build.sh

#!/bin/bash
set -euo pipefail

# Build the ocp-trace image for OpenShift debugging:
#   Driver Toolkit (RHCOS-matched kernel headers) + eBPF + network/shell utilities
#
# Tags the image with the cluster OCP version (e.g. ocp-trace:4.16.37) and also :latest.
#
# Requires: oc (cluster access), podman, subscribed RHEL build host

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PACKAGES_FILE="${SCRIPT_DIR}/packages.txt"
QUAY_REPO="${QUAY_REPO:-quay.io/rh_ee_lguoqing/ocp-trace}"
OUTPUT_FILE="${SCRIPT_DIR}/Dockerfile.generated"
DTK_IMAGE=""
OCP_VERSION=""
QUAY_IMAGE=""
EXPLICIT_TAG=0
TAG_LATEST=1
NO_BUILD=0

show_usage() {
    cat <<EOF
Usage: $0 [OPTIONS]

Build ocp-trace image: Driver Toolkit + packages from packages.txt.

Default tag: \${QUAY_REPO}:\$(oc get clusterversion version -o jsonpath='{.status.desired.version}')
Also tags:   \${QUAY_REPO}:latest  (disable with --no-latest)

Options:
  -d, --dtk-image IMAGE   Driver Toolkit image (default: from cluster release)
  -t, --tag TAG           Full image reference (overrides version-based default)
  -o, --output FILE       Generated Dockerfile path (default: Dockerfile.generated)
  -n, --no-build          Write Dockerfile only; do not run podman build
      --no-latest         Do not also tag/push :latest
  -h, --help              Show this help

Environment:
  QUAY_REPO               Image repo without tag (default: quay.io/rh_ee_lguoqing/ocp-trace)
  QUAY_IMAGE              Same as --tag (overrides version default)

Build on a subscribed RHEL host. Mount entitlements only (not redhat.repo read-only).
Log in to Quay with a user that can push (not a cluster pull robot).
Rebuild after every OCP upgrade.
EOF
}

while [[ $# -gt 0 ]]; do
    case "$1" in
        -d|--dtk-image) DTK_IMAGE="$2"; shift 2 ;;
        -t|--tag) QUAY_IMAGE="$2"; EXPLICIT_TAG=1; shift 2 ;;
        -o|--output) OUTPUT_FILE="$2"; shift 2 ;;
        -n|--no-build) NO_BUILD=1; shift ;;
        --no-latest) TAG_LATEST=0; shift ;;
        -h|--help) show_usage; exit 0 ;;
        *) echo "Unknown option: $1" >&2; show_usage; exit 1 ;;
    esac
done

if [[ -n "${QUAY_IMAGE:-}" && "$EXPLICIT_TAG" -eq 0 ]]; then
    EXPLICIT_TAG=1
fi

if [[ ! -f "$PACKAGES_FILE" ]]; then
    echo "Error: packages file not found: ${PACKAGES_FILE}" >&2
    exit 1
fi

PACKAGES=$(grep -v '^[[:space:]]*#' "$PACKAGES_FILE" | grep -v '^[[:space:]]*$' | tr '\n' ' ')
if [[ -z "$PACKAGES" ]]; then
    echo "Error: no packages listed in ${PACKAGES_FILE}" >&2
    exit 1
fi

read_group() {
    local group="$1"
    awk -v g="$group" '
        /^# @group / { cur=$3; next }
        /^#/ { next }
        /^[[:space:]]*$/ { next }
        cur == g { printf "%s ", $0 }
    ' "$PACKAGES_FILE"
}

EBPF_PACKAGES=$(read_group ebpf)
TOOL_PACKAGES=$(read_group tools)
if [[ -z "$EBPF_PACKAGES" || -z "$TOOL_PACKAGES" ]]; then
    echo "Error: packages.txt must define # @group ebpf and # @group tools" >&2
    exit 1
fi

if [[ -z "$DTK_IMAGE" || -z "$OCP_VERSION" ]]; then
    if ! command -v oc &>/dev/null; then
        if [[ -z "$DTK_IMAGE" ]]; then
            echo "Error: oc not found. Pass --dtk-image or log into the cluster." >&2
            exit 1
        fi
    else
        OCP_VERSION="${OCP_VERSION:-$(oc get clusterversion version -o jsonpath='{.status.desired.version}')}"
        if [[ -z "$DTK_IMAGE" ]]; then
            OCP_IMAGE=$(oc get clusterversion version -o jsonpath='{.status.desired.image}')
            echo "Cluster release image: ${OCP_IMAGE}"
            echo "OCP version: ${OCP_VERSION}"
            DTK_IMAGE=$(oc adm release info "$OCP_IMAGE" --image-for=driver-toolkit)
        fi
    fi
fi

if [[ "$EXPLICIT_TAG" -eq 0 ]]; then
    if [[ -z "$OCP_VERSION" ]]; then
        echo "Error: cannot determine OCP version. Pass --tag or log into the cluster." >&2
        exit 1
    fi
    QUAY_IMAGE="${QUAY_REPO}:${OCP_VERSION}"
fi

LATEST_IMAGE="${QUAY_REPO}:latest"

echo "Driver Toolkit image: ${DTK_IMAGE}"
echo "eBPF packages: ${EBPF_PACKAGES}"
echo "Tool packages: ${TOOL_PACKAGES}"
echo "Primary tag: ${QUAY_IMAGE}"
[[ "$TAG_LATEST" -eq 1 ]] && echo "Also tags: ${LATEST_IMAGE}"

DNF_INSTALL="dnf install -y --allowerasing --setopt=install_weak_deps=False"

cat > "$OUTPUT_FILE" <<EOF
# Generated by build.sh — rebuild after OCP upgrade
# OCP version: ${OCP_VERSION:-unknown}
FROM ${DTK_IMAGE}
# eBPF stack first (heavy LLVM/clang deps from bcc-tools)
RUN ${DNF_INSTALL} ${EBPF_PACKAGES}
# network / shell tools in a separate layer to avoid cross-group solver conflicts
RUN ${DNF_INSTALL} ${TOOL_PACKAGES} && dnf clean all
CMD ["/bin/bash"]
EOF

echo "Wrote ${OUTPUT_FILE}"

if [[ "$NO_BUILD" -eq 1 ]]; then
    echo "Skipping build (--no-build)."
    exit 0
fi

if [[ ! -d /etc/pki/entitlement ]] || [[ -z "$(ls -A /etc/pki/entitlement 2>/dev/null)" ]]; then
    echo "Warning: /etc/pki/entitlement missing or empty. Build needs a subscribed RHEL host." >&2
fi

echo "Building ${QUAY_IMAGE} ..."
podman build \
    --volume /etc/pki/entitlement:/etc/pki/entitlement:ro,Z \
    --volume /etc/rhsm:/etc/rhsm:ro,Z \
    -t "${QUAY_IMAGE}" \
    -f "${OUTPUT_FILE}" .

if [[ "$TAG_LATEST" -eq 1 && "${QUAY_IMAGE}" != "${LATEST_IMAGE}" ]]; then
    podman tag "${QUAY_IMAGE}" "${LATEST_IMAGE}"
    echo "Tagged ${LATEST_IMAGE}"
fi

echo ""
echo "Done. Push with:"
echo "  podman push ${QUAY_IMAGE}"
if [[ "$TAG_LATEST" -eq 1 && "${QUAY_IMAGE}" != "${LATEST_IMAGE}" ]]; then
    echo "  podman push ${LATEST_IMAGE}"
fi