Makefile

# VERSION defines the project version for the bundle.
# Update this value when you upgrade the version of your project.
# To re-generate a bundle for another specific version without changing the standard setup, you can:
# - use the VERSION as arg of the bundle target (e.g make bundle VERSION=0.0.2)
# - use environment variables to overwrite this value (e.g export VERSION=0.0.2)
VERSION ?= 0.0.1

# Set the Operator SDK version to use. By default, what is installed on the system is used.
# This is useful for CI or a project to utilize a specific version of the operator-sdk toolkit.
OPERATOR_SDK_VERSION ?= v1.42.3

# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
ifeq (,$(shell go env GOBIN))
GOBIN=$(shell go env GOPATH)/bin
else
GOBIN=$(shell go env GOBIN)
endif

# CONTAINER_TOOL defines the container tool to be used for building images.
# Be aware that the target commands are only tested with Docker which is
# scaffolded by default. However, you might want to replace it to use other
# tools. (i.e. podman)
CONTAINER_TOOL ?= docker

# Setting SHELL to bash allows bash commands to be executed by recipes.
# Options are set to exit when a recipe line exits non-zero or a piped command fails.
SHELL = /usr/bin/env bash -o pipefail
.SHELLFLAGS = -ec

.PHONY: all
all: build

# Root directory
ROOT_DIR := $(dir $(realpath $(firstword $(MAKEFILE_LIST))))

# Tool versioning
TOOL_MOD := $(ROOT_DIR)tools/go.mod
gotool = go tool -modfile="$(TOOL_MOD)" $(1)

# Tool shortcuts
CONTROLLER_GEN := $(call gotool,controller-gen)
GOLANGCI_LINT := $(call gotool,golangci-lint)
KUSTOMIZE := $(call gotool,kustomize)
SETUP_ENVTEST := $(call gotool,setup-envtest)

##@ General

# The help target prints out all targets with their descriptions organized
# beneath their categories. The categories are represented by '##@' and the
# target descriptions by '##'. The awk command is responsible for reading the
# entire set of makefiles included in this invocation, looking for lines of the
# file as xyz: ## something, and then pretty-format the target and help. Then,
# if there's a line with ##@ something, that gets pretty-printed as a category.
# More info on the usage of ANSI control characters for terminal formatting:
# https://en.wikipedia.org/wiki/ANSI_escape_code#SGR_parameters
# More info on the awk command:
# http://linuxcommand.org/lc3_adv_awk.php

.PHONY: help
help: ## Display this help.
	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)

##@ Development

.PHONY: manifests
manifests: ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
	$(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases

.PHONY: generate
generate: ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
	$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt",year=$(YEAR) paths="./..."

.PHONY: fmt
fmt: ## Run go fmt against code.
	go fmt ./...

.PHONY: vet
vet: ## Run go vet against code.
	go vet ./...

##@ Testing
ENVTEST_K8S_VERSION ?= $(shell go list -m -f "{{ .Version }}" k8s.io/api | awk -F'[v.]' '{printf "1.%d", $$3}')
KIND_CLUSTER ?= hyperfleet-operator-test-e2e

# TODO(user): To use a different vendor for e2e tests, modify the setup under 'tests/e2e'.
# The default setup assumes Kind is pre-installed and builds/loads the Manager Docker image locally.
# CertManager is installed by default; skip with:
# - CERT_MANAGER_INSTALL_SKIP=true

.PHONY: setup-envtest
setup-envtest: $(LOCALBIN) ## Download the envtest binaries (etcd, kube-apiserver) into the local bin directory.
	$(SETUP_ENVTEST) use '$(ENVTEST_K8S_VERSION)' --bin-dir $(LOCALBIN) -p path

.PHONY: test
test: manifests generate fmt vet setup-envtest ## Run tests.
	KUBEBUILDER_ASSETS="$$($(SETUP_ENVTEST) use '$(ENVTEST_K8S_VERSION)' --bin-dir $(LOCALBIN) -p path)" go test $$(go list ./... | grep -v /e2e) -coverprofile cover.out

.PHONY: setup-test-e2e
setup-test-e2e: ## Set up a Kind cluster for e2e tests if it does not exist
	@command -v $(KIND) >/dev/null 2>&1 || { \
		echo "Kind is not installed. Please install Kind manually."; \
		exit 1; \
	}
	@case "$$($(KIND) get clusters)" in \
		*"$(KIND_CLUSTER)"*) \
			echo "Kind cluster '$(KIND_CLUSTER)' already exists. Skipping creation." ;; \
		*) \
			echo "Creating Kind cluster '$(KIND_CLUSTER)'..."; \
			$(KIND) create cluster --name $(KIND_CLUSTER) ;; \
	esac

.PHONY: test-e2e
test-e2e: setup-test-e2e manifests generate fmt vet ## Run the e2e tests. Expected an isolated environment using Kind.
	KIND_CLUSTER=$(KIND_CLUSTER) go test ./test/e2e/ -v -ginkgo.v
	$(MAKE) cleanup-test-e2e

.PHONY: cleanup-test-e2e
cleanup-test-e2e: ## Tear down the Kind cluster used for e2e tests
	@$(KIND) delete cluster --name $(KIND_CLUSTER)

##@ Lint

.PHONY: lint
lint: ## Run golangci-lint.
	$(GOLANGCI_LINT) run

.PHONY: lint-fix
lint-fix: ## Run golangci-lint linter and perform fixes
	$(GOLANGCI_LINT) run --fix

.PHONY: lint-config
lint-config: ## Verify golangci-lint linter configuration
	$(GOLANGCI_LINT) config verify

##@ Build

OC_MIRROR_IMAGE ?= hyperfleet-oc-mirror:local
# Disposable destination registry used only by test-disconnected-mirror to
# simulate the disconnected mirror; it is not the source or production registry.
REGISTRY_IMAGE ?= docker.io/library/registry@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373

.PHONY: build-oc-mirror-image
build-oc-mirror-image: check-container-tool ## Build the containerized oc-mirror runner.
	"$(CONTAINER_TOOL)" build --platform "$(PLATFORM)" -f hack/oc-mirror.Dockerfile -t "$(OC_MIRROR_IMAGE)" .

.PHONY: test-disconnected-mirror
test-disconnected-mirror: build-oc-mirror-image ## Test catalog archive import using a catalog archive (no cluster install).
	"$(CONTAINER_TOOL)" pull --platform "$(PLATFORM)" "$(REGISTRY_IMAGE)"
	CONTAINER_TOOL="$(CONTAINER_TOOL)" OC_MIRROR_IMAGE="$(OC_MIRROR_IMAGE)" \
		CATALOG_IMG="$(CATALOG_IMG)" \
		REGISTRY_IMAGE="$(REGISTRY_IMAGE)" REGISTRY_AUTH_FILE="$(REGISTRY_AUTH_FILE)" CONTAINER_DNS="$(CONTAINER_DNS)" MIRROR_PLATFORM="$(PLATFORM)" \
		./hack/test-disconnected-mirror.sh

.PHONY: build
build: manifests generate fmt vet ## Build manager binary.
	go build -o bin/manager cmd/main.go

# OPERATOR_NAMESPACE is the namespace the operator creates operands in. In-cluster
# it comes from the downward API; for `make run` it defaults here so local dev works.
# Override with e.g. `make run OPERATOR_NAMESPACE=my-ns`.
OPERATOR_NAMESPACE ?= hyperfleet-system

.PHONY: run
run: manifests generate fmt vet ## Run a controller from your host.
	OPERATOR_NAMESPACE=$(OPERATOR_NAMESPACE) go run ./cmd/main.go


##@ Container Images

# Image configuration
PLATFORM ?= linux/amd64
QUAY_USER ?=
QUAY_REPO ?= $(if $(QUAY_USER),$(QUAY_USER),openshift-hyperfleet)
IMG_REGISTRY ?= quay.io/$(QUAY_REPO)
IMG_NAME ?= hyperfleet-operator
IMG_TAG ?= $(APP_VERSION)
OPERATOR_IMG ?= $(IMG_REGISTRY)/$(IMG_NAME):$(IMG_TAG)
export RELATED_IMAGE_HYPERFLEET_OPERATOR ?= $(OPERATOR_IMG)
export RELATED_IMAGE_HYPERFLEET_API ?= quay.io/redhat-services-prod/hyperfleet-tenant/hyperfleet/hyperfleet-api:latest

# Base image for production builds - matches Dockerfile default
# Override with DEV_BASE_IMAGE for dev builds (see image-dev target)
BASE_IMAGE ?= registry.access.redhat.com/ubi9-micro:latest

APP_VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo "0.0.0-dev")
GIT_SHA ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
GIT_DIRTY ?= $(shell [ -z "$$(git status --porcelain 2>/dev/null)" ] || echo "-modified")

# For container builds, use linux by default; override PLATFORM to build for other platforms (e.g. linux/arm64)

# Go build flags (FIPS compliant)
CGO_ENABLED ?= 1
GOEXPERIMENT ?= boringcrypto
GOFLAGS ?= -trimpath
# APP_VERSION/GIT_SHA are injected into the binary via the Dockerfile's own
# -ldflags -X (see Dockerfile and internal/version); `make build`/`make run`
# intentionally skip ldflags and rely on the Go toolchain's automatic VCS
# stamping from the local .git checkout instead (see internal/version).

.PHONY: check-container-tool
check-container-tool:
ifndef CONTAINER_TOOL
	@echo "Error: No container tool found (docker or podman)"
	@exit 1
endif

.PHONY: image
image: check-container-tool manifests generate fmt vet ## Build container image with configurable registry/tag
	@echo "Building container image $(OPERATOR_IMG)..."
	$(CONTAINER_TOOL) build \
		--platform $(PLATFORM) \
		--build-arg BASE_IMAGE=$(BASE_IMAGE) \
		--build-arg APP_VERSION=$(APP_VERSION) \
		--build-arg GIT_SHA=$(GIT_SHA) \
		-t $(OPERATOR_IMG) .
	@echo "Image built: $(OPERATOR_IMG)"
	@echo "$(OPERATOR_IMG)"

.PHONY: image-push
image-push: check-container-tool ## Push container image to registry
	@echo "Pushing image $(OPERATOR_IMG)..."
	$(CONTAINER_TOOL) push $(OPERATOR_IMG)
	@echo "Image pushed: $(OPERATOR_IMG)"

.PHONY: image-build-push
image-build-push: image image-push ## Build and push container image to registry

.PHONY: check-quay-user
check-quay-user:
ifeq ($(strip $(QUAY_USER)),)
	@echo "Error: QUAY_USER is not set"
	@echo ""
	@echo "Usage: QUAY_USER=myuser make image-dev"
	@exit 1
endif

# Usage: QUAY_USER=myuser make image-dev
# Dev image configuration - set QUAY_USER to push to personal registry
DEV_TAG ?= dev-$(GIT_SHA)
DEV_BASE_IMAGE ?= registry.access.redhat.com/ubi9/ubi-minimal:latest

.PHONY: image-dev
image-dev: IMG_TAG = $(DEV_TAG)
image-dev: BASE_IMAGE = $(DEV_BASE_IMAGE)
image-dev: check-quay-user image-build-push ## Build and push dev image to dev Quay registry (requires QUAY_USER)

##@ Deployment

ifndef ignore-not-found
  ignore-not-found = false
endif

.PHONY: install
install: manifests ## Install CRDs into the K8s cluster specified in ~/.kube/config.
	@$(KUSTOMIZE)  build config/crd | $(KUBECTL) apply -f -

.PHONY: uninstall
uninstall: manifests ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
	@$(KUSTOMIZE) build config/crd | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -

.PHONY: deploy
deploy: build-deployer ## Deploy controller to the K8s cluster specified in ~/.kube/config.
	@$(KUBECTL) apply -f dist/install.yaml

.PHONY: undeploy
undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
	@$(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f dist/install.yaml


##@ Bundles/Catalog


# Non-olm installs
# Generates dist/install.yaml
# Install resources:  kubectl apply -f dist/install.yaml
# Uninstall resources: kubectl delete -f dist/install.yaml
# Override images via env vars:
#   make build-deployer RELATED_IMAGE_HYPERFLEET_OPERATOR=<op-img> RELATED_IMAGE_HYPERFLEET_API=<api-img>

.PHONY: build-deployer
build-deployer: manifests generate ## Generate a consolidated YAML with CRDs and deployment.
	@mkdir -p dist
	@$(KUSTOMIZE) build config/default | envsubst > dist/install.yaml


# For now `stable` channel is the default and only channel
# CHANNELS define the bundle channels used in the bundle.
# Add a new line here if you would like to change its default config. (E.g CHANNELS = "candidate,fast,stable")
# To re-generate a bundle for other specific channels without changing the standard setup, you can:
# - use the CHANNELS as arg of the bundle target (e.g make bundle CHANNELS=candidate,fast,stable)
# - use environment variables to overwrite this value (e.g export CHANNELS="candidate,fast,stable")
CHANNELS ?= stable
BUNDLE_CHANNELS := --channels=$(CHANNELS)

# DEFAULT_CHANNEL defines the default channel used in the bundle.
# Add a new line here if you would like to change its default config. (E.g DEFAULT_CHANNEL = "stable")
# To re-generate a bundle for any other default channel without changing the default setup, you can:
# - use the DEFAULT_CHANNEL as arg of the bundle target (e.g make bundle DEFAULT_CHANNEL=stable)
# - use environment variables to overwrite this value (e.g export DEFAULT_CHANNEL="stable")
DEFAULT_CHANNEL ?= stable
BUNDLE_DEFAULT_CHANNEL := --default-channel=$(DEFAULT_CHANNEL)
BUNDLE_METADATA_OPTS ?= $(BUNDLE_CHANNELS) $(BUNDLE_DEFAULT_CHANNEL)


# USE_IMAGE_DIGESTS defines if images are resolved via tags or digests
# You can enable this value if you would like to use SHA Based Digests
# To enable set flag to true
USE_IMAGE_DIGESTS ?= false
ifeq ($(USE_IMAGE_DIGESTS), true)
	BUNDLE_GEN_FLAGS += --use-image-digests
endif

# Defines the base of the registry we use for `make bundle-build catalog-build catalog-push bundle-push`
# Defaults to quay.io/openshift-hyperfleet/hyperfleet-operator
# For dev: If QUAY_REPO is set quay.io/<QUAY_REPO>/hyperfleet-operator
REG_REPO_BASE ?= $(IMG_REGISTRY)/$(IMG_NAME)

# Image tag for the bundle
BUNDLE_IMG ?= $(REG_REPO_BASE)-bundle:v$(VERSION)

# BUNDLE_GEN_FLAGS are the flags passed to the operator-sdk generate bundle command
BUNDLE_GEN_FLAGS ?= -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS)

# A comma-separated list of bundle images (e.g. make catalog-build BUNDLE_IMGS=example.com/operator-bundle:v0.1.0,example.com/operator-bundle:v0.2.0).
# These images MUST exist in a registry and be pull-able.
BUNDLE_IMGS ?= $(BUNDLE_IMG)

# The image tag given to the resulting catalog image (e.g. make catalog-build CATALOG_IMG=example.com/operator-catalog:v0.2.0).
CATALOG_IMG ?= $(REG_REPO_BASE)-catalog:v$(VERSION)

# Set CATALOG_BASE_IMG to an existing catalog image tag to add $BUNDLE_IMGS to that image.
ifneq ($(origin CATALOG_BASE_IMG), undefined)
FROM_INDEX_OPT := --from-index $(CATALOG_BASE_IMG)
endif

# Substitutes RELATED_IMAGE_* env vars into patch-images.yaml via envsubst,
# then builds the bundle image. This mirrors the Konflux pipeline bundle build.
# To override the operator and API images:
#   make bundle-build RELATED_IMAGE_HYPERFLEET_OPERATOR=<image> RELATED_IMAGE_HYPERFLEET_API=<image>
KUSTOMIZE_VARIANT ?= config/manifests/dev
# For dev builds - unset validation of related images
VALIDATE_RELATED_IMAGES ?= false
.PHONY: bundle-build
bundle-build: ## Builds the bundle and bundle image.
	cat config/manifests/dev/patch-images.yaml | envsubst > config/manifests/dev/kustomization.yaml
	$(CONTAINER_TOOL) build -f bundle.Dockerfile \
		--platform $(PLATFORM) \
		--build-arg BUNDLE_VERSION=$(VERSION) \
		--build-arg CHANNELS=$(CHANNELS) \
		--build-arg DEFAULT_CHANNEL=$(DEFAULT_CHANNEL) \
		--build-arg KUSTOMIZE_VARIANT=$(KUSTOMIZE_VARIANT) \
		--build-arg VALIDATE_RELATED_IMAGES=$(VALIDATE_RELATED_IMAGES) \
		--build-arg APP_VERSION=$(APP_VERSION) \
		-t $(BUNDLE_IMG) .

.PHONY: bundle-push
bundle-push: check-container-tool ## Push bundle image to registry
	@echo "Pushing image $(BUNDLE_IMG)..."
	$(CONTAINER_TOOL) push $(BUNDLE_IMG)
	@echo "Image pushed: $(BUNDLE_IMG)"

# Konflux renders the same template in the run-opm-command pipeline task.
# Locally the olm.bundle image is swapped for BUNDLE_IMG, the template itself is left untouched.
CATALOG_TEMPLATE ?= catalog/konflux-template.yaml
CATALOG_RENDERED ?= catalog/hyperfleet-operator/catalog.yaml
.PHONY: catalog-render
# BUNDLE_IMG reaches the recipe through the environment, never as shell or sed syntax
catalog-render: export CATALOG_BUNDLE_IMG = $(BUNDLE_IMG)
catalog-render: opm ## Render the catalog from CATALOG_TEMPLATE using BUNDLE_IMG as the bundle image
	@[[ "$$CATALOG_BUNDLE_IMG" =~ ^[A-Za-z0-9][A-Za-z0-9._/:@-]*$$ ]] || \
		{ echo "Error: BUNDLE_IMG is not a valid image reference: $$CATALOG_BUNDLE_IMG"; exit 1; }
	@mkdir -p _output $(dir $(CATALOG_RENDERED))
	sed "s|image: .*|image: $$CATALOG_BUNDLE_IMG|" $(CATALOG_TEMPLATE) > _output/catalog-template.yaml
	$(OPM) alpha render-template basic --migrate-level=bundle-object-to-csv-metadata \
		-o yaml _output/catalog-template.yaml > $(CATALOG_RENDERED)
	@echo "Rendered $(CATALOG_RENDERED) with bundle image: $$CATALOG_BUNDLE_IMG"

.PHONY: catalog-build
catalog-build: catalog-render ## Render the catalog and build the catalog image
	$(CONTAINER_TOOL) build \
		-f catalog.Dockerfile \
		--platform $(PLATFORM) \
		--build-arg APP_VERSION="$(APP_VERSION)" \
		-t $(CATALOG_IMG) .

.PHONY: catalog-push
catalog-push: check-container-tool ## Push catalog image to registry
	@echo "Pushing image $(CATALOG_IMG)..."
	$(CONTAINER_TOOL) push $(CATALOG_IMG)
	@echo "Image pushed: $(CATALOG_IMG)"

##@ Dependencies

## Location to install dependencies to
LOCALBIN ?= $(shell pwd)/bin
$(LOCALBIN):
	mkdir -p $(LOCALBIN)

## Tool Binaries
KUBECTL ?= kubectl
KIND ?= kind

.PHONY: operator-sdk
OPERATOR_SDK ?= $(LOCALBIN)/operator-sdk
operator-sdk: ## Download operator-sdk locally if necessary.
ifeq (,$(wildcard $(OPERATOR_SDK)))
ifeq (, $(shell which operator-sdk 2>/dev/null))
	@{ \
	set -e ;\
	mkdir -p $(dir $(OPERATOR_SDK)) ;\
	OS=$(shell go env GOOS) && ARCH=$(shell go env GOARCH) && \
	curl -sSLo $(OPERATOR_SDK) https://github.com/operator-framework/operator-sdk/releases/download/$(OPERATOR_SDK_VERSION)/operator-sdk_$${OS}_$${ARCH} ;\
	chmod +x $(OPERATOR_SDK) ;\
	}
else
OPERATOR_SDK = $(shell which operator-sdk)
endif
endif


.PHONY: opm
OPM = $(LOCALBIN)/opm
OPM_VERSION ?= v1.55.0
OPM_PLATFORM = $(shell go env GOOS)-$(shell go env GOARCH)
# sha256 of the $(OPM_VERSION) release binaries, from the release's checksums.txt
OPM_SHA256_linux-amd64 := eed05ce8d6c21bb4acf4683f270ea7fd69ecf492cb58459c5689575c80800921
OPM_SHA256_linux-arm64 := 4048b965d25a96bdaca5c2ca4e45418ba286391f960708e774760c7abfa509ad
OPM_SHA256_darwin-amd64 := 69d13eab1faf88031ce3cdcc91aa0a430e1e15f3f96294660a0e29cba17751eb
OPM_SHA256_darwin-arm64 := 7b8f4e904888f4551289793d0a5c43dfb37985ee1ad6d1b6db2d1859e60d3f37
OPM_SHA256 = $(OPM_SHA256_$(OPM_PLATFORM))
opm: ## Download opm locally if necessary, verified against a pinned checksum.
ifeq (,$(wildcard $(OPM)))
ifeq (,$(shell which opm 2>/dev/null))
	@{ \
	set -e ;\
	if [ -z "$(OPM_SHA256)" ]; then echo "Error: no pinned opm checksum for $(OPM_PLATFORM)"; exit 1; fi ;\
	mkdir -p $(dir $(OPM)) ;\
	curl -fsSLo $(OPM).download https://github.com/operator-framework/operator-registry/releases/download/$(OPM_VERSION)/$(OPM_PLATFORM)-opm ;\
	if command -v sha256sum >/dev/null 2>&1; then SHA256="sha256sum"; else SHA256="shasum -a 256"; fi ;\
	echo "$(OPM_SHA256)  $(OPM).download" | $$SHA256 -c - || { rm -f $(OPM).download; echo "Error: opm checksum mismatch"; exit 1; } ;\
	mv $(OPM).download $(OPM) ;\
	chmod +x $(OPM) ;\
	}
else
OPM = $(shell which opm)
endif
endif