Makefile

# VERSION defines the project version for the bundle.
# Update this value when you upgrade the version of your project.
# To re-generate a bundle for another specific version without changing the standard setup, you can:
# - use the VERSION as arg of the bundle target (e.g make bundle VERSION=0.0.2)
# - use environment variables to overwrite this value (e.g export VERSION=0.0.2)
VERSION ?= 1.13.0

# PREVIOUS_VERSION defines the version that this release replaces.
# Update this value when you bump VERSION to the next release.
# This is used to set spec.replaces in the OpenShift bundle CSV.
PREVIOUS_VERSION ?= 1.12.1

# CHANNELS define the bundle channels used in the bundle.
# Add a new line here if you would like to change its default config. (E.g CHANNELS = "candidate,fast,stable")
# To re-generate a bundle for other specific channels without changing the standard setup, you can:
# - use the CHANNELS as arg of the bundle target (e.g make bundle CHANNELS=candidate,fast,stable)
# - use environment variables to overwrite this value (e.g export CHANNELS="candidate,fast,stable")
ifneq ($(origin CHANNELS), undefined)
BUNDLE_CHANNELS := --channels=$(CHANNELS)
endif

# DEFAULT_CHANNEL defines the default channel used in the bundle.
# Add a new line here if you would like to change its default config. (E.g DEFAULT_CHANNEL = "stable")
# To re-generate a bundle for any other default channel without changing the default setup, you can:
# - use the DEFAULT_CHANNEL as arg of the bundle target (e.g make bundle DEFAULT_CHANNEL=stable)
# - use environment variables to overwrite this value (e.g export DEFAULT_CHANNEL="stable")
ifneq ($(origin DEFAULT_CHANNEL), undefined)
BUNDLE_DEFAULT_CHANNEL := --default-channel=$(DEFAULT_CHANNEL)
endif
BUNDLE_METADATA_OPTS ?= $(BUNDLE_CHANNELS) $(BUNDLE_DEFAULT_CHANNEL)

# IMAGE_TAG_BASE defines the docker.io namespace and part of the image name for remote images.
# This variable is used to construct full image tags for bundle and catalog images.
#
# For example, running 'make bundle-build bundle-push catalog-build catalog-push' will build and push both
# example.com/memcached-operator-bundle:$VERSION and example.com/memcached-operator-catalog:$VERSION.
IMAGE_TAG_BASE ?= crowdstrike/falcon-operator

# BUNDLE_IMG defines the image:tag used for the bundle.
# You can use it as an arg. (E.g make bundle-build BUNDLE_IMG=<some-registry>/<project-name-bundle>:<tag>)
BUNDLE_IMG ?= $(IMAGE_TAG_BASE)-bundle:v$(VERSION)

# BUNDLE_GEN_FLAGS are the flags passed to the operator-sdk generate bundle command
BUNDLE_GEN_FLAGS ?= -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS)

# USE_IMAGE_DIGESTS defines if images are resolved via tags or digests
# You can enable this value if you would like to use SHA Based Digests
# To enable set flag to true
USE_IMAGE_DIGESTS ?= false
ifeq ($(USE_IMAGE_DIGESTS), true)
	BUNDLE_GEN_FLAGS += --use-image-digests
endif

# Set the Operator SDK version to use. By default, what is installed on the system is used.
# This is useful for CI or a project to utilize a specific version of the operator-sdk toolkit.
OPERATOR_SDK_VERSION ?= v1.38.0

# Image URL to use all building/pushing image targets
IMG ?= controller:latest
# ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
ENVTEST_K8S_VERSION = 1.30.3

# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
ifeq (,$(shell go env GOBIN))
GOBIN=$(shell go env GOPATH)/bin
else
GOBIN=$(shell go env GOBIN)
endif

# GOFLAGS defines additional golang build flags like -tags and -ldflags
GOFLAGS ?= -a \
         -tags "exclude_graphdriver_devicemapper exclude_graphdriver_btrfs containers_image_openpgp" \
         --ldflags="-X 'github.com/crowdstrike/falcon-operator/version.Version=$(VERSION)'"

# CONTAINER_TOOL defines the container tool to be used for building images.
# Be aware that the target commands are only tested with Docker which is
# scaffolded by default. However, you might want to replace it to use other
# tools. (i.e. podman)
CONTAINER_TOOL ?= docker

# CONTAINER_BUILD_ARGS defines additional build arguments to pass to the $CONTAINER_TOOL during build.
CONTAINER_BUILD_ARGS ?= --build-arg VERSION=$(VERSION) --build-arg GOPROXY=$(GOPROXY)

# Setting SHELL to bash allows bash commands to be executed by recipes.
# Options are set to exit when a recipe line exits non-zero or a piped command fails.
SHELL = /usr/bin/env bash -o pipefail
.SHELLFLAGS = -ec

.PHONY: all
all: build

##@ General

# The help target prints out all targets with their descriptions organized
# beneath their categories. The categories are represented by '##@' and the
# target descriptions by '##'. The awk command is responsible for reading the
# entire set of makefiles included in this invocation, looking for lines of the
# file as xyz: ## something, and then pretty-format the target and help. Then,
# if there's a line with ##@ something, that gets pretty-printed as a category.
# More info on the usage of ANSI control characters for terminal formatting:
# https://en.wikipedia.org/wiki/ANSI_escape_code#SGR_parameters
# More info on the awk command:
# http://linuxcommand.org/lc3_adv_awk.php

.PHONY: help
help: ## Display this help.
	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)

##@ Development

.PHONY: manifests
manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
	$(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases

.PHONY: generate
generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
	$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."

.PHONY: fmt
fmt: ## Run go fmt against code.
	go fmt ./...

.PHONY: vet
vet: ## Run go vet against code.
	go vet ./...

.PHONY: test
test: manifests generate fmt vet envtest ## Run tests.
	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test $$(go list ./... | grep -v /test/) -coverprofile cover.out

##@ Testing

# Utilize Kind or modify the e2e tests to load the image locally, enabling compatibility with other vendors.
# Environment Variables (optional):
#   USE_EXISTING_OPERATOR - Set to 'true' to skip operator installation and use existing deployment (default: false)
#   OPERATOR_NAMESPACE - The namespace where the operator is deployed (default: falcon-system, only used with USE_EXISTING_OPERATOR)
#   BUNDLE_IMG - Use OLM bundle installation instead of traditional deployment
#   OPERATOR_IMAGE - Custom operator image to use (default: example.com/falcon-operator:v0.0.1)
#   GINKGO_LABEL_FILTER - Filter tests by label (e.g., "!FalconNodeSensor", "FalconAdmission || FalconContainer")
#   GINKGO_FOCUS - Focus on tests matching this regular expression
#   GINKGO_SKIP - Skip tests matching this regular expression
#   FALCON_CLIENT_ID - CrowdStrike Falcon API Client ID
#   FALCON_CLIENT_SECRET - CrowdStrike Falcon API Client Secret
USE_EXISTING_OPERATOR ?= false
.PHONY: test-e2e
test-e2e: operator-sdk ## Run e2e tests against a Kind k8s instance or existing operator installation
	@set -e; \
	GINKGO_ARGS="-v -ginkgo.v -timeout 30m"; \
	if [ -n "$(GINKGO_LABEL_FILTER)" ]; then \
		GINKGO_ARGS="$$GINKGO_ARGS -ginkgo.label-filter='$(GINKGO_LABEL_FILTER)'"; \
	fi; \
	if [ -n "$(GINKGO_FOCUS)" ]; then \
		GINKGO_ARGS="$$GINKGO_ARGS -ginkgo.focus='$(GINKGO_FOCUS)'"; \
	fi; \
	if [ -n "$(GINKGO_SKIP)" ]; then \
		GINKGO_ARGS="$$GINKGO_ARGS -ginkgo.skip='$(GINKGO_SKIP)'"; \
	fi; \
	if [ "$(USE_EXISTING_OPERATOR)" = "true" ]; then \
		USE_EXISTING_OPERATOR=true OPERATOR_NAMESPACE=$(or $(OPERATOR_NAMESPACE),falcon-system) \
		eval "go test ./test/e2e/ $$GINKGO_ARGS"; \
	else \
		eval "go test ./test/e2e/ $$GINKGO_ARGS"; \
	fi

GOLANGCI_LINT = $(shell pwd)/bin/golangci-lint
GOLANGCI_LINT_VERSION ?= v1.54.2
golangci-lint:
	@[ -f $(GOLANGCI_LINT) ] || { \
	set -e ;\
	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(shell dirname $(GOLANGCI_LINT)) $(GOLANGCI_LINT_VERSION) ;\
	}

.PHONY: lint
lint: golangci-lint ## Run golangci-lint linter & yamllint
	$(GOLANGCI_LINT) run

.PHONY: lint-fix
lint-fix: golangci-lint ## Run golangci-lint linter and perform fixes
	$(GOLANGCI_LINT) run --fix

##@ Build

.PHONY: build
build: manifests generate fmt vet ## Build manager binary.
	go build $(GOFLAGS) -o bin/manager cmd/main.go

.PHONY: run
run: manifests generate fmt vet ## Run a controller from your host.
	go run ./cmd/main.go

# If you wish to build the manager image targeting other platforms you can use the --platform flag.
# (i.e. docker build --platform linux/arm64). However, you must enable docker buildKit for it.
# More info: https://docs.docker.com/develop/develop-images/build_enhancements/
.PHONY: docker-build
docker-build: ## Build docker image with the manager.
	$(CONTAINER_TOOL) build $(CONTAINER_BUILD_ARGS) -t ${IMG} .

.PHONY: docker-push
docker-push: ## Push docker image with the manager.
	$(CONTAINER_TOOL) push ${IMG}

# PLATFORMS defines the target platforms for the manager image be built to provide support to multiple
# architectures. (i.e. make docker-buildx IMG=myregistry/mypoperator:0.0.1). To use this option you need to:
# - be able to use docker buildx. More info: https://docs.docker.com/build/buildx/
# - have enabled BuildKit. More info: https://docs.docker.com/develop/develop-images/build_enhancements/
# - be able to push the image to your registry (i.e. if you do not set a valid value via IMG=<myregistry/image:<tag>> then the export will fail)
# To adequately provide solutions that are compatible with multiple platforms, you should consider using this option.
PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
.PHONY: docker-buildx
docker-buildx: ## Build and push docker image for the manager for cross-platform support
	# copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile
	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross
	- $(CONTAINER_TOOL) buildx create --name project-v3-builder
	$(CONTAINER_TOOL) buildx use project-v3-builder
	- $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) $(CONTAINER_BUILD_ARGS) --provenance=false --tag ${IMG} -f Dockerfile.cross .
	- $(CONTAINER_TOOL) buildx rm project-v3-builder
	rm Dockerfile.cross

##@ Deployment

ifndef ignore-not-found
  ignore-not-found = false
endif

.PHONY: install
install: manifests kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config.
	$(KUSTOMIZE) build config/crd | $(KUBECTL) apply -f -

.PHONY: uninstall
uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
	$(KUSTOMIZE) build config/crd | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -

.PHONY: deploy
deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
	$(KUSTOMIZE) build config/default | $(KUBECTL) apply -f -

.PHONY: undeploy
undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
	$(KUSTOMIZE) build config/default | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -

##@ Build Dependencies

## Location to install dependencies to
LOCALBIN ?= $(shell pwd)/bin
$(LOCALBIN):
	mkdir -p $(LOCALBIN)

## Tool Binaries
KUBECTL ?= kubectl
KUSTOMIZE ?= $(LOCALBIN)/kustomize
CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
ENVTEST ?= $(LOCALBIN)/setup-envtest
KUBEBUILDER ?= $(LOCALBIN)/kubebuilder

## Tool Versions
KUSTOMIZE_VERSION ?= v5.6.0
CONTROLLER_TOOLS_VERSION ?= v0.20.1
KUBEBUILDER_VERSION ?= v4.15.0

.PHONY: kustomize
kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary. If wrong version is installed, it will be removed before downloading.
$(KUSTOMIZE): $(LOCALBIN)
	@if test -x $(LOCALBIN)/kustomize && ! $(LOCALBIN)/kustomize version | grep -q $(KUSTOMIZE_VERSION); then \
		echo "$(LOCALBIN)/kustomize version is not expected $(KUSTOMIZE_VERSION). Removing it before installing."; \
		rm -rf $(LOCALBIN)/kustomize; \
	fi
	test -s $(LOCALBIN)/kustomize || GOBIN=$(LOCALBIN) GO111MODULE=on go install sigs.k8s.io/kustomize/kustomize/v5@$(KUSTOMIZE_VERSION)

.PHONY: controller-gen
controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary. If wrong version is installed, it will be overwritten.
$(CONTROLLER_GEN): $(LOCALBIN)
	test -s $(LOCALBIN)/controller-gen && $(LOCALBIN)/controller-gen --version | grep -q $(CONTROLLER_TOOLS_VERSION) || \
	GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_TOOLS_VERSION)

.PHONY: envtest
envtest: $(ENVTEST) ## Download envtest-setup locally if necessary.
$(ENVTEST): $(LOCALBIN)
	test -s $(LOCALBIN)/setup-envtest || GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@release-0.23

.PHONY: kubebuilder
kubebuilder: $(KUBEBUILDER) ## Download kubebuilder locally if necessary. If wrong version is installed, it will be removed before downloading.
$(KUBEBUILDER): $(LOCALBIN)
	@if test -x $(KUBEBUILDER) && ! $(KUBEBUILDER) version | grep -q $(KUBEBUILDER_VERSION); then \
		echo "$(KUBEBUILDER) version does not match expected $(KUBEBUILDER_VERSION). Removing and reinstalling."; \
		rm -rf $(KUBEBUILDER); \
	fi
	@if ! test -s $(KUBEBUILDER); then \
		set -e ;\
		mkdir -p $(LOCALBIN) ;\
		OS=$$(go env GOOS) && ARCH=$$(go env GOARCH) && \
		curl -sSLo $(KUBEBUILDER) https://github.com/kubernetes-sigs/kubebuilder/releases/download/$(KUBEBUILDER_VERSION)/kubebuilder_$${OS}_$${ARCH} ;\
		chmod +x $(KUBEBUILDER) ;\
	fi
	@echo "Installed kubebuilder version: $$($(KUBEBUILDER) version | awk 'NR==1{print $$NF}')"

.PHONY: operator-sdk
OPERATOR_SDK ?= $(LOCALBIN)/operator-sdk
operator-sdk: $(LOCALBIN) ## Download operator-sdk locally if necessary. If wrong version is installed, it will be removed before downloading.
	@if test -x $(OPERATOR_SDK) && ! $(OPERATOR_SDK) version | grep -q $(OPERATOR_SDK_VERSION); then \
		echo "$(OPERATOR_SDK) version does not match expected $(OPERATOR_SDK_VERSION). Removing and reinstalling."; \
		rm -rf $(OPERATOR_SDK); \
	fi
	@if ! test -s $(OPERATOR_SDK); then \
		set -e ;\
		mkdir -p $(LOCALBIN) ;\
		OS=$$(go env GOOS) && ARCH=$$(go env GOARCH) && \
		curl -sSLo $(OPERATOR_SDK) https://github.com/operator-framework/operator-sdk/releases/download/$(OPERATOR_SDK_VERSION)/operator-sdk_$${OS}_$${ARCH} ;\
		chmod +x $(OPERATOR_SDK) ;\
	fi
	@echo "Installed operator-sdk version: $$($(OPERATOR_SDK) version | awk -F'"' '{print $$2; exit}')"

.PHONY: bundle
bundle: manifests kustomize operator-sdk ## Generate bundle manifests and metadata, then validate generated files.
	$(OPERATOR_SDK) generate kustomize manifests -q
	cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG)
	$(KUSTOMIZE) build config/manifests | $(OPERATOR_SDK) generate bundle $(BUNDLE_GEN_FLAGS)
	perl -pi -e 's/FALCON_OPERATOR_MANIFEST_PLACEHOLDER/$(VERSION)/g' bundle/manifests/falcon-operator.clusterserviceversion.yaml
	$(OPERATOR_SDK) bundle validate ./bundle

.PHONY: bundle-build
bundle-build: ## Build the bundle image.
	docker build -f bundle.Dockerfile -t $(BUNDLE_IMG) .

.PHONY: bundle-push
bundle-push: ## Push the bundle image.
	$(MAKE) docker-push IMG=$(BUNDLE_IMG)

.PHONY: opm
OPM = $(LOCALBIN)/opm
opm: ## Download opm locally if necessary.
ifeq (,$(wildcard $(OPM)))
ifeq (,$(shell which opm 2>/dev/null))
	@{ \
	set -e ;\
	mkdir -p $(dir $(OPM)) ;\
	OS=$(shell go env GOOS) && ARCH=$(shell go env GOARCH) && \
	curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.23.0/$${OS}-$${ARCH}-opm ;\
	chmod +x $(OPM) ;\
	}
else
OPM = $(shell which opm)
endif
endif

# A comma-separated list of bundle images (e.g. make catalog-build BUNDLE_IMGS=example.com/operator-bundle:v0.1.0,example.com/operator-bundle:v0.2.0).
# These images MUST exist in a registry and be pull-able.
BUNDLE_IMGS ?= $(BUNDLE_IMG)

# The image tag given to the resulting catalog image (e.g. make catalog-build CATALOG_IMG=example.com/operator-catalog:v0.2.0).
CATALOG_IMG ?= $(IMAGE_TAG_BASE)-catalog:v$(VERSION)

# Set CATALOG_BASE_IMG to an existing catalog image tag to add $BUNDLE_IMGS to that image.
ifneq ($(origin CATALOG_BASE_IMG), undefined)
FROM_INDEX_OPT := --from-index $(CATALOG_BASE_IMG)
endif

# Build a catalog image by adding bundle images to an empty catalog using the operator package manager tool, 'opm'.
# This recipe invokes 'opm' in 'semver' bundle add mode. For more information on add modes, see:
# https://github.com/operator-framework/community-operators/blob/7f1438c/docs/packaging-operator.md#updating-your-existing-operator
.PHONY: catalog-build
catalog-build: opm ## Build a catalog image.
	$(OPM) index add --container-tool docker --mode semver --tag $(CATALOG_IMG) --bundles $(BUNDLE_IMGS) $(FROM_INDEX_OPT)

# Push the catalog image.
.PHONY: catalog-push
catalog-push: ## Push a catalog image.
	$(MAKE) docker-push IMG=$(CATALOG_IMG)

.PHONY: non-olm
non-olm: kustomize ## Generate non-olm deployment manifest
	$(KUSTOMIZE) build config/non-olm -o deploy/falcon-operator.yaml
	perl -pi -e 's/FALCON_OPERATOR_MANIFEST_PLACEHOLDER/$(VERSION)/g' deploy/falcon-operator.yaml

.PHONY: bundle-openshift
bundle-openshift: manifests kustomize operator-sdk ## Generate OpenShift bundle with certification requirements
	$(OPERATOR_SDK) generate kustomize manifests -q
	cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG)
	$(KUSTOMIZE) build config/manifests | $(OPERATOR_SDK) generate bundle $(BUNDLE_GEN_FLAGS) --channels=certified-1.0 --default-channel=certified-1.0
	perl -pi -e 's/FALCON_OPERATOR_MANIFEST_PLACEHOLDER/$(VERSION)/g' bundle/manifests/falcon-operator.clusterserviceversion.yaml
	@echo "Applying OpenShift-specific patches..."
	@yq -i '.[0].value = "falcon-operator.v$(PREVIOUS_VERSION)"' config/manifests-openshift/patches/replaces.yaml
	@hack/patch-openshift-bundle.sh
	@hack/patch-openshift-bundle.sh --apply
	@yq eval-all -i 'select(fileIndex == 0) * select(fileIndex == 1)' bundle/metadata/annotations.yaml config/manifests-openshift/patches/bundle-metadata-annotations.yaml
	@echo "Restoring patch templates..."
	@yq -i '.[0].value = "falcon-operator.vPREVIOUS_VERSION"' config/manifests-openshift/patches/replaces.yaml
	@hack/patch-openshift-bundle.sh --restore
	@echo "✓ OpenShift bundle generated successfully"

.PHONY: bundle-openshift-validate
bundle-openshift-validate: ## Validate OpenShift bundle patches were applied correctly
	@hack/validate-openshift-bundle.sh

##@ Helm Deployment

## Helm binary to use for deploying the chart
HELM ?= $(LOCALBIN)/helm
## Namespace to deploy the Helm release
HELM_NAMESPACE ?= falcon-operator
## Name of the Helm release
HELM_RELEASE ?= falcon-operator
## Path to the Helm chart directory
HELM_CHART_DIR ?= helm-charts/chart
## Additional arguments to pass to helm commands
HELM_EXTRA_ARGS ?=
## Helm version to install
HELM_VERSION ?=

# RBAC template files that were ClusterRole/ClusterRoleBinding in kustomize.
# The helm plugin wraps all RBAC kinds with an rbac.namespaced toggle regardless
# of the source kind, so we strip the toggle back out after generation.
HELM_CLUSTERROLE_TEMPLATES = \
	$(HELM_CHART_DIR)/templates/rbac/admission-controller-role.yaml \
	$(HELM_CHART_DIR)/templates/rbac/container-role.yaml \
	$(HELM_CHART_DIR)/templates/rbac/image-controller-role.yaml \
	$(HELM_CHART_DIR)/templates/rbac/manager-role.yaml \
	$(HELM_CHART_DIR)/templates/rbac/manager-rolebinding.yaml \
	$(HELM_CHART_DIR)/templates/rbac/node-sensor-role.yaml

.PHONY: helm-build
helm-build: kubebuilder
	$(KUBEBUILDER) edit --plugins=helm/v2-alpha --output-dir=helm-charts --manifests deploy/falcon-operator.yaml
	@# Remove unused templates
	rm -rf $(HELM_CHART_DIR)/templates/prometheus $(HELM_CHART_DIR)/templates/network-policy
	rm -f $(HELM_CHART_DIR)/templates/rbac/falcon-FalconDeployment-editor-role.yaml
	rm -f $(HELM_CHART_DIR)/templates/rbac/falcon-FalconDeployment-viewer-role.yaml
	rm -f .github/workflows/test-chart.yml
	@# Strip rbac.namespaced kind/namespace toggles — keep ClusterRole/ClusterRoleBinding hardcoded
	@for f in $(HELM_CLUSTERROLE_TEMPLATES); do \
		perl -0777 -i -pe \
			's/\{\{- if \.Values\.rbac\.namespaced \}\}\nkind: Role\n\{\{- else \}\}\nkind: ClusterRole\n\{\{- end \}\}/kind: ClusterRole/g; \
			 s/\{\{- if \.Values\.rbac\.namespaced \}\}\nkind: RoleBinding\n\{\{- else \}\}\nkind: ClusterRoleBinding\n\{\{- end \}\}/kind: ClusterRoleBinding/g; \
			 s/  \{\{- if \.Values\.rbac\.namespaced \}\}\n  kind: Role\n  \{\{- else \}\}\n  kind: ClusterRole\n  \{\{- end \}\}/  kind: ClusterRole/g; \
			 s/\{\{- if \.Values\.rbac\.namespaced \}\}\n  namespace: \{\{ \.Release\.Namespace \}\}\n\{\{- end \}\}\n//g' \
			$$f; \
	done

.PHONY: install-helm
install-helm: $(LOCALBIN) ## Install Helm (version specified by HELM_VERSION, or latest if unset).
	@if [ -n "$(HELM_VERSION)" ] && test -x $(HELM) && ! $(HELM) version --short | grep -q "$(HELM_VERSION)"; then \
		echo "$(HELM) version is not expected $(HELM_VERSION). Removing it before installing."; \
		rm -f $(HELM); \
	fi
	@if [ -z "$(HELM_VERSION)" ] || [ ! -f $(HELM) ]; then \
		echo "Installing Helm..." && \
		if [ -n "$(HELM_VERSION)" ]; then \
			curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4 | HELM_INSTALL_DIR=$(LOCALBIN) DESIRED_VERSION="$(HELM_VERSION)" USE_SUDO=false bash; \
		else \
			curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4 | HELM_INSTALL_DIR=$(LOCALBIN) USE_SUDO=false bash; \
		fi; \
	fi

.PHONY: helm-deploy
helm-deploy: install-helm helm-build ## Deploy manager to the K8s cluster via Helm. Specify an image with IMG.
	img="$(IMG)"; \
	$(HELM) upgrade --install $(HELM_RELEASE) $(HELM_CHART_DIR) \
		--namespace $(HELM_NAMESPACE) \
		--create-namespace \
		--set manager.image.repository=$${img%:*} \
		--set manager.image.tag=$${img##*:} \
		--wait \
		--timeout 5m \
		$(HELM_EXTRA_ARGS)

.PHONY: helm-uninstall
helm-uninstall: ## Uninstall the Helm release from the K8s cluster.
	$(HELM) uninstall $(HELM_RELEASE) --namespace $(HELM_NAMESPACE)

.PHONY: helm-status
helm-status: ## Show Helm release status.
	$(HELM) status $(HELM_RELEASE) --namespace $(HELM_NAMESPACE)

.PHONY: helm-history
helm-history: ## Show Helm release history.
	$(HELM) history $(HELM_RELEASE) --namespace $(HELM_NAMESPACE)

.PHONY: helm-rollback
helm-rollback: ## Rollback to previous Helm release.
	$(HELM) rollback $(HELM_RELEASE) --namespace $(HELM_NAMESPACE)