOR_SDK_VERSION)/operator-sdk_$${OS}_$${ARCH} ;\
	chmod +x $(OPERATOR_SDK) ;\
	}
else
OPERATOR_SDK = $(shell which operator-sdk)
endif
endif

.PHONY: bundle
bundle: manifests operator-sdk ## Generate bundle manifests and metadata, then validate generated files.
	$(OPERATOR_SDK) generate kustomize manifests -q
	cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG)
	$(KUSTOMIZE) build config/manifests | $(OPERATOR_SDK) generate bundle $(BUNDLE_GEN_FLAGS)
	$(OPERATOR_SDK) bundle validate ./bundle

.PHONY: bundle-build
bundle-build: ## Build the bundle image.
	docker build -f bundle.Dockerfile -t $(BUNDLE_IMG) .

.PHONY: bundle-push
bundle-push: ## Push the bundle image.
	docker push $(BUNDLE_IMG)

.PHONY: opm
OPM = $(LOCALBIN)/opm
opm: ## Download opm locally if necessary.
ifeq (,$(wildcard $(OPM)))
ifeq (,$(shell which opm 2>/dev/null))
	@{ \
	set -e ;\
	mkdir -p $(dir $(OPM)) ;\
	OS=$(shell go env GOOS) && ARCH=$(shell go env GOARCH) && \
	curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.55.0/$${OS}-$${ARCH}-opm ;\
	chmod +x $(OPM) ;\
	}
else
OPM = $(shell which opm)
endif
endif

# A comma-separated list of bundle images (e.g. make catalog-build BUNDLE_IMGS=example.com/operator-bundle:v0.1.0,example.com/operator-bundle:v0.2.0).
# These images MUST exist in a registry and be pull-able.
BUNDLE_IMGS ?= $(BUNDLE_IMG)

# The image tag given to the resulting catalog image (e.g. make catalog-build CATALOG_IMG=example.com/operator-catalog:v0.2.0).
CATALOG_IMG ?= $(IMAGE_TAG_BASE)-catalog:v$(VERSION)

# Set CATALOG_BASE_IMG to an existing catalog image tag to add $BUNDLE_IMGS to that image.
ifneq ($(origin CATALOG_BASE_IMG), undefined)
FROM_INDEX_OPT := --from-index $(CATALOG_BASE_IMG)
endif

# Build a catalog image by adding bundle images to an empty catalog using the operator package manager tool, 'opm'.
# This recipe invokes 'opm' in 'semver' bundle add mode. For more information on add modes, see:
# https://github.com/operator-framework/community-operators/blob/7f1438c/docs/packaging-operator.md#updating-your-existing-operator
.PHONY: catalog-build
catalog-build: opm ## Build a catalog image.
	$(OPM) index add --container-tool docker --mode semver --tag $(CATALOG_IMG) --bundles $(BUNDLE_IMGS) $(FROM_INDEX_OPT)

# Push the catalog image.
.PHONY: catalog-push
catalog-push: ## Push a catalog image.
	docker push $(CATALOG_IMG)