feat(profiling): add pprof profiling, K8s API call tracking, and benchmark suite

Makefile

@@ -110,6 +110,10 @@ govulncheck: ## Run govulncheck linter
 test: ## Run GoLang tests
 	go test -tags=aws,helmunit -shuffle=on ./...
 
+.PHONY: test-profile
+test-profile: ## Run GoLang tests with profiling
+	PROF_BENCH_ONLY=0 hack/profile.sh
+
 .PHONY: test-update-snaps
 test-update-snaps:
 	UPDATE_SNAPS=always go test -tags=aws,helmunit -shuffle=on ./...
@@ -150,6 +154,12 @@ $(BINARY_NAME)-$(ARCH): $(GO_SRCS)
 	CGO_ENABLED=0 GOOS=$(strip $(GOOS)) GOARCH=$(strip $(ARCH)) go build -trimpath -ldflags "$(GO_LINKER_FLAGS)" -o $(BINARY_NAME)-$(ARCH) github.com/nginx/kubernetes-ingress/cmd/nginx-ingress
 	@cp $(BINARY_NAME)-$(ARCH) $(BINARY_NAME)
 
+.PHONY: build-debug
+build-debug: ## Build Ingress Controller binary with debug flags and pprof on :6060
+	@go version || (code=$$?; printf "\033[0;31mError\033[0m: unable to build locally, try using the parameter TARGET=container or TARGET=download\n"; exit $$code)
+	CGO_ENABLED=0 GOOS=$(strip $(GOOS)) GOARCH=$(strip $(ARCH)) go build -tags debug -ldflags "$(DEBUG_GO_LINKER_FLAGS)" -gcflags "$(DEBUG_GO_GC_FLAGS)" -o $(BINARY_NAME)-$(ARCH) github.com/nginx/kubernetes-ingress/cmd/nginx-ingress
+	@cp $(BINARY_NAME)-$(ARCH) $(BINARY_NAME)
+
 .PHONY: build
 build: ## Build Ingress Controller binary
 ifeq ($(strip $(TARGET)),local)
@@ -160,7 +170,7 @@ else ifeq ($(strip $(TARGET)),download)
 else ifeq ($(strip $(TARGET)),debug)
 # Debug builds run unconditionally (no incremental file target) since they are infrequent.
 	@go version || (code=$$?; printf "\033[0;31mError\033[0m: unable to build locally, try using the parameter TARGET=container or TARGET=download\n"; exit $$code)
-	CGO_ENABLED=0 GOOS=$(strip $(GOOS)) GOARCH=$(strip $(ARCH)) go build -ldflags "$(DEBUG_GO_LINKER_FLAGS)" -gcflags "$(DEBUG_GO_GC_FLAGS)" -o $(BINARY_NAME)-$(ARCH) github.com/nginx/kubernetes-ingress/cmd/nginx-ingress
+	CGO_ENABLED=0 GOOS=$(strip $(GOOS)) GOARCH=$(strip $(ARCH)) go build -tags debug -ldflags "$(DEBUG_GO_LINKER_FLAGS)" -gcflags "$(DEBUG_GO_GC_FLAGS)" -o $(BINARY_NAME)-$(ARCH) github.com/nginx/kubernetes-ingress/cmd/nginx-ingress
 	@cp $(BINARY_NAME)-$(ARCH) $(BINARY_NAME)
 else ifeq ($(strip $(TARGET)),container)
 # Binary is built inside Docker as part of the image build; nothing to do here.
@@ -185,6 +195,10 @@ build-goreleaser: ## Build Ingress Controller binary using GoReleaser
 	@goreleaser -v || (code=$$?; printf "\033[0;31mError\033[0m: there was a problem with GoReleaser. Follow the docs to install it https://goreleaser.com/install\n"; exit $$code)
 	GOOS=$(strip $(GOOS)) GOPATH=$(shell go env GOPATH) GOARCH=$(strip $(ARCH)) goreleaser build --clean --snapshot --id kubernetes-ingress --single-target
 
+.PHONY: debian-image-profiling
+debian-image-profiling: build-debug ## Create Docker image for profiling (Debian + pprof on :6060, includes Delve)
+	docker build --platform linux/$(strip $(ARCH)) $(strip $(DOCKER_BUILD_OPTIONS)) --target profiling -f build/Dockerfile -t $(BUILD_IMAGE) . --build-arg BUILD_OS=debian --build-arg NGINX_OSS_VERSION=$(NGINX_OSS_VERSION) --build-arg AGENT_V3_VERSION=$(AGENT_V3_VERSION)
+
 ###### NIC + NGINX OSS Images (built from scratch) ######
 
 .PHONY: alpine-image

build/Dockerfile

@@ -841,7 +841,7 @@ RUN apk add --no-cache git
 RUN --mount=type=bind,target=/go/src/github.com/nginx/kubernetes-ingress/ --mount=type=cache,target=/root/.cache/go-build \
 	go mod download
 RUN --mount=type=bind,target=/go/src/github.com/nginx/kubernetes-ingress/ --mount=type=cache,target=/root/.cache/go-build \
-	CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build -gcflags "all=-N -l" -o /nginx-ingress github.com/nginx/kubernetes-ingress/cmd/nginx-ingress
+	CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build -tags debug -gcflags "all=-N -l" -o /nginx-ingress github.com/nginx/kubernetes-ingress/cmd/nginx-ingress
 RUN CGO_ENABLED=0 go install -ldflags "-s -w -extldflags '-static'" github.com/go-delve/delve/cmd/dlv@latest
 
 
@@ -922,6 +922,40 @@ USER 101
 ENTRYPOINT ["/dlv"]
 
 
+############################################# profiling — host debug binary + Delve, pprof on :6060, normal entrypoint #############################################
+FROM common AS profiling
+ARG BUILD_OS
+ENV BUILD_OS=${BUILD_OS}
+
+LABEL org.nginx.kic.image.build.version="profiling"
+
+ENV GOPATH="/work"
+ENV GOROOT="/go"
+ENV PATH="$PATH:${GOROOT}/bin:${GOPATH}/bin"
+
+COPY --link --from=debug-builder --chown=101:0 /go/bin/dlv /dlv
+COPY --link --chown=101:0 nginx-ingress /
+# root is required for `setcap` invocation
+USER 0
+RUN --mount=type=bind,target=/tmp if [ -z "${BUILD_OS##*plus*}" ]; then PLUS=-plus; fi \
+	&& cp -a /tmp/internal/configs/version1/nginx$PLUS.ingress.tmpl \
+	/tmp/internal/configs/version1/nginx$PLUS.tmpl \
+	/tmp/internal/configs/version2/nginx$PLUS.virtualserver.tmpl \
+	/tmp/internal/configs/version2/nginx$PLUS.transportserver.tmpl / \
+	&& if [ -z "${BUILD_OS##*plus*}" ]; then cp -a /tmp/internal/configs/version2/oidc.tmpl /; fi \
+	&& chown -R 101:0 /*.tmpl \
+	&& chmod -R g=u /*.tmpl \
+	&& setcap 'cap_net_bind_service=+ep' /nginx-ingress && setcap -v 'cap_net_bind_service=+ep' /nginx-ingress \
+	&& setcap 'cap_net_bind_service=+ep' /dlv && setcap -v 'cap_net_bind_service=+ep' /dlv \
+	&& mkdir -p /nonexistent /work /go/bin /go-build \
+	&& chown 101:0 /nonexistent /work /go-build
+COPY --link --from=debug-builder --chown=101:0 /usr/local/go/bin/go /go/bin/go
+# 101 is nginx, defined above
+USER 101
+
+EXPOSE 6060
+
+
 ############################################# local-prebuilt — host binary into pre-downloaded base image #############################################
 FROM ${PREBUILT_BASE_IMG} AS local-prebuilt
 ARG BUILD_OS