main.go

/*
Copyright The Kubernetes NMState Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package main

import (
	"context"
	"crypto/tls"
	"encoding/json"
	"flag"
	"fmt"
	"net/http"
	"os"
	"strconv"
	"time"

	configv1 "github.com/openshift/api/config/v1"
	tlspkg "github.com/openshift/controller-runtime-common/pkg/tls"
	corev1 "k8s.io/api/core/v1"
	"k8s.io/apimachinery/pkg/fields"
	"k8s.io/apimachinery/pkg/labels"
	"k8s.io/apimachinery/pkg/runtime"
	"k8s.io/apimachinery/pkg/types"
	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
	"k8s.io/client-go/rest"
	"k8s.io/client-go/util/retry"
	ctrl "sigs.k8s.io/controller-runtime"
	"sigs.k8s.io/controller-runtime/pkg/cache"
	"sigs.k8s.io/controller-runtime/pkg/client"
	"sigs.k8s.io/controller-runtime/pkg/log/zap"
	"sigs.k8s.io/controller-runtime/pkg/manager"
	"sigs.k8s.io/controller-runtime/pkg/metrics"
	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"

	// +kubebuilder:scaffold:imports

	"github.com/gofrs/flock"
	"github.com/kelseyhightower/envconfig"
	"github.com/pkg/errors"
	"github.com/qinqon/kube-admission-webhook/pkg/certificate"
	"github.com/spf13/pflag"
	"k8s.io/apimachinery/pkg/util/wait"

	"github.com/nmstate/kubernetes-nmstate/api/names"
	nmstateapi "github.com/nmstate/kubernetes-nmstate/api/shared"
	nmstatev1 "github.com/nmstate/kubernetes-nmstate/api/v1"
	nmstatev1beta1 "github.com/nmstate/kubernetes-nmstate/api/v1beta1"
	controllers "github.com/nmstate/kubernetes-nmstate/controllers/handler"
	controllersmetrics "github.com/nmstate/kubernetes-nmstate/controllers/metrics"
	"github.com/nmstate/kubernetes-nmstate/pkg/cluster"
	"github.com/nmstate/kubernetes-nmstate/pkg/enactmentstatus"
	"github.com/nmstate/kubernetes-nmstate/pkg/environment"
	"github.com/nmstate/kubernetes-nmstate/pkg/file"
	nmstatelog "github.com/nmstate/kubernetes-nmstate/pkg/log"
	"github.com/nmstate/kubernetes-nmstate/pkg/monitoring"
	"github.com/nmstate/kubernetes-nmstate/pkg/nmstatectl"
	"github.com/nmstate/kubernetes-nmstate/pkg/webhook"
)

const generalExitStatus int = 1

type ProfilerConfig struct {
	EnableProfiler bool   `envconfig:"ENABLE_PROFILER"`
	ProfilerPort   string `envconfig:"PROFILER_PORT" default:"6060"`
}

var (
	scheme   = runtime.NewScheme()
	setupLog = ctrl.Log.WithName("setup")
)

func init() {
	utilruntime.Must(clientgoscheme.AddToScheme(scheme))

	utilruntime.Must(nmstatev1.AddToScheme(scheme))
	utilruntime.Must(nmstatev1beta1.AddToScheme(scheme))
	utilruntime.Must(configv1.AddToScheme(scheme))
	// +kubebuilder:scaffold:scheme

	metrics.Registry.MustRegister(monitoring.AppliedFeatures)
	metrics.Registry.MustRegister(monitoring.NetworkInterfaces)
	metrics.Registry.MustRegister(monitoring.NetworkRoutes)
	metrics.Registry.MustRegister(monitoring.PolicyStatus)
	metrics.Registry.MustRegister(monitoring.EnactmentStatus)
}

func main() {
	if mainHandler() == generalExitStatus {
		os.Exit(generalExitStatus)
	}
}

// The code from main() has to be extracted into another function in order to properly handle defer.
// Otherwise, defer may never execute because of eventual os.Exit().
// return 1 indicates that program should exit with status code 1
func mainHandler() int {
	opt := zap.Options{}
	opt.BindFlags(flag.CommandLine)
	var logType string
	var dumpMetricFamilies bool
	pflag.StringVar(&logType, "v", "info", "Log type (debug/info).")
	pflag.BoolVar(&dumpMetricFamilies, "dump-metric-families", false, "Dump the prometheus metric families and exit.")
	pflag.CommandLine.MarkDeprecated("v", "please use the --zap-devel flag for debug logging instead")
	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
	pflag.Parse()

	if dumpMetricFamilies {
		return dumpMetricFamiliesToStdout()
	}

	if exitCode := initializeLogging(logType, &opt); exitCode != 0 {
		return exitCode
	}

	handlerLock, err := setupHandlerLockIfNeeded()
	if err != nil {
		setupLog.Error(err, "Failed to setup handler lock")
		return generalExitStatus
	}
	if handlerLock != nil {
		defer handlerLock.Unlock()
	}

	cfg := ctrl.GetConfigOrDie()

	// Detect OpenShift and fetch TLS profile early, before creating the
	// manager, so both the metrics server and webhooks share the same config.
	platformTLSOpts, err := cluster.FetchOpenShiftTLSOpts(cfg, scheme)
	if err != nil {
		setupLog.Error(err, "unable to fetch TLS configuration")
		return generalExitStatus
	}

	// Compose the TLS opts applied to all TLS-enabled servers.
	tlsOpts := composeTLSOpts(platformTLSOpts)

	mgr, err := createManager(cfg, tlsOpts, platformTLSOpts != nil /*isOpenShift*/)
	if err != nil {
		setupLog.Error(err, "unable to start manager")
		return generalExitStatus
	}

	// Create a cancellable context so that controllers (e.g. the TLS
	// security profile watcher) can trigger a graceful shutdown.
	ctx, cancel := context.WithCancel(ctrl.SetupSignalHandler())
	defer cancel()

	// On OpenShift, watch for TLS profile changes on processes that serve
	// TLS (webhook and metrics) and trigger a graceful shutdown so they
	// restart with the new configuration.
	if platformTLSOpts != nil && (environment.IsWebhook() || environment.IsMetricsManager()) {
		if err := setupTLSProfileWatcher(mgr, cancel); err != nil {
			setupLog.Error(err, "unable to set up TLS profile watcher")
			return generalExitStatus
		}
	}

	if err := setupControllersByEnvironment(mgr, tlsOpts); err != nil {
		return generalExitStatus
	}

	return startManager(mgr, ctx)
}

// initializeLogging sets up logging configuration and handles early exit conditions
func initializeLogging(logType string, opt *zap.Options) int {
	if logType == "debug" {
		// workaround until --v flag got removed
		flag.CommandLine.Set("zap-devel", "true")
		nmstatectl.SetDebugMode(true)
	}

	ctrl.SetLogger(zap.New(zap.UseFlagOptions(opt)))
	return 0
}

// setupHandlerLockIfNeeded sets up handler lock if running in handler mode
func setupHandlerLockIfNeeded() (*flock.Flock, error) {
	if !environment.IsHandler() {
		return nil, nil
	}

	handlerLock, err := lockHandler()
	if err != nil {
		return nil, err
	}
	setupLog.Info("Successfully took nmstate exclusive lock")
	return handlerLock, nil
}

// composeTLSOpts returns TLS options for all TLS-enabled servers.
// Always disables HTTP/2 (CVE-2023-39325), and adds the platform profile opts if present.
func composeTLSOpts(tlsOpts func(*tls.Config)) func(*tls.Config) {
	return func(c *tls.Config) {
		if tlsOpts != nil {
			tlsOpts(c)
		}
		c.NextProtos = []string{"http/1.1"}
	}
}

// setupTLSProfileWatcher watches for platform TLS profile changes and
// triggers a graceful shutdown so the process restarts with the new config.
func setupTLSProfileWatcher(mgr manager.Manager, cancel context.CancelFunc) error {
	// Use a non-cached client for the initial fetch because the manager's
	// cache is not started yet at this point.
	apiClient, err := client.New(mgr.GetConfig(), client.Options{Scheme: mgr.GetScheme()})
	if err != nil {
		return fmt.Errorf("failed creating client for TLS profile watcher: %w", err)
	}

	tlsProfileSpec, err := tlspkg.FetchAPIServerTLSProfile(context.Background(), apiClient)
	if err != nil {
		return fmt.Errorf("unable to get initial TLS profile for watcher: %w", err)
	}

	return (&tlspkg.SecurityProfileWatcher{
		Client:                mgr.GetClient(),
		InitialTLSProfileSpec: tlsProfileSpec,
		OnProfileChange: func(ctx context.Context, oldSpec, newSpec configv1.TLSProfileSpec) {
			setupLog.Info("TLS profile has changed, initiating shutdown to reload",
				"oldProfile", oldSpec, "newProfile", newSpec)
			cancel()
		},
	}).SetupWithManager(mgr)
}

// createManager creates and configures the controller manager.
// The metrics server always uses TLS (SecureServing). On non-OpenShift clusters
// controller-runtime auto-generates a self-signed certificate.
// When isOpenShift is true, authentication and authorization are enforced on the
// metrics endpoint via TokenReview/SubjectAccessReview.
func createManager(cfg *rest.Config, tlsOpts func(*tls.Config), isOpenShift bool) (manager.Manager, error) {
	// Get metrics bind address from environment variable, with default fallback
	metricsBindAddress := os.Getenv("METRICS_BIND_ADDRESS")
	if metricsBindAddress == "" {
		metricsBindAddress = ":8089"
	}

	metricsOpts := metricsserver.Options{
		BindAddress:   metricsBindAddress,
		SecureServing: true,
		TLSOpts:       []func(*tls.Config){tlsOpts},
	}

	if isOpenShift {
		metricsOpts.FilterProvider = filters.WithAuthenticationAndAuthorization
	}

	ctrlOptions := ctrl.Options{
		Scheme:  scheme,
		Metrics: metricsOpts,
	}

	if environment.IsHandler() {
		cacheResourcesOnNodes(&ctrlOptions)
	}

	setupLog.Info("Creating manager")
	return ctrl.NewManager(cfg, ctrlOptions)
}

// setupControllersByEnvironment configures controllers based on the current environment.
func setupControllersByEnvironment(mgr manager.Manager, tlsOpts func(*tls.Config)) error {
	switch {
	case environment.IsCertManager():
		return setupCertManagerEnvironment(mgr)
	case environment.IsWebhook():
		return setupWebhookEnvironment(mgr, tlsOpts)
	case environment.IsMetricsManager():
		return setupMetricsManager(mgr)
	case environment.IsHandler():
		return setupHandlerEnvironment(mgr)
	default:
		return nil
	}
}

// setupCertManagerEnvironment configures the certificate manager
func setupCertManagerEnvironment(mgr manager.Manager) error {
	certManagerOpts, err := retrieveCertAndCAIntervals()
	if err != nil {
		return err
	}
	return setupCertManager(mgr, certManagerOpts)
}

// setupWebhookEnvironment configures the webhook
func setupWebhookEnvironment(mgr manager.Manager, tlsOpts func(*tls.Config)) error {
	if err := webhook.AddToManager(mgr, tlsOpts); err != nil {
		setupLog.Error(err, "Cannot initialize webhook")
		return err
	}
	return nil
}

// setupHandlerEnvironment cleans up unavailableNodeCounts after unexpected restart,
// configures the handler controllers and performs health checks
func setupHandlerEnvironment(mgr manager.Manager) error {
	// Clean stale unavailable counts from node before starting controllers
	// Prevents deadlock after unexpected cluster reboot where nodes were
	// processing NNCP and left stale counts in etcd.
	if err := cleanStaleUnavailableCounts(mgr); err != nil {
		setupLog.Error(err, "Failed to cleanup stale unavailable counts, continuing anyway")
		// Don't error this is best-effort (NNCP needs manual restart)
	}

	if err := setupHandlerControllers(mgr); err != nil {
		return err
	}
	if err := checkNmstateIsWorking(); err != nil {
		return err
	}
	return createHealthyFile()
}

// startManager starts the manager and handles profiler setup
func startManager(mgr manager.Manager, ctx context.Context) int {
	setProfiler()
	setupLog.Info("starting manager")
	if err := mgr.Start(ctx); err != nil {
		setupLog.Error(err, "problem running manager")
		return generalExitStatus
	}
	return 0
}

// cleanStaleUnavailableCounts cleans up stale unavailable node counts that have been
// left in NNCP status after unexpected cluster reboots.
func cleanStaleUnavailableCounts(mgr manager.Manager) error {
	ctx := context.Background()
	nodeName := environment.NodeName()
	setupLog.Info("Cleaning up stale unavailable counts for node", "node", nodeName)

	apiClient, err := client.New(mgr.GetConfig(), client.Options{Scheme: mgr.GetScheme()})
	if err != nil {
		return err
	}

	enactmentList := &nmstatev1beta1.NodeNetworkConfigurationEnactmentList{}
	nodeLabel := client.MatchingLabels{nmstateapi.EnactmentNodeLabel: nodeName}
	if err := apiClient.List(ctx, enactmentList, nodeLabel); err != nil {
		return err
	}

	// For each enactment that was "Progressing" (interrupted by reboot)
	for i := range enactmentList.Items {
		enactment := &enactmentList.Items[i]
		if enactmentstatus.IsProgressing(&enactment.Status.Conditions) {
			policyName := enactment.Labels[nmstateapi.EnactmentPolicyLabel]
			generationKey := strconv.FormatInt(enactment.Status.PolicyGeneration, 10)

			setupLog.Info("detected stale progressing enactment, cleaning up",
				"enactment", enactment.Name,
				"policy", policyName,
				"generation", generationKey)

			// Decrement counter for this policy and generation
			if err := decrementStaleUnavailableCount(ctx, apiClient, policyName, generationKey); err != nil {
				setupLog.Error(err, "Failed to decrement stale count", "policy", policyName)
				// no return to continue with other enactments
			}

			// Reset retry count for this enactment and generation
			if err := resetStaleRetryCount(ctx, apiClient, enactment.Name, generationKey); err != nil {
				setupLog.Error(err, "Failed to reset stale retry count", "enactment", enactment.Name)
				// no return to continue with other enactments
			}
		}
	}

	setupLog.Info("Finished cleaning up stale unavailable counts", "node", nodeName)
	return nil
}

// decrementStaleUnavailableCount decrements the UnavailableNodeCountMap of a specific
// policy and generation for startup cleanup.
func decrementStaleUnavailableCount(ctx context.Context, cli client.Client, policyName, generationKey string) error {
	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
		policy := &nmstatev1.NodeNetworkConfigurationPolicy{}
		if err := cli.Get(ctx, types.NamespacedName{Name: policyName}, policy); err != nil {
			return err
		}

		if policy.Status.UnavailableNodeCountMap == nil {
			return nil // Nothing to clean up
		}

		if policy.Status.UnavailableNodeCountMap[generationKey] > 0 {
			policy.Status.UnavailableNodeCountMap[generationKey]--
			setupLog.Info("Decremented stale unavailable count",
				"policy", policyName,
				"generation", generationKey,
				"newCount", policy.Status.UnavailableNodeCountMap[generationKey])
			return cli.Status().Update(ctx, policy)
		}

		return nil
	})
}

// resetStaleRetryCount resets the RetryCount for a specific enactment and generation
// during startup clean to prevent stale retry counts from previous interrupted reconciles.
func resetStaleRetryCount(ctx context.Context, cli client.Client, enactmentName, generationKey string) error {
	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
		enactment := &nmstatev1beta1.NodeNetworkConfigurationEnactment{}
		if err := cli.Get(ctx, types.NamespacedName{Name: enactmentName}, enactment); err != nil {
			return err
		}

		if enactment.Status.RetryCount == nil || enactment.Status.RetryCount[generationKey] == 0 {
			return nil
		}

		enactment.Status.RetryCount[generationKey] = 0
		setupLog.Info("Reset stale retry count",
			"enactment", enactmentName,
			"generation", generationKey)
		return cli.Status().Update(ctx, enactment)
	})
}

// Handler runs as a daemonset and we want that each handler pod will cache/reconcile only resources that belong the node it runs on.
func cacheResourcesOnNodes(ctrlOptions *ctrl.Options) {
	nodeName := environment.NodeName()
	metadataNameMatchingNodeNameSelector := fields.Set{"metadata.name": nodeName}.AsSelector()
	nodeLabelMatchingNodeNameSelector := labels.Set{nmstateapi.EnactmentNodeLabel: nodeName}.AsSelector()
	ctrlOptions.Cache = cache.Options{
		ByObject: map[client.Object]cache.ByObject{
			&corev1.Node{}: {
				Field: metadataNameMatchingNodeNameSelector,
			},
			&nmstatev1beta1.NodeNetworkState{}: {
				Field: metadataNameMatchingNodeNameSelector,
			},
			&nmstatev1beta1.NodeNetworkConfigurationEnactment{}: {
				Label: nodeLabelMatchingNodeNameSelector,
			},
		},
	}
}

func setupHandlerControllers(mgr manager.Manager) error {
	setupLog.Info("Creating Node controller")
	if err := (&controllers.NodeReconciler{
		Client: mgr.GetClient(),
		Log:    ctrl.Log.WithName("controllers").WithName("Node"),
		Scheme: mgr.GetScheme(),
	}).SetupWithManager(mgr); err != nil {
		setupLog.Error(err, "unable to create Node controller", "controller", "NMState")
		return err
	}

	setupLog.Info("Creating non cached client")
	apiClient, err := client.New(mgr.GetConfig(), client.Options{Scheme: mgr.GetScheme(), Mapper: mgr.GetRESTMapper()})
	if err != nil {
		setupLog.Error(err, "failed creating non cached client")
		return err
	}

	setupLog.Info("Creating NodeNetworkConfigurationPolicy controller")
	if err = (&controllers.NodeNetworkConfigurationPolicyReconciler{
		Client:    mgr.GetClient(),
		APIClient: apiClient,
		Log:       ctrl.Log.WithName("controllers").WithName("NodeNetworkConfigurationPolicy"),
		Scheme:    mgr.GetScheme(),
		//nolint:staticcheck // TODO: migrate to GetEventRecorder
		Recorder: mgr.GetEventRecorderFor(fmt.Sprintf("%s.nmstate-handler", environment.NodeName())),
	}).SetupWithManager(mgr); err != nil {
		setupLog.Error(err, "unable to create NodeNetworkConfigurationPolicy controller", "controller", "NMState")
		return err
	}

	setupLog.Info("Creating NodeNetworkConfigurationEnactment controller")
	if err = (&controllers.NodeNetworkConfigurationEnactmentReconciler{
		Client: mgr.GetClient(),
		Log:    ctrl.Log.WithName("controllers").WithName("NodeNetworkConfigurationEnactment"),
		Scheme: mgr.GetScheme(),
	}).SetupWithManager(mgr); err != nil {
		setupLog.Error(err, "unable to create NodeNetworkConfigurationEnactment controller", "controller", "NMState")
		return err
	}

	return nil
}

// Handler runs with host networking so opening ports is problematic
// they will collide with node ports so to ensure that we reach this
// point (we have the handler lock and nmstatectl show is working) a
// file is touched and the file is checked at readinessProbe field.
func createHealthyFile() error {
	healthyFile := "/tmp/healthy"
	setupLog.Info("Marking handler as healthy touching healthy file", "healthyFile", healthyFile)
	err := file.Touch(healthyFile)
	if err != nil {
		setupLog.Error(err, "failed marking handler as healthy")
		return err
	}
	return nil
}

func checkNmstateIsWorking() error {
	setupLog.Info("Checking availability of nmstatectl")
	logWriter := nmstatelog.NewWriter(setupLog, 0)
	if err := nmstatectl.ShowWithArgumentsAndOutputs([]string{"-vvv"}, logWriter, logWriter); err != nil {
		setupLog.Error(err, "failed checking nmstatectl health")
		return err
	}
	setupLog.Info("Nmstatectl available, 'show' finished successfully.")
	return nil
}

func retrieveCertAndCAIntervals() (certificate.Options, error) {
	certManagerOpts := certificate.Options{
		Namespace:   os.Getenv("POD_NAMESPACE"),
		WebhookName: "nmstate",
		WebhookType: certificate.MutatingWebhook,
		ExtraLabels: names.IncludeRelationshipLabels(nil),
	}

	var err error
	certManagerOpts.CARotateInterval, err = environment.LookupAsDuration("CA_ROTATE_INTERVAL")
	if err != nil {
		setupLog.Error(err, "Failed retrieving ca rotate interval")
		return certificate.Options{}, err
	}

	certManagerOpts.CAOverlapInterval, err = environment.LookupAsDuration("CA_OVERLAP_INTERVAL")
	if err != nil {
		setupLog.Error(err, "Failed retrieving ca overlap interval")
		return certificate.Options{}, err
	}

	certManagerOpts.CertRotateInterval, err = environment.LookupAsDuration("CERT_ROTATE_INTERVAL")
	if err != nil {
		setupLog.Error(err, "Failed retrieving cert rotate interval")
		return certificate.Options{}, err
	}

	certManagerOpts.CertOverlapInterval, err = environment.LookupAsDuration("CERT_OVERLAP_INTERVAL")
	if err != nil {
		setupLog.Error(err, "Failed retrieving cert overlap interval")
		return certificate.Options{}, err
	}

	return certManagerOpts, nil
}

func setupCertManager(mgr manager.Manager, certManagerOpts certificate.Options) error {
	setupLog.Info("Creating cert-manager")
	certManager, err := certificate.NewManager(mgr.GetClient(), &certManagerOpts)
	if err != nil {
		setupLog.Error(err, "unable to create cert-manager", "controller", "cert-manager")
		return err
	}
	err = certManager.Add(mgr)
	if err != nil {
		setupLog.Error(err, "unable to add cert-manager to controller-runtime manager", "controller", "cert-manager")
		return err
	}
	return nil
}

func setupMetricsManager(mgr manager.Manager) error {
	setupLog.Info("Creating Metrics NodeNetworkConfigurationEnactment controller")
	if err := (&controllersmetrics.NodeNetworkConfigurationEnactmentReconciler{
		Client: mgr.GetClient(),
		Log:    ctrl.Log.WithName("metrics").WithName("NodeNetworkConfigurationEnactment"),
		Scheme: mgr.GetScheme(),
	}).SetupWithManager(mgr); err != nil {
		setupLog.Error(err, "unable to create NodeNetworkConfigurationEnactment metrics controller", "metrics", "NMState")
		return err
	}

	setupLog.Info("Creating Metrics NodeNetworkState controller")
	if err := (&controllersmetrics.NodeNetworkStateReconciler{
		Client: mgr.GetClient(),
		Log:    ctrl.Log.WithName("metrics").WithName("NodeNetworkState"),
		Scheme: mgr.GetScheme(),
	}).SetupWithManager(mgr); err != nil {
		setupLog.Error(err, "unable to create NodeNetworkState metrics controller", "metrics", "NMState")
		return err
	}

	setupLog.Info("Creating Metrics NodeNetworkConfigurationPolicy controller")
	if err := (&controllersmetrics.NodeNetworkConfigurationPolicyReconciler{
		Client: mgr.GetClient(),
		Log:    ctrl.Log.WithName("metrics").WithName("NodeNetworkConfigurationPolicy"),
		Scheme: mgr.GetScheme(),
	}).SetupWithManager(mgr); err != nil {
		setupLog.Error(err, "unable to create NodeNetworkConfigurationPolicy metrics controller", "metrics", "NMState")
		return err
	}

	setupLog.Info("Creating Metrics NodeNetworkConfigurationEnactment status controller")
	if err := (&controllersmetrics.NodeNetworkConfigurationEnactmentStatusReconciler{
		Client: mgr.GetClient(),
		Log:    ctrl.Log.WithName("metrics").WithName("NodeNetworkConfigurationEnactmentStatus"),
		Scheme: mgr.GetScheme(),
	}).SetupWithManager(mgr); err != nil {
		setupLog.Error(err, "unable to create NodeNetworkConfigurationEnactment status metrics controller", "metrics", "NMState")
		return err
	}

	return nil
}

// Start profiler on given port if ENABLE_PROFILER is True
func setProfiler() {
	cfg := ProfilerConfig{}
	envconfig.Process("", &cfg)
	if cfg.EnableProfiler {
		setupLog.Info("Starting profiler")
		go func() {
			profilerAddress := fmt.Sprintf("0.0.0.0:%s", cfg.ProfilerPort)
			setupLog.Info(fmt.Sprintf("Starting Profiler Server! \t Go to http://%s/debug/pprof/\n", profilerAddress))
			server := &http.Server{ReadHeaderTimeout: 10 * time.Second, Addr: profilerAddress}
			err := server.ListenAndServe()
			if err != nil {
				setupLog.Info("Failed to start the server! Error: %v", err)
			}
		}()
	}
}

func lockHandler() (*flock.Flock, error) {
	lockFilePath, ok := os.LookupEnv("NMSTATE_INSTANCE_NODE_LOCK_FILE")
	if !ok {
		return nil, errors.New("Failed to find NMSTATE_INSTANCE_NODE_LOCK_FILE ENV var")
	}
	setupLog.Info(fmt.Sprintf("Try to take exclusive lock on file: %s", lockFilePath))
	handlerLock := flock.New(lockFilePath)
	interval := 5 * time.Second
	err := wait.PollUntilContextCancel(context.Background(), interval, true, /*immediate*/
		func(context.Context) (done bool, err error) {
			locked, err := handlerLock.TryLock()
			if err != nil {
				setupLog.Error(err, "retrying to lock handler")
				return false, nil // Don't return the error here, it will not re-poll if we do
			}
			return locked, nil
		})
	return handlerLock, err
}

func dumpMetricFamiliesToStdout() int {
	metricFamiliesJSON, err := json.Marshal(monitoring.Families())
	if err != nil {
		setupLog.Error(err, "Failed dumping metric families")
		return generalExitStatus
	}
	fmt.Printf("%s", string(metricFamiliesJSON))
	return 0
}