Makefile

# ------------------------------------------------------------------------------
# Configuration - Repository
# ------------------------------------------------------------------------------

REPO ?= github.com/kong/kong-operator
REPO_URL ?= https://$(REPO)
REPO_NAME ?= $(shell echo $(REPO) | cut -d / -f 3)
REPO_INFO ?= $(shell git config --get remote.origin.url)
TAG ?= $(shell git describe --tags)
VERSION ?= $(shell cat VERSION)
GO_MODULE_MAJOR_VERSION := $(shell go list -m -f '{{.Path}}' | awk -F'/v' '{print (NF>1) ? $$NF : "1"}')
GO_METADATA_PACKAGE = $(REPO)/v$(GO_MODULE_MAJOR_VERSION)/modules/manager/metadata

ifndef COMMIT
  COMMIT := $(shell git rev-parse --short HEAD)
endif

# ------------------------------------------------------------------------------
# Configuration - Build
# ------------------------------------------------------------------------------

# Some sensible Make defaults: https://tech.davis-hansson.com/p/make/
SHELL = bash
.SHELLFLAGS = -euc -o pipefail

IMG ?= docker.io/kong/kong-operator
KUSTOMIZE_IMG_NAME = docker.io/kong/kong-operator

ifeq (Darwin,$(shell uname -s))
LDFLAGS_COMMON ?= -extldflags=-Wl,-ld_classic
endif

LDFLAGS_METADATA ?= \
	-X $(GO_METADATA_PACKAGE).projectName=$(REPO_NAME) \
	-X $(GO_METADATA_PACKAGE).release=$(TAG) \
	-X $(GO_METADATA_PACKAGE).commit=$(COMMIT) \
	-X $(GO_METADATA_PACKAGE).repo=$(REPO_INFO) \
	-X $(GO_METADATA_PACKAGE).repoURL=$(REPO_URL)

# ------------------------------------------------------------------------------
# Configuration - Tooling
# ------------------------------------------------------------------------------

ifeq (,$(shell go env GOBIN))
GOBIN=$(shell go env GOPATH)/bin
else
GOBIN=$(shell go env GOBIN)
endif

PROJECT_DIR := $(shell dirname $(abspath $(lastword $(MAKEFILE_LIST))))

TOOLS_VERSIONS_FILE = $(PROJECT_DIR)/.tools_versions.yaml

.PHONY: tools
tools: controller-gen kustomize client-gen golangci-lint gotestsum skaffold yq crd-ref-docs

MISE := $(shell which mise)
MISE_FILE := .mise.toml
MISE_DATA_DIR ?= $(PROJECT_DIR)/bin/

.PHONY: mise
mise:
	@mise -V >/dev/null 2>/dev/null || (echo "mise - https://github.com/jdx/mise - not found. Please install it." && exit 1)

.PHONY: mise-plugin-install
mise-plugin-install: mise
	$(MISE) plugin install --yes -q $(DEP) $(URL)

.PHONY: mise-install
mise-install: mise
	MISE_DATA_DIR=$(PROJECT_DIR)/bin/ $(MISE) install -q $(DEP_VER)

# NOTE: some tools like helm are to be used by users inside the operator directory.
# Installing them to bin/ will make them unavailable unless MISE_DATA_DIR env variable
# is set to $(PROJECT_DIR)/bin/, which is not outside of this Makefile.
# Hence installing such tools globally on the system.
.PHONY: mise-install-global
mise-install-global: mise
	@$(MISE) install -q $(DEP_VER)

OS := $(shell uname | tr '[:upper:]' '[:lower:]')
ARCH := $(shell uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')

# Do not store yq's version in .tools_versions.yaml as it is used to get tool versions.
# renovate: datasource=github-releases depName=mikefarah/yq
YQ_VERSION = 4.52.4
YQ = $(PROJECT_DIR)/bin/installs/github-mikefarah-yq/$(YQ_VERSION)/yq_$(OS)_$(ARCH)
.PHONY: yq
yq: mise # Download yq locally if necessary.
	$(MAKE) mise-install DEP_VER=github:mikefarah/yq@$(YQ_VERSION)

CONTROLLER_GEN_VERSION = $(shell $(YQ) -r '.controller-tools' < $(TOOLS_VERSIONS_FILE))
CONTROLLER_GEN = $(PROJECT_DIR)/bin/installs/github-kubernetes-sigs-controller-tools/$(CONTROLLER_GEN_VERSION)/controller-gen
.PHONY: controller-gen
controller-gen: mise yq ## Download controller-gen locally if necessary.
	$(MAKE) mise-install DEP_VER=github:kubernetes-sigs/controller-tools@$(CONTROLLER_GEN_VERSION)

KUSTOMIZE_VERSION = $(shell $(YQ) -p toml -o yaml '.tools["github:kubernetes-sigs/kustomize"].version' < $(MISE_FILE))
KUSTOMIZE = $(PROJECT_DIR)/bin/installs/github-kubernetes-sigs-kustomize/$(KUSTOMIZE_VERSION)/kustomize
.PHONY: kustomize
kustomize: mise yq ## Download kustomize locally if necessary.
	$(MAKE) mise-install DEP_VER=github:kubernetes-sigs/kustomize

CLIENT_GEN_VERSION = $(shell $(YQ) -r '.code-generator' < $(TOOLS_VERSIONS_FILE))
CLIENT_GEN = $(PROJECT_DIR)/bin/installs/go-k8s-io-code-generator-cmd-client-gen/$(CLIENT_GEN_VERSION)/bin/client-gen
.PHONY: client-gen
client-gen: mise yq ## Download client-gen locally if necessary.
	$(MAKE) mise-install DEP_VER=go:k8s.io/code-generator/cmd/client-gen@$(CLIENT_GEN_VERSION)

GOLANGCI_LINT_VERSION = $(shell $(YQ) -r '.golangci-lint' < $(TOOLS_VERSIONS_FILE))
GOLANGCI_LINT = $(PROJECT_DIR)/bin/installs/github-golangci-golangci-lint/$(GOLANGCI_LINT_VERSION)/golangci-lint
.PHONY: golangci-lint
golangci-lint: mise yq ## Download golangci-lint locally if necessary.
	$(MAKE) mise-install DEP_VER=github:golangci/golangci-lint@$(GOLANGCI_LINT_VERSION)

.PHONY: golangci-lint-cache-path
golangci-lint-cache-path:
	@$(GOLANGCI_LINT) cache status | awk '{ print $$2 }'

.PHONY: go-fix
go-fix:
	go fix ./...

GOTESTSUM_VERSION = $(shell $(YQ) -r '.gotestsum' < $(TOOLS_VERSIONS_FILE))
GOTESTSUM = $(PROJECT_DIR)/bin/installs/github-gotestyourself-gotestsum/$(GOTESTSUM_VERSION)/gotestsum
.PHONY: gotestsum
gotestsum: mise yq ## Download gotestsum locally if necessary.
	$(MAKE) mise-install DEP_VER=github:gotestyourself/gotestsum@$(GOTESTSUM_VERSION)

CRD_REF_DOCS_VERSION = $(shell $(YQ) -r '.crd-ref-docs' < $(TOOLS_VERSIONS_FILE))
CRD_REF_DOCS = $(PROJECT_DIR)/bin/installs/github-elastic-crd-ref-docs/$(CRD_REF_DOCS_VERSION)/crd-ref-docs
.PHONY: crd-ref-docs
crd-ref-docs: yq ## Download crd-ref-docs locally if necessary.
	$(MAKE) mise-install DEP_VER=github:elastic/crd-ref-docs@$(CRD_REF_DOCS_VERSION)

SKAFFOLD_VERSION = $(shell $(YQ) -r '.skaffold' < $(TOOLS_VERSIONS_FILE))
SKAFFOLD = $(PROJECT_DIR)/bin/installs/github-google-container-tools-skaffold/$(SKAFFOLD_VERSION)/skaffold
.PHONY: skaffold
skaffold: mise yq ## Download skaffold locally if necessary.
	$(MAKE) mise-install DEP_VER=github:GoogleContainerTools/skaffold@$(SKAFFOLD_VERSION)

SETUP_ENVTEST_VERSION = $(shell $(YQ) -r '.setup-envtest' < $(TOOLS_VERSIONS_FILE))
SETUP_ENVTEST = $(PROJECT_DIR)/bin/installs/github-kubernetes-sigs-controller-runtime/$(SETUP_ENVTEST_VERSION)/setup-envtest
.PHONY: setup-envtest
setup-envtest: mise yq ## Download setup-envtest locally if necessary.
	$(MAKE) mise-install DEP_VER=github:kubernetes-sigs/controller-runtime@$(SETUP_ENVTEST_VERSION)

ACTIONLINT_VERSION = $(shell $(YQ) -r '.actionlint' < $(TOOLS_VERSIONS_FILE))
ACTIONLINT = $(PROJECT_DIR)/bin/installs/github-rhysd-actionlint/$(ACTIONLINT_VERSION)/actionlint
.PHONY: download.actionlint
download.actionlint: mise yq ## Download actionlint locally if necessary.
	$(MAKE) mise-install DEP_VER=github:rhysd/actionlint@$(ACTIONLINT_VERSION)

SHELLCHECK_VERSION = $(shell $(YQ) -r '.shellcheck' < $(TOOLS_VERSIONS_FILE))
SHELLCHECK = $(PROJECT_DIR)/bin/installs/github-koalaman-shellcheck/$(SHELLCHECK_VERSION)/shellcheck
.PHONY: download.shellcheck
download.shellcheck: mise yq ## Download shellcheck locally if necessary.
	$(MAKE) mise-install DEP_VER=github:koalaman/shellcheck@$(SHELLCHECK_VERSION)

GOVULNCHECK_VERSION = $(shell $(YQ) -r '.govulncheck' < $(TOOLS_VERSIONS_FILE))
GOVULNCHECK = $(PROJECT_DIR)/bin/installs/go-golang-org-x-vuln-cmd-govulncheck/$(GOVULNCHECK_VERSION)/bin/govulncheck
.PHONY: download.govulncheck
download.govulncheck: mise yq ## Download govulncheck locally if necessary.
	$(MAKE) mise-install DEP_VER=go:golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION)

CHARTSNAP_VERSION = $(shell $(YQ) -ojson -r '.chartsnap' < $(TOOLS_VERSIONS_FILE))
.PHONY: download.chartsnap
download.chartsnap: yq download.helm
	HELM=$(HELM) CHARTSNAP_VERSION=$(CHARTSNAP_VERSION) ./scripts/install-chartsnap.sh

KUBE_LINTER_VERSION = $(shell $(YQ) -ojson -r '.kube-linter' < $(TOOLS_VERSIONS_FILE))
KUBE_LINTER = $(PROJECT_DIR)/bin/installs/github-stackrox-kube-linter/$(KUBE_LINTER_VERSION)/kube-linter
.PHONY: kube-linter
download.kube-linter: mise yq
	$(MAKE) mise-install DEP_VER=github:stackrox/kube-linter@$(KUBE_LINTER_VERSION)

TELEPRESENCE_VERSION = $(shell $(YQ) -p toml -o yaml '.tools["github:telepresenceio/telepresence"].version' < $(MISE_FILE))
TELEPRESENCE= $(PROJECT_DIR)/bin/installs/github-telepresenceio-telepresence/$(TELEPRESENCE_VERSION)/telepresence
.PHONY: download.telepresence
download.telepresence: mise yq ## Download telepresence locally if necessary.
	$(MAKE) mise-install DEP_VER=github:telepresenceio/telepresence

MARKDOWNLINT_VERSION = $(shell $(YQ) -r '.markdownlint-cli2' < $(TOOLS_VERSIONS_FILE))
MARKDOWNLINT = $(PROJECT_DIR)/bin/installs/npm-markdownlint-cli2/$(MARKDOWNLINT_VERSION)/bin/markdownlint-cli2
.PHONY: download.markdownlint-cli2
download.markdownlint-cli2: mise yq ## Download markdownlint-cli2 locally if necessary.
	$(MAKE) mise-install DEP_VER=npm:markdownlint-cli2@$(MARKDOWNLINT_VERSION)

HELM_VERSION = $(shell $(YQ) -p toml -o yaml '.tools["http:helm"].version' < $(MISE_FILE))
HELM = helm
.PHONY: download.helm
download.helm: mise yq ## Download helm locally if necessary.
	$(MAKE) mise-install-global DEP_VER=http:helm

KUBE_API_LINTER_VERSION = $(shell $(YQ) -p toml -o yaml '.tools["go:sigs.k8s.io/kube-api-linter/cmd/golangci-lint-kube-api-linter"].version' < $(MISE_FILE))
KUBE_API_LINTER = $(PROJECT_DIR)/bin/installs/go-sigs-k8s-io-kube-api-linter-cmd-golangci-lint-kube-api-linter/$(KUBE_API_LINTER_VERSION)/bin/golangci-lint-kube-api-linter
.PHONY: download.kube-api-linter
download.kube-api-linter: mise yq ## Download kube-api-linter locally if necessary.
	$(MAKE) mise-install DEP_VER=go:sigs.k8s.io/kube-api-linter/cmd/golangci-lint-kube-api-linter@$(KUBE_API_LINTER_VERSION)

CHAINSAW_VERSION = $(shell $(YQ) -r '.chainsaw' < $(TOOLS_VERSIONS_FILE))
CHAINSAW = $(PROJECT_DIR)/bin/installs/github-kyverno-chainsaw/$(CHAINSAW_VERSION)/chainsaw
.PHONY: chainsaw
chainsaw: mise yq ## Download chainsaw locally if necessary.
	$(MAKE) mise-install DEP_VER=github:kyverno/chainsaw@$(CHAINSAW_VERSION)

.PHONY: use-setup-envtest
use-setup-envtest:
	$(SETUP_ENVTEST) use -v info $(CLUSTER_VERSION)

# ------------------------------------------------------------------------------
# Build
# ------------------------------------------------------------------------------

.PHONY: all
all: build

.PHONY: clean
clean:
	@rm -rf build/
	@rm -rf bin/*
	@rm -f coverage*.out

.PHONY: tidy
tidy:
	go mod tidy
	go mod verify

.PHONY: build.operator
build.operator:
	$(MAKE) _build.operator LDFLAGS="-s -w"

.PHONY: build.operator.debug
build.operator.debug:
	$(MAKE) _build.operator GCFLAGS="-gcflags='all=-N -l'"

.PHONY: _build.operator
_build.operator:
	go build -o bin/manager $(GCFLAGS) \
		-ldflags "$(LDFLAGS_COMMON) $(LDFLAGS) $(LDFLAGS_METADATA)" \
		cmd/main.go

.PHONY: build
build: generate
	$(MAKE) build.operator

.PHONY: _govulncheck
_govulncheck:
	GOVULNCHECK=$(GOVULNCHECK) SCAN=$(SCAN) ./hack/govulncheck-with-excludes.sh ./...

.PHONY: govulncheck
govulncheck: download.govulncheck
	$(MAKE) _govulncheck SCAN=symbol
	$(MAKE) _govulncheck SCAN=package

GOLANGCI_LINT_CONFIG ?= $(PROJECT_DIR)/.golangci.yaml
.PHONY: lint
lint: lint.modules lint.golangci-lint

.PHONY: lint.modules
lint.modules:
	go mod tidy -diff

.PHONY: lint.golangci-lint
lint.golangci-lint: golangci-lint
	$(GOLANGCI_LINT) run -v --config $(GOLANGCI_LINT_CONFIG) $(GOLANGCI_LINT_FLAGS)

.PHONY: lint.charts
lint.charts: download.kube-linter
	$(KUBE_LINTER) lint charts/

.PHONY: lint.actions
lint.actions: download.actionlint download.shellcheck
# TODO: add more files to be checked
	SHELLCHECK_OPTS='--exclude=SC2086,SC2155,SC2046' \
	$(ACTIONLINT) -shellcheck $(SHELLCHECK) \
		./.github/workflows/*

.PHONY: lint.markdownlint
lint.markdownlint: download.markdownlint-cli2
	$(MARKDOWNLINT) \
		CHANGELOG.md \
		README.md \
		FEATURES.md \
		AGENTS.md \
		.github/ISSUE_TEMPLATE/*.md \
		charts/kong-operator/README.md \
		charts/kong-operator/UPGRADE.md \
		charts/kong-operator/CHANGELOG.md

.PHONY: lint.all
lint.all: lint lint.charts lint.actions lint.markdownlint

.PHONY: verify
verify: verify.go-fix verify.manifests verify.generators

.PHONY: verify.diff
verify.diff:
	@$(PROJECT_DIR)/scripts/verify-diff.sh $(PROJECT_DIR)

.PHONY: verify.repo
verify.repo:
	@$(PROJECT_DIR)/scripts/verify-repo.sh

.PHONY: verify.manifests
verify.manifests: verify.repo manifests verify.diff

.PHONY: verify.generators
verify.generators: verify.repo generate verify.diff

.PHONY: verify.go-fix
verify.go-fix: go-fix verify.diff

# ------------------------------------------------------------------------------
# Build - Generators
# ------------------------------------------------------------------------------

API_DIR ?= api

.PHONY: generate
# Integrated workflow: in addition to API/deepcopy/docs, also generate manifests and update chart golden snapshots.
# This consolidates the previous sequence:
#   make generate && make manifests && make test.charts.golden.update
# into a single command: make generate
# Note: manifests is placed near the end to preserve the prior ordering (docs are generated from CRDs first).
generate: generate.api generate.api-from-oas generate.crds generate.crd-kustomize generate.k8sio-gomod-replace generate.apitypes-funcs generate.docs generate.lint-fix manifests test.charts.golden.update generate.cli-arguments-docs

.PHONY: generate.crds
generate.crds: controller-gen ## Generate WebhookConfiguration and CustomResourceDefinition objects.
	@echo "Generate CRDs in version $(VERSION)"
	VERSION=$(VERSION) go run ./scripts/crds-generator

.PHONY: generate.crd-kustomize
generate.crd-kustomize:
	./scripts/generate-crd-kustomize.sh

.PHONY: generate.api
generate.api: controller-gen
	$(CONTROLLER_GEN) object:headerFile="hack/generators/boilerplate.go.txt" paths="./$(API_DIR)/..."

.PHONY: generate.api-from-oas
generate.api-from-oas:
	mise r generate-api

.PHONY: generate.apitypes-funcs
generate.apitypes-funcs:
	go run ./scripts/apitypes-funcs

.PHONY: generate.docs
generate.docs: generate.apidocs

.PHONY: generate.apidocs
generate.apidocs: crd-ref-docs
	./scripts/apidocs-gen/generate.sh $(CRD_REF_DOCS)

# Apply same auto-fixes as golangci-lint to keep generate and lint consistent
.PHONY: generate.lint-fix
generate.lint-fix: golangci-lint
	$(GOLANGCI_LINT) run -v --config $(GOLANGCI_LINT_CONFIG) --fix

# this will generate the custom typed clients needed for end-users implementing logic in Go to use our API types.
.PHONY: generate.clientsets
generate.clientsets: client-gen
	# We create a symlink to the apis/ directory as a hack because currently
	# client-gen does not properly support the use of api/ as your API
	# directory.
	#
	# See: https://github.com/kubernetes/code-generator/issues/167
	ln -sf api apis
	$(CLIENT_GEN) \
		--go-header-file ./hack/generators/boilerplate.go.txt \
		--clientset-name clientset \
		--input-base '' \
		--input $(REPO)/apis/v1alpha1 \
		--input $(REPO)/apis/v1beta1 \
		--output-dir pkg/ \
		--output-pkg $(REPO)/pkg/
	rm apis
	find ./pkg/clientset/ -type f -name '*.go' -exec sed -i '' -e 's/github.com\/kong\/gateway-operator\/apis/github.com\/kong\/gateway-operator\/api/gI' {} \; &> /dev/null

.PHONY: generate.k8sio-gomod-replace
generate.k8sio-gomod-replace:
	./hack/update-k8sio-gomod-replace.sh

.PHONY: generate.cli-arguments-docs
generate.cli-arguments-docs:
	go run ./scripts/cli-arguments-docs-gen/main.go > ./docs/cli-arguments.md
	$(PROJECT_DIR)/scripts/cli-arguments-docs-gen/post-process-for-konghq.sh \
		$(PROJECT_DIR)/docs/cli-arguments-for-developer-konghq-com.md \
		$(PROJECT_DIR)/docs/cli-arguments.md

# ------------------------------------------------------------------------------
# Build - Manifests
# ------------------------------------------------------------------------------

CONTROLLER_GEN_CRD_OPTIONS ?= "+crd:generateEmbeddedObjectMeta=true"
CONTROLLER_GEN_PATHS_RAW := ./pkg/utils/kubernetes/reduce/ ./controller/... ./ingress-controller/internal/controllers/... ./ingress-controller/internal/konnect/ ./modules/manager/
CONTROLLER_GEN_PATHS := $(patsubst %,%;,$(strip $(CONTROLLER_GEN_PATHS_RAW)))
CONFIG_DIR = $(PROJECT_DIR)/config
CONFIG_CRD_DIR = $(CONFIG_DIR)/crd
CONFIG_CRD_BASE_PATH = $(CONFIG_CRD_DIR)/bases
CONFIG_RBAC_ROLE_DIR = $(CONFIG_DIR)/rbac/role


.PHONY: manifests
manifests: manifests.conversion-webhook manifests.validating-webhook manifests.validating-policy manifests.versions manifests.crds manifests.role manifests.charts ## Generate ClusterRole and CustomResourceDefinition objects.

.PHONY: manifests.conversion-webhook
manifests.conversion-webhook: kustomize
	KUSTOMIZE_BIN=$(KUSTOMIZE) go run hack/generators/conversion-webhook/main.go

.PHONY: manifests.validating-webhook
manifests.validating-webhook: controller-gen kustomize
	$(CONTROLLER_GEN) \
		webhook:headerFile="hack/generators/boilerplate_validating_webhook.yaml" paths="./ingress-controller/internal/admission/..." \
		output:webhook:artifacts:config=config/default/validating_webhook/;
	KUSTOMIZE_BIN=$(KUSTOMIZE) go run hack/generators/validating-webhook/main.go

.PHONY: manifests.validating-policy
manifests.validating-policy: kustomize
	KUSTOMIZE_BIN=$(KUSTOMIZE) go run hack/generators/validating-policy/main.go

.PHONY: manifests.crds
manifests.crds: controller-gen ## Generate CustomResourceDefinition objects.
	$(CONTROLLER_GEN) paths="$(CONTROLLER_GEN_PATHS)" $(CONTROLLER_GEN_CRD_OPTIONS) +output:crd:artifacts:config=$(CONFIG_CRD_BASE_PATH)

.PHONY: manifests.role
manifests.role: controller-gen
	$(CONTROLLER_GEN) \
		paths="$(CONTROLLER_GEN_PATHS)" \
		rbac:roleName="manager-role",headerFile="hack/generators/boilerplate_role.yaml" \
		output:rbac:dir=$(CONFIG_RBAC_ROLE_DIR)

# manifests.versions ensures that image versions are set in the manifests according to the current version.
.PHONY: manifests.versions
manifests.versions: kustomize yq
	$(YQ) eval '.appVersion = "$(VERSION)"' -i charts/kong-operator/Chart.yaml
	$(YQ) eval '.image.tag = "$(VERSION)"' -i charts/kong-operator/values.yaml
	cd config/components/manager-image/ && $(KUSTOMIZE) edit set image $(KUSTOMIZE_IMG_NAME)=$(IMG):$(VERSION)

.PHONY: manifests.charts
manifests.charts:
	@$(MAKE) manifests.charts.kong-operator.crds.operator
	@$(MAKE) manifests.charts.kong-operator.crds.gwapi-standard
	@$(MAKE) manifests.charts.kong-operator.crds.gwapi-experimental
	@$(MAKE) manifests.charts.kong-operator.chart.yaml
	@$(MAKE) manifests.charts.kong-operator.role

KONG_OPERATOR_CHART_DIR = $(PROJECT_DIR)/charts/kong-operator


.PHONY: ensure.go.pkg.downloaded.gateway-api
ensure.go.pkg.downloaded.gateway-api:
	@go mod download $(GATEWAY_API_PACKAGE)@$(GATEWAY_API_VERSION)

# NOTE: Target below makes sure that the generated role is always up-to-date
# between the manifests (generated via kubebuilder markers) and the chart.
.PHONY: manifests.charts.kong-operator.role
manifests.charts.kong-operator.role: manifests.role
	cp $(CONFIG_RBAC_ROLE_DIR)/role.yaml $(KONG_OPERATOR_CHART_DIR)/templates/cluster-role.yaml
	$(YQ) eval '.metadata.name = "{{ template \"kong.fullnamespacedname\" . }}-manager-role"' -i $(KONG_OPERATOR_CHART_DIR)/templates/cluster-role.yaml

.PHONY: manifests.charts.kong-operator.crds.operator
manifests.charts.kong-operator.crds.operator: kustomize
	$(MAKE) manifests.conversion-webhook

GATEWAY_API_STANDARD_CRDS_SUBCHART_CHART_YAML_PATH = $(KONG_OPERATOR_CHART_DIR)/charts/gwapi-standard-crds/Chart.yaml
GATEWAY_API_STANDARD_CRDS_SUBCHART_MANIFEST_PATH = $(KONG_OPERATOR_CHART_DIR)/charts/gwapi-standard-crds/crds/gwapi-crds.yaml

.PHONY: manifests.charts.kong-operator.crds.gwapi-standard
manifests.charts.kong-operator.crds.gwapi-standard: kustomize ensure.go.pkg.downloaded.gateway-api
	@$(MAKE) manifests.charts.print.chart.yaml \
		NAME=gwapi-standard-crds \
		DESCRIPTION="A Helm chart for Kubernetes Gateway API standard channel CRDs" \
		VERSION=$(GATEWAY_API_VERSION:v%=%) \
		CHART_YAML_PATH=$(GATEWAY_API_STANDARD_CRDS_SUBCHART_CHART_YAML_PATH)
	$(KUSTOMIZE) build $(GATEWAY_API_CRDS_KUSTOMIZE_STANDARD_LOCAL_PATH) > $(GATEWAY_API_STANDARD_CRDS_SUBCHART_MANIFEST_PATH)

GATEWAY_API_EXPERIMENTAL_CRDS_SUBCHART_CHART_YAML_PATH = $(KONG_OPERATOR_CHART_DIR)/charts/gwapi-experimental-crds/Chart.yaml
GATEWAY_API_EXPERIMENTAL_CRDS_SUBCHART_MANIFEST_PATH = $(KONG_OPERATOR_CHART_DIR)/charts/gwapi-experimental-crds/crds/gwapi-crds.yaml

.PHONY: manifests.charts.kong-operator.crds.gwapi-experimental
manifests.charts.kong-operator.crds.gwapi-experimental: kustomize ensure.go.pkg.downloaded.gateway-api
	@$(MAKE) manifests.charts.print.chart.yaml \
		NAME=gwapi-experimental-crds \
		DESCRIPTION="A Helm chart for Kubernetes Gateway API experimental channel CRDs" \
		VERSION=$(GATEWAY_API_VERSION:v%=%) \
		CHART_YAML_PATH=$(GATEWAY_API_EXPERIMENTAL_CRDS_SUBCHART_CHART_YAML_PATH)
	$(KUSTOMIZE) build $(GATEWAY_API_CRDS_KUSTOMIZE_EXPERIMENTAL_LOCAL_PATH) > $(GATEWAY_API_EXPERIMENTAL_CRDS_SUBCHART_MANIFEST_PATH)

.PHONY: manifests.charts.print.chart.yaml
manifests.charts.print.chart.yaml: yq
	@echo "Generating $(CHART_YAML_PATH)"
	@touch $(CHART_YAML_PATH)
	@$(YQ) eval '.apiVersion = "v2"' -i $(CHART_YAML_PATH)
	@$(YQ) eval '.name = "$(NAME)"' -i $(CHART_YAML_PATH)
	@$(YQ) eval '.version = "$(VERSION)"' -i $(CHART_YAML_PATH)
	@$(YQ) eval 'with(.appVersion ; . = "$(VERSION)" | . style="double")' -i $(CHART_YAML_PATH)
	@$(YQ) eval '.description = "$(DESCRIPTION)"' -i $(CHART_YAML_PATH)

KONG_OPERATOR_CHART_YAML_PATH = $(KONG_OPERATOR_CHART_DIR)/Chart.yaml

# NOTE: Below yq invocations are split into multiple lines to make it slightly more readable.
# yq command lines splitting in Makefiles proves to be rather hard.
.PHONY: manifests.charts.kong-operator.chart.yaml
manifests.charts.kong-operator.chart.yaml: yq
	@echo "Generating $(KONG_OPERATOR_CHART_YAML_PATH)"
	@$(YQ) eval \
		'.dependencies = [ {"name":"ko-crds","version":"$(shell $(YQ) -r '.version' < $(KONG_OPERATOR_CHART_DIR)/charts/ko-crds/Chart.yaml)"}]' \
		-i $(KONG_OPERATOR_CHART_YAML_PATH)
	@$(YQ) eval \
		'.dependencies += [ {"name":"gwapi-standard-crds","version":"$(GATEWAY_API_VERSION:v%=%)","condition":"gwapi-standard-crds.enabled"}]' \
		-i $(KONG_OPERATOR_CHART_YAML_PATH)
	@$(YQ) eval \
		'.dependencies += [ {"name":"gwapi-experimental-crds","version":"$(GATEWAY_API_VERSION:v%=%)","condition":"gwapi-experimental-crds.enabled"}]' \
		-i $(KONG_OPERATOR_CHART_YAML_PATH)

# ------------------------------------------------------------------------------
# Build - Container Images
# ------------------------------------------------------------------------------

.PHONY: _docker.build
_docker.build:
	docker build -t $(IMG):$(TAG) \
		--target $(TARGET) \
		--build-arg GOPATH=$(shell go env GOPATH) \
		--build-arg GOCACHE=$(shell go env GOCACHE) \
		--build-arg TAG=$(TAG) \
		--build-arg COMMIT=$(COMMIT) \
		--build-arg REPO_INFO=$(REPO_INFO) \
		$(DOCKERBUILDFLAGS) \
		.

.PHONY: docker.build
docker.build:
	TAG=$(TAG) TARGET=distroless $(MAKE) _docker.build

.PHONY: docker.push
docker.push:
	docker push $(IMG):$(TAG)

# NOTE: Token-Permissions check has been disabled as it has been flaky on the CI.
# TODO: https://github.com/Kong/kong-operator/issues/2089
.PHONY: docker.run.openssf
docker.run.openssf:
	docker run --rm --env GITHUB_TOKEN=$(GITHUB_TOKEN) \
		gcr.io/openssf/scorecard:stable \
		--repo=$(REPO) \
		--commit=$(COMMIT) \
		--show-details \
		--checks=Pinned-Dependencies,License,Dangerous-Workflow,Binary-Artifacts,Code-Review

# ------------------------------------------------------------------------------
# Testing
# ------------------------------------------------------------------------------

GOTESTSUM_FORMAT ?= standard-verbose
INTEGRATION_TEST_TIMEOUT ?= "30m"
CONFORMANCE_TEST_TIMEOUT ?= "20m"
E2E_TEST_TIMEOUT ?= "20m"
_CLUSTER_VERSION ?= $(shell $(YQ) eval -r -o=json '.[0] | sub("^v"; "")' .github/supported_k8s_node_versions.yaml)
CLUSTER_VERSION ?=$(patsubst v%,%,$(_CLUSTER_VERSION ))
TEST_KONG_HELM_CHART_VERSION ?= $(shell $(YQ) -ojson -r '.integration.helm.kong' < ./test/test_dependencies.yaml)
KONG_CONTROLLER_FEATURE_GATES ?= GatewayAlpha=true

.PHONY: test
test: test.unit

UNIT_TEST_PATHS := ./api/... ./controller/... ./internal/... ./pkg/... ./modules/... ./ingress-controller/internal/... ./ingress-controller/pkg/...
UNIT_TEST_PATHS_CRD_GEN := ./pkg/...

.PHONY: _test.unit
_test.unit: gotestsum
	GOTESTSUM_FORMAT=$(GOTESTSUM_FORMAT) \
		$(GOTESTSUM) -- $(GOTESTFLAGS) \
		-race \
		-coverprofile=coverage.unit.out \
		-ldflags "$(LDFLAGS_COMMON) $(LDFLAGS)" \
		$(UNIT_TEST_PATHS)
	cd crd-from-oas && \
		GOTESTSUM_FORMAT=$(GOTESTSUM_FORMAT) \
		$(GOTESTSUM) -- $(GOTESTFLAGS) \
		-race \
		$(UNIT_TEST_PATHS_CRD_GEN)

.PHONY: test.unit
test.unit:
	@$(MAKE) _test.unit GOTESTFLAGS="$(GOTESTFLAGS)"

.PHONY: test.unit.pretty
test.unit.pretty:
	@$(MAKE) _test.unit GOTESTSUM_FORMAT=pkgname GOTESTFLAGS="$(GOTESTFLAGS)" UNIT_TEST_PATHS="$(UNIT_TEST_PATHS)"

ENVTEST_TEST_PATHS := ./test/envtest/...
ENVTEST_TIMEOUT ?= 15m
PKG_LIST=./controller/...,./internal/...,./pkg/...,./modules/...
TEST_DIR ?= $(PROJECT_DIR)

.PHONY: _test.envtest
_test.envtest: gotestsum setup-envtest
	$(MAKE) use-setup-envtest CLUSTER_VERSION=$(CLUSTER_VERSION)
	cd $(TEST_DIR) && \
	KUBECONFIG=$(KUBECONFIG) \
	KUBEBUILDER_ASSETS="$(shell $(SETUP_ENVTEST) use $(CLUSTER_VERSION) -p path)" \
	GOTESTSUM_FORMAT=$(GOTESTSUM_FORMAT) \
		$(GOTESTSUM) -- \
		$(GOTESTFLAGS) \
		-race \
		-timeout $(ENVTEST_TIMEOUT) \
		-covermode=atomic \
		-coverpkg=$(PKG_LIST) \
		-coverprofile=coverage.envtest.out \
		-ldflags "$(LDFLAGS_COMMON) $(LDFLAGS)" \
		$(ENVTEST_TEST_PATHS)

.PHONY: test.envtest
test.envtest:
	$(MAKE) _test.envtest GOTESTSUM_FORMAT=standard-verbose

.PHONY: test.envtest.pretty
test.envtest.pretty:
	$(MAKE) _test.envtest GOTESTSUM_FORMAT=testname

.PHONY: test.crds-validation
test.crds-validation:
	$(MAKE) _test.envtest GOTESTSUM_FORMAT=standard-verbose ENVTEST_TEST_PATHS=./test/crdsvalidation/...

.PHONY: test.crds-validation.pretty
test.crds-validation.pretty:
	$(MAKE) _test.envtest GOTESTSUM_FORMAT=testname ENVTEST_TEST_PATHS=./test/crdsvalidation/...

# Define a constant list of channels
CHANNELS := ingress-controller-incubator gateway-operator kong-operator

.PHONY: install.only
install.only: kustomize
	@for channel in $(CHANNELS); do \
		$(KUSTOMIZE) build config/crd/$$channel | kubectl apply --server-side -f -; \
	done

.PHONY: test.api
test.api: gotestsum
	GOFLAGS=$(GOFLAGS) \
	GOTESTSUM_FORMAT=$(GOTESTSUM_FORMAT) \
	$(GOTESTSUM) -- $(GOTESTFLAGS) \
	-timeout $(INTEGRATION_TEST_TIMEOUT) \
	-ldflags "$(LDFLAGS_COMMON) $(LDFLAGS) $(LDFLAGS_METADATA)" \
	-race \
	-coverprofile=$(COVERPROFILE) \
	./api/test/...

.PHONY: _test.integration
_test.integration: gotestsum download.telepresence download.helm
	KUBECONFIG=$(KUBECONFIG) \
	TELEPRESENCE_BIN=$(TELEPRESENCE) \
	GOFLAGS=$(GOFLAGS) \
	GOTESTSUM_FORMAT=$(GOTESTSUM_FORMAT) \
	$(GOTESTSUM) -- $(GOTESTFLAGS) \
	-timeout $(INTEGRATION_TEST_TIMEOUT) \
	-ldflags "$(LDFLAGS_COMMON) $(LDFLAGS) $(LDFLAGS_METADATA)" \
	-race \
	-coverprofile=$(COVERPROFILE) \
	$(GOTESTPATH)

.PHONY: test.integration-ko
test.integration-ko:
	@$(MAKE) _test.integration \
		GOTESTFLAGS="-skip='BlueGreen|TestAdmissionWebhook_' $(GOTESTFLAGS)" \
		COVERPROFILE="coverage.integration.ko.out" \
		GOTESTPATH=./test/integration/

# Prevent the following data race by not running via gotestsum:
# WARNING: DATA RACE
# Read at 0x00000bcabcb0 by goroutine 1080:
#   k8s.io/klog/v2.(*loggingT).output()
#       /home/runner/go/pkg/mod/k8s.io/klog/v2@v2.130.1/klog.go:888 +0x81a
#   k8s.io/klog/v2.(*loggingT).printWithInfos()
#       /home/runner/go/pkg/mod/k8s.io/klog/v2@v2.130.1/klog.go:733 +0x319
#   k8s.io/klog/v2.(*loggingT).printDepth()
#       /home/runner/go/pkg/mod/k8s.io/klog/v2@v2.130.1/klog.go:715 +0xe9
#   k8s.io/klog/v2.(*loggingT).printS()
#       /home/runner/go/pkg/mod/k8s.io/klog/v2@v2.130.1/klog.go:822 +0x285
#   k8s.io/klog/v2.(*loggingT).infoS()
#       /home/runner/go/pkg/mod/k8s.io/klog/v2@v2.130.1/klog.go:806 +0x176
#   k8s.io/klog/v2.Verbose.InfoSDepth()
#       /home/runner/go/pkg/mod/k8s.io/klog/v2@v2.130.1/klog.go:1467 +0x175
#   k8s.io/klog/v2.(*klogger).Info()
#       /home/runner/go/pkg/mod/k8s.io/klog/v2@v2.130.1/klogr.go:58 +0xb4
#   github.com/go-logr/logr.Logger.Info()
#       /home/runner/go/pkg/mod/github.com/go-logr/logr@v1.4.3/logr.go:280 +0x107
#   sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[go.shape.struct { k8s.io/apimachinery/pkg/types.NamespacedName }]).Start.func1()
#       /home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.22.4/pkg/internal/controller/controller.go:286 +0x214
#   sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[go.shape.struct { k8s.io/apimachinery/pkg/types.NamespacedName }]).Start()
#       /home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.22.4/pkg/internal/controller/controller.go:303 +0x188
#   sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[sigs.k8s.io/controller-runtime/pkg/reconcile.Request]).Start()
#       /home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.22.4/pkg/internal/controller/controller.go:259 +0x4a
#   sigs.k8s.io/controller-runtime/pkg/manager.(*runnableGroup).reconcile.func1()
#       /home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.22.4/pkg/manager/runnable_group.go:260 +0x1e1
#   sigs.k8s.io/controller-runtime/pkg/manager.(*runnableGroup).reconcile.gowrap1()
#       /home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.22.4/pkg/manager/runnable_group.go:283 +0x41

# Previous write at 0x00000bcabcb0 by main goroutine:
#   testing.(*M).Run()
#       /opt/hostedtoolcache/go/1.25.5/x64/src/testing/testing.go:2285 +0x294
#   github.com/kong/kong-operator/test/integration.Suite()
#       /home/runner/work/kong-operator/kong-operator/test/integration/suite.go:161 +0xf97
#   github.com/kong/kong-operator/test/integration/validatingwebhook.TestMain()
#       /home/runner/work/kong-operator/kong-operator/test/integration/validatingwebhook/suite_test.go:10 +0x172
#   main.main()
#       _testmain.go:67 +0x16d

# Goroutine 1080 (running) created at:
#   sigs.k8s.io/controller-runtime/pkg/manager.(*runnableGroup).reconcile()
#       /home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.22.4/pkg/manager/runnable_group.go:244 +0x23c
#   sigs.k8s.io/controller-runtime/pkg/manager.(*runnableGroup).Start.func1.gowrap2()
#       /home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.22.4/pkg/manager/runnable_group.go:173 +0x33

.PHONY: test.integration-bluegreen
test.integration-bluegreen: download.telepresence
	KUBECONFIG=$(KUBECONFIG) \
	TELEPRESENCE_BIN=$(TELEPRESENCE) \
	GOFLAGS=$(GOFLAGS) \
	KONG_OPERATOR_BLUEGREEN_CONTROLLER="true" \
	go test \
	-run='BlueGreen|TestDataPlane' $(GOTESTFLAGS) \
	-timeout $(INTEGRATION_TEST_TIMEOUT) \
	-ldflags "$(LDFLAGS_COMMON) $(LDFLAGS) $(LDFLAGS_METADATA)" \
	-race -v \
	-coverprofile="coverage.integration-bluegreen.out" \
	./test/integration/

.PHONY: test.integration-validatingwebhook
test.integration-validatingwebhook: download.telepresence
	KUBECONFIG=$(KUBECONFIG) \
	TELEPRESENCE_BIN=$(TELEPRESENCE) \
	GOFLAGS=$(GOFLAGS) \
	go test \
	-run='TestAdmissionWebhook_' $(GOTESTFLAGS) \
	-timeout $(INTEGRATION_TEST_TIMEOUT) \
	-ldflags "$(LDFLAGS_COMMON) $(LDFLAGS) $(LDFLAGS_METADATA)" \
	-race -v \
	-coverprofile="coverage.integration-validatingwebhook.out" \
	./test/integration/validatingwebhook/

PKG_LIST_KIC = ./ingress-controller/pkg/...,./ingress-controller/internal/...

# Integration tests don't use gotestsum because there's a data race issue
# when go toolchain is writing to os.Stderr which is being read in go-kong
# https://github.com/Kong/go-kong/blob/c71247b5c8aae2/kong/client.go#L182
# which in turn produces a data race becuase gotestsum needs go test invoked with
# -json which enables the problematic branch in go toolchain (that writes to os.Stderr).
#
# Related issue: https://github.com/Kong/kubernetes-ingress-controller/issues/3754
.PHONY: _test.integration-kic
_test.integration-kic: mise yq
	TEST_KONG_HELM_CHART_VERSION="$(TEST_KONG_HELM_CHART_VERSION)" \
	TEST_DATABASE_MODE="$(DBMODE)" \
	KONG_CONTROLLER_FEATURE_GATES="$(KONG_CONTROLLER_FEATURE_GATES)" \
	go test $(GOTESTFLAGS) \
	-v \
	-timeout $(INTEGRATION_TEST_TIMEOUT) \
	-parallel $(NCPU) \
	-race \
	-ldflags="$(LDFLAGS_COMMON)" \
	-covermode=atomic \
	-coverpkg=$(PKG_LIST_KIC) \
	-coverprofile=$(COVERAGE_OUT) \
	./test/integration/kic

.PHONY: test.integration-kic.dbless
test.integration-kic.dbless:
	@$(MAKE) _test.integration-kic \
		DBMODE=off \
		COVERAGE_OUT=coverage.integration.kic.out

.PHONY: test.integration-kic.postgres
test.integration-kic.postgres:
	@$(MAKE) _test.integration-kic \
		DBMODE=postgres \
		COVERAGE_OUT=coverage.integration.kic.out

.PHONY: test.integration-kic
test.integration-kic: test.integration-kic.dbless test.integration-kic.postgres

.PHONY: _test.e2e
_test.e2e: gotestsum
		GOTESTSUM_FORMAT=$(GOTESTSUM_FORMAT) \
		$(GOTESTSUM) -- $(GOTESTFLAGS) \
		-timeout $(E2E_TEST_TIMEOUT) \
		-ldflags "$(LDFLAGS_COMMON) $(LDFLAGS) $(LDFLAGS_METADATA)" \
		-race \
		./test/e2e/...

.PHONY: test.e2e
test.e2e:
	@$(MAKE) _test.e2e \
		GOTESTFLAGS="$(GOTESTFLAGS)"

CHAINSAW_TEST_DIR ?= ./test/e2e/chainsaw
CHAINSAW_CONFIG ?= ./test/e2e/chainsaw/.chainsaw.yaml
.PHONY: test.e2e.chainsaw
test.e2e.chainsaw: chainsaw ## Run chainsaw e2e tests.
	$(CHAINSAW) test --config $(CHAINSAW_CONFIG) --quiet --test-dir $(CHAINSAW_TEST_DIR)

NCPU := $(shell getconf _NPROCESSORS_ONLN)
PARALLEL := $(if $(PARALLEL),$(PARALLEL),$(NCPU))

.PHONY: _test.conformance
_test.conformance: gotestsum download.telepresence
		KUBECONFIG=$(KUBECONFIG) \
		TELEPRESENCE_BIN=$(TELEPRESENCE) \
		GOTESTSUM_FORMAT=$(GOTESTSUM_FORMAT) \
		$(GOTESTSUM) -- $(GOTESTFLAGS) \
		-timeout $(CONFORMANCE_TEST_TIMEOUT) \
		-ldflags "$(LDFLAGS_COMMON) $(LDFLAGS) $(LDFLAGS_METADATA)" \
		-race \
		-parallel $(PARALLEL) \
		$(TEST_SUITE_PATH)

.PHONY: test.conformance
test.conformance:
	@$(MAKE) _test.conformance \
		GOTESTFLAGS="$(GOTESTFLAGS)" \
		TEST_SUITE_PATH='./test/conformance/...'


.PHONY: test.kongintegration
test.kongintegration:
	@$(MAKE) _test.kongintegration GOTESTSUM_FORMAT=standard-verbose

.PHONY: test.kongintegration.pretty
test.kongintegration.pretty:
	@$(MAKE) _test.kongintegration GOTESTSUM_FORMAT=testname

.PHONY: test.kongintegration.golden.update
test.kongintegration.golden.update:
	@go test -v -run TestKongClient_GoldenTests ./ingress-controller/internal/dataplane -update

.PHONY: _test.kongintegration
_test.kongintegration: gotestsum
	# Disable testcontainer's reaper (Ryuk). It's needed because Ryuk requires
	# privileged mode to run, which is not desired and could cause issues in CI.
	TESTCONTAINERS_RYUK_DISABLED="true" \
	GOTESTSUM_FORMAT=$(GOTESTSUM_FORMAT) \
	$(GOTESTSUM) -- $(GOTESTFLAGS) \
		-race \
		-ldflags="$(LDFLAGS_COMMON)" \
		-parallel $(NCPU) \
		-coverpkg=$(PKG_LIST) \
		-coverprofile=coverage.kongintegration.out \
		./ingress-controller/test/kongintegration

.PHONY: test.samples
test.samples: kustomize
	@echo "Ensuring CRDs installed for samples"
	# Apply operator CRDs using kustomize (Helm templates cannot be applied directly by kubectl).
	@$(KUSTOMIZE) build config/crd | kubectl apply --server-side --force-conflicts --field-manager=kong-operator-tests -f -
	@kubectl apply --server-side --force-conflicts --field-manager=kong-operator-tests -f charts/kong-operator/charts/gwapi-standard-crds/crds/gwapi-crds.yaml || true
	@kubectl get crd -ojsonpath='{.items[*].metadata.name}' | xargs -n1 kubectl wait --for condition=established crd
	# Disable tests including GatewayConfiguration v1beta1 and ControlPlane v1beta1 temporarily because they need conversion webhooks: https://github.com/Kong/kong-operator/issues/1986
	@cd config/samples/ && find . -not -name "kustomization.*" -not -name "zz_temp_disabled_*" -type f | sort | xargs -I{} bash -c "echo;echo {}; kubectl apply -f {} && kubectl delete -f {}" \;

.PHONY: test.charts.golden
test.charts.golden:
	@ \
		$(MAKE) _chartsnap CHART=kong-operator || \
	(echo "$$GOLDEN_TEST_FAILURE_MSG" && exit 1)

.PHONY: test.charts.golden.update
test.charts.golden.update:
	@ $(MAKE) _chartsnap CHART=kong-operator CHARTSNAP_ARGS="-u"

.PHONY: test.charts.ct.install
test.charts.ct.install:
# NOTE: We add ko-crds.enabled=false below to handle CRD management outside of ct.
# This is to work around the flaky CRD uninstall behavior of ct.
# Without this, CRDs created by one test helm release installation
# would sometimes not get removed upon uninstalling the release,
# and keep them around after helm uninstall would yield ownership issues.
# Error: INSTALLATION FAILED: Unable to continue with install: CustomResourceDefinition "aigateways.gateway-operator.konghq.com" in namespace ""
# exists and cannot be imported into the current release: invalid ownership metadata; annotation validation error: key "meta.helm.sh/release-name"
# must equal "kong-operator-h39gau9scc": current value is "kong-operator-tiptva339m"
#
# This could potentially be solved by setting the --cascade foreground option
# to helm uninstall command in ct, but ct does not currently support passing
# extra args to helm uninstall.
# There's an open PR for this: https://github.com/helm/chart-testing/pull/806

	ct install --target-branch main \
		--debug \
		--helm-extra-set-args "--set=ko-crds.enabled=false" \
		--helm-extra-args "--wait" \
		--helm-extra-args "--timeout=3m" \
		--charts charts/$(CHART_NAME) \
		--namespace kong-test

# Defining multi-line strings to echo: https://stackoverflow.com/a/649462/7958339
define GOLDEN_TEST_FAILURE_MSG
>> Golden tests have failed.
>> Please run 'make test.charts.golden.update' to update golden files and commit the changes if they're expected.
endef
export GOLDEN_TEST_FAILURE_MSG

.PHONY: _chartsnap
_chartsnap: download.chartsnap download.helm
	$(HELM) chartsnap -c ./charts/$(CHART) -f ./charts/$(CHART)/ci/ $(CHARTSNAP_ARGS) \
		-- \
		--api-versions gateway.networking.k8s.io/v1 \
		--api-versions admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy \
		--api-versions admissionregistration.k8s.io/v1/ValidatingAdmissionPolicyBinding

# ------------------------------------------------------------------------------
# Gateway API
# ------------------------------------------------------------------------------

# GATEWAY_API_VERSION will be processed by kustomize and therefore accepts
# only branch names, tags, or full commit hashes, i.e. short hashes or go
# pseudo versions are not supported [1].
# Please also note that kustomize fails silently when provided with an
# unsupported ref and downloads the manifests from the main branch.
#
# [1]: https://github.com/kubernetes-sigs/kustomize/blob/master/examples/remoteBuild.md#remote-directories
GATEWAY_API_PACKAGE ?= sigs.k8s.io/gateway-api
GATEWAY_API_VERSION ?= $(shell go list -m -f '{{ .Version }}' $(GATEWAY_API_PACKAGE))
GATEWAY_API_CRDS_LOCAL_PATH = $(shell go env GOPATH)/pkg/mod/$(GATEWAY_API_PACKAGE)@$(GATEWAY_API_VERSION)/config/crd
GATEWAY_API_CRDS_KUSTOMIZE_STANDARD_LOCAL_PATH = $(GATEWAY_API_CRDS_LOCAL_PATH)/
GATEWAY_API_CRDS_KUSTOMIZE_EXPERIMENTAL_LOCAL_PATH = $(GATEWAY_API_CRDS_LOCAL_PATH)/experimental


# NOTE: we also need --server-side because some CRDs exceed the size limit for annotations:
# The CustomResourceDefinition "httproutes.gateway.networking.k8s.io" is invalid: metadata.annotations: Too long: may not be more than 262144 bytes
.PHONY: install.gateway-api-crds
install.gateway-api-crds: kustomize ensure.go.pkg.downloaded.gateway-api
	$(KUSTOMIZE) build $(GATEWAY_API_CRDS_KUSTOMIZE_EXPERIMENTAL_LOCAL_PATH) | kubectl apply --server-side -f -

.PHONY: uninstall.gateway-api-crds
uninstall.gateway-api-crds: kustomize ensure.go.pkg.downloaded.gateway-api
	$(KUSTOMIZE) build $(GATEWAY_API_CRDS_KUSTOMIZE_EXPERIMENTAL_LOCAL_PATH) | kubectl delete --ignore-not-found=$(ignore-not-found) -f -

# ------------------------------------------------------------------------------
# Debug
# ------------------------------------------------------------------------------

ifndef ignore-not-found
  ignore-not-found = false
endif

.PHONY: _ensure-kong-system-namespace
_ensure-kong-system-namespace:
	@kubectl create ns kong-system 2>/dev/null || true
	@kubectl get secret kong-operator-ca -n kong-system >/dev/null 2>&1 || \
		(openssl genrsa -out /tmp/ko-makefile-ca.key 4096 2>/dev/null && \
		openssl req -x509 -new -key /tmp/ko-makefile-ca.key -days 3650 -out /tmp/ko-makefile-ca.crt -subj "/CN=Kong Operator CA" 2>/dev/null && \
		kubectl create secret tls kong-operator-ca \
			--cert=/tmp/ko-makefile-ca.crt \
			--key=/tmp/ko-makefile-ca.key \
			--namespace kong-system \
			--dry-run=client -o yaml | \
			kubectl label -f - konghq.com/secret=internal --overwrite --local -o yaml | \
			kubectl apply -f -)

# Run a controller from your host.
# TODO: https://github.com/Kong/kong-operator/issues/1989
.PHONY: run
run: download.telepresence generate install.all _ensure-kong-system-namespace install.rbacs
	@$(MAKE) _run

# Run a controller from your host and make it impersonate the controller-manager service account from kong-system namespace.
.PHONY: run.with_impersonate
run.with_impersonate: download.telepresence generate install.all _ensure-kong-system-namespace install.rbacs
	@$(MAKE) _run.with-impersonate

KUBECONFIG ?= $(HOME)/.kube/config

# Run the operator without checking any preconditions, installing CRDs etc.
# This is mostly useful when 'run' was run at least once on a server and CRDs, RBACs
# etc didn't change in between the runs.
.PHONY: _run
_run:
	@$(TELEPRESENCE) helm install
	@$(TELEPRESENCE) connect
	bash -c "trap \
		'$(TELEPRESENCE) quit -s; $(TELEPRESENCE) helm uninstall; rm -rf $(TMP_KUBECONFIG) || 1' EXIT; \
		KONG_OPERATOR_KUBECONFIG=$(or $(TMP_KUBECONFIG),$(KUBECONFIG)) \
		KONG_OPERATOR_ANONYMOUS_REPORTS=false \
		KONG_OPERATOR_LOGGING_MODE=development \
		go run ./cmd/main.go \
		--no-leader-election \
		-cluster-ca-secret-namespace kong-system \
		-enable-controller-kongplugininstallation \
		-enable-controller-aigateway \
		-enable-controller-konnect \
		-enable-controller-controlplaneextensions \
		-enable-conversion-webhook=false \
		-enable-validating-webhook=false \
		-zap-time-encoding iso8601 \
		-zap-log-level 2 \
		-zap-devel true \
	"

# Run the operator locally with impersonation of controller-manager service account from kong-system namespace.
# The operator will use a temporary kubeconfig file and impersonate the real RBACs.
.PHONY: _run.with-impersonate
_run.with-impersonate:
	@$(eval TMP := $(shell mktemp -d))
	@$(eval TMP_KUBECONFIG := $(TMP)/kubeconfig)
	[ ! -z "$(KUBECONFIG)" ] || exit 1
	cp $(KUBECONFIG) $(TMP_KUBECONFIG)
	@$(eval TMP_TOKEN := $(shell kubectl create token --namespace=kong-system controller-manager))
	@$(eval CLUSTER := $(shell kubectl config get-contexts | grep '^\*' | tr -s ' ' | cut -d ' ' -f 3))
	KUBECONFIG=$(TMP_KUBECONFIG) kubectl config set-credentials ko --token=$(TMP_TOKEN)
	KUBECONFIG=$(TMP_KUBECONFIG) kubectl config set-context ko --cluster=$(CLUSTER) --user=kgo --namespace=kong-system
	KUBECONFIG=$(TMP_KUBECONFIG) kubectl config use-context ko
	$(MAKE) _run TMP_KUBECONFIG=$(TMP_KUBECONFIG)

SKAFFOLD_RUN_PROFILE ?= dev

.PHONY: _skaffold
_skaffold: skaffold
	GOCACHE=$(shell go env GOCACHE) \
		$(SKAFFOLD) $(CMD) --port-forward=pods --profile=$(SKAFFOLD_PROFILE) $(SKAFFOLD_FLAGS)

.PHONY: run.skaffold
run.skaffold: _ensure-kong-system-namespace
	TAG=$(TAG) REPO_INFO=$(REPO_INFO) COMMIT=$(COMMIT) \
		CMD=dev \
		SKAFFOLD_PROFILE=$(SKAFFOLD_RUN_PROFILE) \
		$(MAKE) _skaffold

.PHONY: debug
debug: generate install.all _ensure-kong-system-namespace
	KONG_OPERATOR_ANONYMOUS_REPORTS=false \
	KONG_OPERATOR_LOGGING_MODE=development \
		dlv debug ./cmd/main.go -- \
		--no-leader-election \
		-cluster-ca-secret-namespace kong-system \
		--enable-controller-aigateway \
		--enable-controller-konnect \
		-zap-time-encoding iso8601

.PHONY: debug.skaffold
debug.skaffold: _ensure-kong-system-namespace
	GOCACHE=$(shell go env GOCACHE) \
	TAG=$(TAG)-debug REPO_INFO=$(REPO_INFO) COMMIT=$(COMMIT) \
		$(SKAFFOLD) debug --port-forward=pods --profile=debug

.PHONY: debug.skaffold.continuous
debug.skaffold.continuous: _ensure-kong-system-namespace
	GOCACHE=$(shell go env GOCACHE) \
	TAG=$(TAG)-debug REPO_INFO=$(REPO_INFO) COMMIT=$(COMMIT) \
		$(SKAFFOLD) debug --port-forward=pods --profile=debug --auto-build --auto-deploy --auto-sync

CERT_MANAGER_VERSION = $(shell $(YQ) -r '.cert-manager' < $(TOOLS_VERSIONS_FILE))
.PHONY: install.helm.cert-manager
install.helm.cert-manager: yq download.helm
	$(HELM) repo add jetstack https://charts.jetstack.io && \
	$(HELM) repo update && \
	$(HELM) upgrade --install \
		cert-manager jetstack/cert-manager \
		--namespace cert-manager \
		--create-namespace \
		--version $(CERT_MANAGER_VERSION) \
		--set crds.enabled=true

.PHONY: uninstall.helm.cert-manager
uninstall.helm.cert-manager: download.helm
	$(HELM) uninstall cert-manager --namespace cert-manager

# Install CRDs into the K8s cluster specified in ~/.kube/config.
.PHONY: install
install: install.helm.cert-manager manifests kustomize install.gateway-api-crds
	$(MAKE) install.crds

.PHONY: install.crds
install.crds: kustomize
	$(KUSTOMIZE) build config/crd | kubectl apply --server-side -f -

# Install RBACs from config/rbac into the K8s cluster specified in ~/.kube/config.
.PHONY: install.rbacs
install.rbacs: kustomize
	$(KUSTOMIZE) build config/rbac | kubectl apply -f -

# Install standard and experimental CRDs into the K8s cluster specified in ~/.kube/config.
.PHONY: install.all
install.all: install.helm.cert-manager manifests kustomize install.gateway-api-crds
	kubectl get crd -ojsonpath='{.items[*].metadata.name}' | xargs -n1 kubectl wait --for condition=established crd

# Uninstall CRDs from the K8s cluster specified in ~/.kube/config.
# Call with ignore-not-found=true to ignore resource not found errors during deletion.
.PHONY: uninstall
uninstall: manifests kustomize uninstall.gateway-api-crds uninstall.helm.cert-manager
	$(MAKE) uninstall.crds

.PHONY: uninstall.crds
uninstall.crds: kustomize
	$(KUSTOMIZE) build config/crd | kubectl delete --ignore-not-found=$(ignore-not-found) -f -

# Uninstall standard and experimental CRDs from the K8s cluster specified in ~/.kube/config.
# Call with ignore-not-found=true to ignore resource not found errors during deletion.
.PHONY: uninstall.all
uninstall.all: manifests kustomize uninstall.gateway-api-crds uninstall.helm.cert-manager

# Deploy controller to the K8s cluster specified in ~/.kube/config.
# This will wait for operator's Deployment to get Available.
# This uses a temporary directory becuase "kustomize edit set image" would introduce
# a change in current work tree which we do not want.
.PHONY: deploy
deploy: manifests kustomize
	$(eval TMP := $(shell mktemp -d))
	cp -R config $(TMP)
	cd $(TMP)/config/components/manager-image/ && $(KUSTOMIZE) edit set image $(KUSTOMIZE_IMG_NAME)=$(IMG):$(VERSION)
	cd $(TMP)/config/default && $(KUSTOMIZE) build . | kubectl apply --server-side -f -
	kubectl wait --timeout=1m deploy -n kong-system gateway-operator-controller-manager --for=condition=Available=true

# Undeploy controller from the K8s cluster specified in ~/.kube/config.
# Call with ignore-not-found=true to ignore resource not found errors during deletion.
.PHONY: undeploy
undeploy:
	$(KUSTOMIZE) build config/default | kubectl delete --wait=false --ignore-not-found=$(ignore-not-found) -f -

# Install and connect telepresence to the cluster.
# This target is essential for debugging the operator from an IDE as it establishes
# connectivity between the local development environment and the Kubernetes cluster.
# It allows the locally running operator to interact with the cluster resources
# as if it were running inside the cluster itself.
.PHONY: install.telepresence
install.telepresence: download.telepresence
	@$(PROJECT_DIR)/scripts/telepresence-manager.sh install "$(TELEPRESENCE)"

# Disconnect and uninstall telepresence from the cluster.
# This target cleans up the telepresence resources created by the install.telepresence target.
# It should be used when you're done debugging the operator locally to ensure proper
# cleanup of network connections and cluster resources.
.PHONY: uninstall.telepresence
uninstall.telepresence: download.telepresence
	@$(PROJECT_DIR)/scripts/telepresence-manager.sh uninstall "$(TELEPRESENCE)"

.PHONY: lint.api
lint.api: download.kube-api-linter
	$(KUBE_API_LINTER) run --config $(PROJECT_DIR)/.golangci-kube-api.yaml -v \
		./api/gateway-operator/v2beta1/... \
		./api/konnect/v1alpha1/... \
		./api/konnect/v1alpha2/... \
		./api/common/v1alpha1/...
	mise r lint-api