Makefile

# Set the default goal
.DEFAULT_GOAL := build
MAKEFLAGS += --no-print-directory

DOCKER ?= docker
KIND ?= kind

export KUBECONFIG ?= ${HOME}/.kube/config

# Active module mode, as we use Go modules to manage dependencies
export GO111MODULE=on
GOPATH=$(shell go env GOPATH)
GOBIN=$(GOPATH)/bin
GINKGO=$(GOBIN)/ginkgo

# Sources tracked for build-target staleness. Includes go.mod/go.sum so a
# dependency bump (e.g. for a CVE fix) reliably forces a binary rebuild even
# when no .go file under the tree was edited - otherwise `make` thinks the
# binary is up to date and silently keeps the stale module versions baked in.
SOURCES := $(shell find . -name '*.go') go.mod go.sum

IMAGE_TAG := dev
STARBOARD_CLI_IMAGE := aquasec/starboard:$(IMAGE_TAG)
STARBOARD_OPERATOR_IMAGE := aquasec/starboard-operator:$(IMAGE_TAG)
STARBOARD_SCANNER_AQUA_IMAGE := aquasec/starboard-scanner-aqua:$(IMAGE_TAG)
STARBOARD_OPERATOR_IMAGE_UBI8 := aquasec/starboard-operator:$(IMAGE_TAG)-ubi8
STARBOARD_OPERATOR_IMAGE_UBI8_FIPS := aquasec/starboard-operator:$(IMAGE_TAG)-ubi8-fips
STARBOARD_OPERATOR_IMAGE_UBI9 := aquasec/starboard-operator:$(IMAGE_TAG)-ubi9
STARBOARD_OPERATOR_IMAGE_UBI9_FIPS := aquasec/starboard-operator:$(IMAGE_TAG)-ubi9-fips

MKDOCS_IMAGE := aquasec/mkdocs-material:starboard
MKDOCS_PORT := 8000

.PHONY: all
all: build

.PHONY: build
build: build-starboard-cli build-starboard-operator build-starboard-scanner-aqua

## Builds the starboard binary
build-starboard-cli: bin/starboard
bin/starboard: $(SOURCES)
	CGO_ENABLED=0 go build -o $@ ./cmd/starboard/main.go

## Builds the starboard-operator binary
build-starboard-operator: bin/starboard-operator
bin/starboard-operator: $(SOURCES)
	CGO_ENABLED=0 GOOS=linux go build -o $@ ./cmd/starboard-operator/main.go

## Builds the starboard-operator FIPS binary (BoringCrypto + fipsonly tag)
build-starboard-operator-fips: bin/starboard-operator-fips
bin/starboard-operator-fips: $(SOURCES)
	CGO_ENABLED=0 GOOS=linux GOEXPERIMENT=boringcrypto go build -tags fipsonly -o $@ ./cmd/starboard-operator/main.go

## Builds the scanner-aqua binary
build-starboard-scanner-aqua: bin/starboard-scanner-aqua
bin/starboard-scanner-aqua: $(SOURCES)
	CGO_ENABLED=0 GOOS=linux go build -o $@ ./cmd/scanner-aqua/main.go

.PHONY: get-ginkgo
## Installs Ginkgo CLI
get-ginkgo:
	@go install github.com/onsi/ginkgo/ginkgo

.PHONY: get-qtc
## Installs quicktemplate compiler
get-qtc:
	@go install github.com/valyala/quicktemplate/qtc

.PHONY: compile-templates
## Converts quicktemplate files (*.qtpl) into Go code
compile-templates: get-qtc
	$(GOBIN)/qtc

.PHONY: test
## Runs both unit and integration tests
test: unit-tests itests-starboard itests-starboard-operator

.PHONY: unit-tests
## Runs unit tests with code coverage enabled
unit-tests: $(SOURCES)
	go test -v -short -race -timeout 30s -coverprofile=coverage.txt ./...

.PHONY: itests-starboard
## Runs integration tests for Starboard CLI with code coverage enabled
itests-starboard: check-kubeconfig get-ginkgo
	@$(GINKGO) \
	-coverprofile=coverage.txt \
	-coverpkg=github.com/aquasecurity/starboard/pkg/cmd,\
	github.com/aquasecurity/starboard/pkg/plugin,\
	github.com/aquasecurity/starboard/pkg/kube,\
	github.com/aquasecurity/starboard/pkg/kubebench,\
	github.com/aquasecurity/starboard/pkg/kubehunter,\
	github.com/aquasecurity/starboard/pkg/plugin/trivy,\
	github.com/aquasecurity/starboard/pkg/plugin/polaris,\
	github.com/aquasecurity/starboard/pkg/plugin/conftest,\
	github.com/aquasecurity/starboard/pkg/configauditreport,\
	github.com/aquasecurity/starboard/pkg/vulnerabilityreport \
	./itest/starboard

.PHONY: itests-starboard-operator
## Runs integration tests for Starboard Operator with code coverage enabled
itests-starboard-operator: check-kubeconfig get-ginkgo
	@$(GINKGO) \
	-coverprofile=coverage.txt \
	-coverpkg=github.com/aquasecurity/starboard/pkg/operator,\
	github.com/aquasecurity/starboard/pkg/operator/predicate,\
	github.com/aquasecurity/starboard/pkg/operator/controller,\
	github.com/aquasecurity/starboard/pkg/plugin,\
	github.com/aquasecurity/starboard/pkg/plugin/trivy,\
	github.com/aquasecurity/starboard/pkg/plugin/polaris,\
	github.com/aquasecurity/starboard/pkg/plugin/conftest,\
	github.com/aquasecurity/starboard/pkg/configauditreport,\
	github.com/aquasecurity/starboard/pkg/vulnerabilityreport,\
	github.com/aquasecurity/starboard/pkg/kubebench \
	./itest/starboard-operator

.PHONY: integration-operator-conftest
integration-operator-conftest: check-kubeconfig get-ginkgo
	@$(GINKGO) \
	-coverprofile=coverage.txt \
	-coverpkg=github.com/aquasecurity/starboard/pkg/operator,\
	github.com/aquasecurity/starboard/pkg/operator/predicate,\
	github.com/aquasecurity/starboard/pkg/operator/controller,\
	github.com/aquasecurity/starboard/pkg/plugin,\
	github.com/aquasecurity/starboard/pkg/plugin/conftest,\
	github.com/aquasecurity/starboard/pkg/configauditreport \
	./itest/starboard-operator/configauditreport/conftest

.PHONY: check-kubeconfig
check-kubeconfig:
ifndef KUBECONFIG
	$(error Environment variable KUBECONFIG is not set)
else
	@echo "KUBECONFIG=${KUBECONFIG}"
endif

## Removes build artifacts
clean:
	@rm -r ./bin 2> /dev/null || true
	@rm -r ./dist 2> /dev/null || true

## Builds Docker images for all binaries
docker-build: \
	docker-build-starboard-cli \
	docker-build-starboard-operator \
	docker-build-starboard-operator-ubi8 \
	docker-build-starboard-scanner-aqua

## Builds Docker image for Starboard CLI
docker-build-starboard-cli: build-starboard-cli
	$(DOCKER) build --no-cache -t $(STARBOARD_CLI_IMAGE) -f build/starboard/Dockerfile bin

## Builds Docker image for Starboard operator
docker-build-starboard-operator: build-starboard-operator
	$(DOCKER) build --no-cache -t $(STARBOARD_OPERATOR_IMAGE) -f build/starboard-operator/Dockerfile bin

## Builds FIPS Docker image for Starboard operator (UBI8 base - deprecated, kept for parity)
docker-build-starboard-operator-fips: build-starboard-operator-fips
	$(DOCKER) build --no-cache -f build/starboard-operator/Dockerfile.fips.ubi8 -t $(STARBOARD_OPERATOR_IMAGE_UBI8_FIPS) bin

## Builds FIPS Docker image for Starboard operator (UBI9 base - this is what releases ship)
docker-build-starboard-operator-fips-ubi9: build-starboard-operator-fips
	cp LICENSE bin/LICENSE
	$(DOCKER) build --no-cache -f build/starboard-operator/Dockerfile.fips.ubi9 -t $(STARBOARD_OPERATOR_IMAGE_UBI9_FIPS) bin

## Builds Docker image for Starboard operator ubi8
docker-build-starboard-operator-ubi8: build-starboard-operator
	$(DOCKER) build --no-cache -f build/starboard-operator/Dockerfile.ubi8 -t $(STARBOARD_OPERATOR_IMAGE_UBI8) bin

## Builds Docker image for Starboard operator ubi9
docker-build-starboard-operator-ubi9: build-starboard-operator
	cp LICENSE bin/LICENSE
	$(DOCKER) build --no-cache -f build/starboard-operator/Dockerfile.ubi9 -t $(STARBOARD_OPERATOR_IMAGE_UBI9) bin

## Builds Docker image for Aqua scanner
docker-build-starboard-scanner-aqua: build-starboard-scanner-aqua
	$(DOCKER) build --no-cache -t $(STARBOARD_SCANNER_AQUA_IMAGE) -f build/scanner-aqua/Dockerfile bin

kind-load-images: \
	docker-build-starboard-operator \
	docker-build-starboard-operator-ubi8
	$(KIND) load docker-image \
		$(STARBOARD_OPERATOR_IMAGE) \
		$(STARBOARD_OPERATOR_IMAGE_UBI8)

## Runs MkDocs development server to preview the documentation page
mkdocs-serve:
	$(DOCKER) build -t $(MKDOCS_IMAGE) -f build/mkdocs-material/Dockerfile bin
	$(DOCKER) run --name mkdocs-serve --rm -v $(PWD):/docs -p $(MKDOCS_PORT):8000 $(MKDOCS_IMAGE)

.PHONY: \
	build-starboard-cli \
	build-starboard-operator \
	build-starboard-operator-fips \
	build-starboard-scanner-aqua \
	clean \
	docker-build \
	docker-build-starboard-cli \
	docker-build-starboard-operator \
	docker-build-starboard-operator-ubi8 \
	docker-build-starboard-operator-ubi9 \
	docker-build-starboard-operator-fips \
	docker-build-starboard-operator-fips-ubi9 \
	docker-build-starboard-scanner-aqua \
	kind-load-images \
	mkdocs-serve