Makefile

# Image URL to use all building/pushing image targets
IMG ?= controller:latest
# ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
ENVTEST_K8S_VERSION ?= 1.33.0

# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
ifeq (,$(shell go env GOBIN))
GOBIN=$(shell go env GOPATH)/bin
else
GOBIN=$(shell go env GOBIN)
endif

# CONTAINER_TOOL defines the container tool to be used for building images.
# Be aware that the target commands are only tested with Docker which is
# scaffolded by default. However, you might want to replace it to use other
# tools. (i.e. podman)
CONTAINER_TOOL ?= docker

# Setting SHELL to bash allows bash commands to be executed by recipes.
# Options are set to exit when a recipe line exits non-zero or a piped command fails.
SHELL = /usr/bin/env bash -o pipefail
.SHELLFLAGS = -ec

.PHONY: all
all: build

##@ General

# The help target prints out all targets with their descriptions organized
# beneath their categories. The categories are represented by '##@' and the
# target descriptions by '##'. The awk command is responsible for reading the
# entire set of makefiles included in this invocation, looking for lines of the
# file as xyz: ## something, and then pretty-format the target and help. Then,
# if there's a line with ##@ something, that gets pretty-printed as a category.
# More info on the usage of ANSI control characters for terminal formatting:
# https://en.wikipedia.org/wiki/ANSI_escape_code#SGR_parameters
# More info on the awk command:
# http://linuxcommand.org/lc3_adv_awk.php

.PHONY: help
help: ## Display this help.
	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)

##@ Development

.PHONY: manifests
manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
	$(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases

.PHONY: generate
generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
	$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."

.PHONY: fmt
fmt: ## Run go fmt against code.
	go fmt ./...

.PHONY: vet
vet: ## Run go vet against code.
	go vet ./...

.PHONY: test
test: manifests generate fmt vet envtest ## Run tests.
	$(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN)
	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test $$(go list ./... | grep -v /e2e) -coverprofile cover.out

# Utilize Kind or modify the e2e tests to load the image locally, enabling compatibility with other vendors.
.PHONY: test-e2e  # Run the e2e tests against a Kind k8s instance that is spun up.
test-e2e:
	go test ./test/e2e/ -v -ginkgo.v

.PHONY: bench
bench: ## Run benchmarks for resource builders.
	go test ./internal/resources/ -bench=. -benchmem -run=^$$ -count=1

##@ Docs Site

.PHONY: api-docs
api-docs: manifests crd-ref-docs ## Regenerate docs/api-reference-generated.md from the API types.
	$(CRD_REF_DOCS) \
	  --config docs-site/crd-ref-docs.yaml \
	  --source-path api/v1 \
	  --output-path docs/api-reference-generated.md \
	  --renderer markdown

.PHONY: docs-venv
docs-venv: docs-site/.venv/bin/activate ## Create the docs-site Python virtualenv.
docs-site/.venv/bin/activate: docs-site/requirements.txt
	python3 -m venv docs-site/.venv
	docs-site/.venv/bin/pip install --upgrade pip
	docs-site/.venv/bin/pip install -r docs-site/requirements.txt
	touch docs-site/.venv/bin/activate

.PHONY: docs-serve
docs-serve: docs-venv ## Serve the docs site locally (http://127.0.0.1:8000).
	docs-site/.venv/bin/mkdocs serve -f docs-site/mkdocs.yml

.PHONY: docs-build
docs-build: docs-venv ## Build the docs site in strict mode (fails on warnings).
	docs-site/.venv/bin/mkdocs build --strict -f docs-site/mkdocs.yml

.PHONY: lint
lint: golangci-lint ## Run golangci-lint linter
	$(GOLANGCI_LINT) run

.PHONY: lint-fix
lint-fix: golangci-lint ## Run golangci-lint linter and perform fixes
	$(GOLANGCI_LINT) run --fix

.PHONY: sync-chart-crds
sync-chart-crds: manifests ## Copy generated CRDs into the Helm chart.
	rm -rf charts/hermes-operator/templates/crds
	mkdir -p charts/hermes-operator/templates/crds
	cp config/crd/bases/*.yaml charts/hermes-operator/templates/crds/

##@ Build

.PHONY: build
build: manifests generate fmt vet ## Build manager binary.
	go build -o bin/manager cmd/main.go

.PHONY: run
run: manifests generate fmt vet ## Run a controller from your host.
	go run ./cmd/main.go

# If you wish to build the manager image targeting other platforms you can use the --platform flag.
# (i.e. docker build --platform linux/arm64). However, you must enable docker buildKit for it.
# More info: https://docs.docker.com/develop/develop-images/build_enhancements/
.PHONY: docker-build
docker-build: ## Build docker image with the manager.
	$(CONTAINER_TOOL) build -t ${IMG} .

.PHONY: docker-push
docker-push: ## Push docker image with the manager.
	$(CONTAINER_TOOL) push ${IMG}

# PLATFORMS defines the target platforms for the manager image be built to provide support to multiple
# architectures. (i.e. make docker-buildx IMG=myregistry/mypoperator:0.0.1). To use this option you need to:
# - be able to use docker buildx. More info: https://docs.docker.com/build/buildx/
# - have enabled BuildKit. More info: https://docs.docker.com/develop/develop-images/build_enhancements/
# - be able to push the image to your registry (i.e. if you do not set a valid value via IMG=<myregistry/image:<tag>> then the export will fail)
# To adequately provide solutions that are compatible with multiple platforms, you should consider using this option.
PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
.PHONY: docker-buildx
docker-buildx: ## Build and push docker image for the manager for cross-platform support
	# copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile
	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross
	- $(CONTAINER_TOOL) buildx create --name hermes-operator-builder
	$(CONTAINER_TOOL) buildx use hermes-operator-builder
	- $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) --tag ${IMG} -f Dockerfile.cross .
	- $(CONTAINER_TOOL) buildx rm hermes-operator-builder
	rm Dockerfile.cross

# -------- hermes-agent image (Plan 3) --------

AGENT_IMAGE         ?= ghcr.io/paperclipinc/hermes-agent
HERMES_VERSION      ?= v2026.5.29.2
AGENT_IMAGE_PLATFORMS ?= linux/amd64,linux/arm64

# Build the agent image for the current platform. Local dev only.
.PHONY: agent-image-build
agent-image-build:
	docker build \
		--build-arg HERMES_VERSION=$(HERMES_VERSION) \
		-t $(AGENT_IMAGE):$(HERMES_VERSION) \
		images/hermes-agent

# Multi-arch build via buildx. Pushes only if PUSH=1.
.PHONY: agent-image-buildx
agent-image-buildx:
	docker buildx build \
		--platform $(AGENT_IMAGE_PLATFORMS) \
		--build-arg HERMES_VERSION=$(HERMES_VERSION) \
		$(if $(filter 1,$(PUSH)),--push,--load) \
		-t $(AGENT_IMAGE):$(HERMES_VERSION) \
		images/hermes-agent

# Refresh images/hermes-agent/uv.lock for the requested HERMES_VERSION.
# Rewrites the git ref in pyproject.toml, then runs native uv (uses the host
# git + python to resolve the git+https dependency). Requires network access.
.PHONY: agent-image-relock
agent-image-relock: ## Relock images/hermes-agent/uv.lock for HERMES_VERSION. Requires local uv + git (resolves the git+https hermes-agent dep). CI alternative: run the agent-image-relock workflow (pins uv 0.11.7).
	sed -i.bak -E 's|(hermes-agent @ git\+https://github.com/NousResearch/hermes-agent@)[^"]+|\1$(HERMES_VERSION)|' images/hermes-agent/pyproject.toml
	rm -f images/hermes-agent/pyproject.toml.bak
	cd images/hermes-agent && UV_FROZEN=false uv lock
	@echo "Updated images/hermes-agent/pyproject.toml and uv.lock for hermes-agent@$(HERMES_VERSION)"

# Smoke-test a locally built image: --help should exit 0.
.PHONY: agent-image-smoke
agent-image-smoke:
	docker run --rm $(AGENT_IMAGE):$(HERMES_VERSION) hermes-agent --help >/dev/null
	@echo "agent-image-smoke OK for $(AGENT_IMAGE):$(HERMES_VERSION)"

.PHONY: build-installer
build-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs and deployment.
	mkdir -p dist
	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
	$(KUSTOMIZE) build config/default > dist/install.yaml

.PHONY: installer
installer: manifests generate kustomize ## Emit dist/install.yaml for plain kubectl apply.
	mkdir -p dist
	cd config/manager && $(KUSTOMIZE) edit set image controller=ghcr.io/paperclipinc/hermes-operator:$${VERSION:-latest}
	$(KUSTOMIZE) build config/default > dist/install.yaml
	@echo "Wrote dist/install.yaml ($$(wc -l < dist/install.yaml) lines)"

##@ Deployment

ifndef ignore-not-found
  ignore-not-found = false
endif

.PHONY: install
install: manifests kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config.
	$(KUSTOMIZE) build config/crd | $(KUBECTL) apply -f -

.PHONY: uninstall
uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
	$(KUSTOMIZE) build config/crd | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -

.PHONY: deploy
deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
	$(KUSTOMIZE) build config/default | $(KUBECTL) apply -f -

.PHONY: undeploy
undeploy: kustomize ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
	$(KUSTOMIZE) build config/default | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -

##@ Dependencies

## Location to install dependencies to
LOCALBIN ?= $(shell pwd)/bin
$(LOCALBIN):
	mkdir -p $(LOCALBIN)

## Tool Binaries
KUBECTL ?= kubectl
KUSTOMIZE ?= $(LOCALBIN)/kustomize
CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
ENVTEST ?= $(LOCALBIN)/setup-envtest
GOLANGCI_LINT = $(LOCALBIN)/golangci-lint
CRD_REF_DOCS ?= $(LOCALBIN)/crd-ref-docs

## Tool Versions
KUSTOMIZE_VERSION ?= v5.4.2
CONTROLLER_TOOLS_VERSION ?= v0.21.0
ENVTEST_VERSION ?= release-0.24
GOLANGCI_LINT_VERSION ?= v2.12.2
CRD_REF_DOCS_VERSION ?= v0.3.0

.PHONY: kustomize
kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
$(KUSTOMIZE): $(LOCALBIN)
	$(call go-install-tool,$(KUSTOMIZE),sigs.k8s.io/kustomize/kustomize/v5,$(KUSTOMIZE_VERSION))

.PHONY: controller-gen
controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary.
$(CONTROLLER_GEN): $(LOCALBIN)
	$(call go-install-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen,$(CONTROLLER_TOOLS_VERSION))

.PHONY: envtest
envtest: $(ENVTEST) ## Download setup-envtest locally if necessary.
$(ENVTEST): $(LOCALBIN)
	$(call go-install-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest,$(ENVTEST_VERSION))

.PHONY: golangci-lint
golangci-lint: $(GOLANGCI_LINT) ## Download golangci-lint locally if necessary.
$(GOLANGCI_LINT): $(LOCALBIN)
	$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/v2/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION))

.PHONY: crd-ref-docs
crd-ref-docs: $(CRD_REF_DOCS) ## Download crd-ref-docs locally if necessary.
$(CRD_REF_DOCS): $(LOCALBIN)
	$(call go-install-tool,$(CRD_REF_DOCS),github.com/elastic/crd-ref-docs,$(CRD_REF_DOCS_VERSION))

# go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist
# $1 - target path with name of binary
# $2 - package url which can be installed
# $3 - specific version of package
define go-install-tool
@[ -f "$(1)-$(3)" ] || { \
set -e; \
package=$(2)@$(3) ;\
echo "Downloading $${package}" ;\
rm -f $(1) || true ;\
GOBIN=$(LOCALBIN) go install $${package} ;\
mv $(1) $(1)-$(3) ;\
} ;\
ln -sf $(1)-$(3) $(1)
endef

##@ E2E

KIND_CLUSTER ?= hermes-operator-e2e

.PHONY: kind-up
kind-up: ## Create a kind cluster for e2e.
	kind create cluster --name $(KIND_CLUSTER) --config hack/kind-config.yaml

.PHONY: kind-down
kind-down: ## Tear down the kind cluster.
	kind delete cluster --name $(KIND_CLUSTER)

.PHONY: e2e
e2e: ## Run e2e suite against the kind cluster (must already be up).
	go test ./test/e2e/... -v -timeout 10m

.PHONY: e2e-load-image
e2e-load-image: docker-build ## Load the locally-built operator image into kind.
	kind load docker-image $(IMG) --name $(KIND_CLUSTER)

##@ Conformance

CONFORMANCE_KIND_CLUSTER ?= hermes-conformance

.PHONY: conformance-kind-up
conformance-kind-up: ## Spin up a fresh kind cluster for conformance.
	kind create cluster --name $(CONFORMANCE_KIND_CLUSTER) --config hack/kind-config.yaml || true

.PHONY: conformance-kind-down
conformance-kind-down:
	kind delete cluster --name $(CONFORMANCE_KIND_CLUSTER)

.PHONY: conformance-install
conformance-install: docker-build ## Install operator + CRDs onto the conformance cluster.
	kind load docker-image $(IMG) --name $(CONFORMANCE_KIND_CLUSTER)
	@echo "waiting for cert-manager webhook to be reachable before installing chart..."
	@kubectl wait --for=condition=Available --timeout=2m \
	  -n cert-manager deploy/cert-manager-webhook deploy/cert-manager deploy/cert-manager-cainjector || true
	@for i in 1 2 3 4 5 6 7 8 9 10; do \
	  if kubectl get --raw=/apis/cert-manager.io/v1 >/dev/null 2>&1; then break; fi; \
	  echo "waiting for cert-manager API (try $$i/10)..."; sleep 3; \
	done
	helm upgrade --install hermes-operator charts/hermes-operator \
	  --namespace hermes-system --create-namespace \
	  --set image.repository=$(shell echo $(IMG) | cut -d: -f1) \
	  --set image.tag=$(shell echo $(IMG) | cut -d: -f2) \
	  --set image.pullPolicy=IfNotPresent \
	  --wait --timeout=10m \
	  || { \
	    echo "::group::diagnostics"; \
	    kubectl get all -n hermes-system || true; \
	    kubectl describe deploy/hermes-operator -n hermes-system || true; \
	    kubectl get certificates,certificaterequests -A || true; \
	    kubectl get pods -n hermes-system -o wide || true; \
	    kubectl logs -n hermes-system -l app.kubernetes.io/name=hermes-operator --all-containers=true --tail=200 || true; \
	    echo "::endgroup::"; \
	    exit 1; \
	  }

.PHONY: conformance
conformance: ## Run the full conformance suite. Requires KUBECONFIG to a cluster with operator installed.
	cd test/conformance && go test -v -timeout 60m -ginkgo.v ./...

.PHONY: conformance-negative
conformance-negative:
	cd test/conformance && go test -v -timeout 10m -ginkgo.v -ginkgo.focus="webhook deny paths" ./...

.PHONY: conformance-idempotency
conformance-idempotency:
	cd test/conformance && go test -v -timeout 55m -ginkgo.v -ginkgo.focus="idempotency" ./...

.PHONY: conformance-upgrade
conformance-upgrade:
	cd test/conformance && go test -v -timeout 60m -ginkgo.v -ginkgo.focus="upgrade-path matrix" ./...

.PHONY: conformance-gitops
conformance-gitops:
	cd test/conformance && go test -v -timeout 20m -ginkgo.v -ginkgo.focus="GitOps coexistence" ./...

.PHONY: conformance-failure
conformance-failure:
	cd test/conformance && go test -v -timeout 20m -ginkgo.v -ginkgo.focus="failure injection" ./...

.PHONY: sync-bundle-crds
sync-bundle-crds: manifests ## Sync CRDs from config/crd/bases/ into the OLM bundle.
	cp config/crd/bases/hermes.agent_hermesinstances.yaml      bundle/manifests/
	cp config/crd/bases/hermes.agent_hermesselfconfigs.yaml    bundle/manifests/
	cp config/crd/bases/hermes.agent_hermesclusterdefaults.yaml bundle/manifests/

.PHONY: sync-bundle-rbac
sync-bundle-rbac: manifests ## Sync bundle CSV RBAC from kubebuilder-generated role.
	bash hack/sync-bundle-rbac.sh

.PHONY: sync-bundle-rbac-check
sync-bundle-rbac-check: ## Verify the bundle CSV RBAC is in sync (CI use).
	bash hack/sync-bundle-rbac.sh --check

##@ Bundle

BUNDLE_IMG ?= ghcr.io/paperclipinc/hermes-operator-bundle:$(shell git describe --tags --always)
CATALOG_IMG ?= ghcr.io/paperclipinc/hermes-operator-catalog:$(shell git describe --tags --always)

OPERATOR_SDK ?= $(LOCALBIN)/operator-sdk
OPERATOR_SDK_VERSION ?= v1.38.0
OPM ?= $(LOCALBIN)/opm
OPM_VERSION ?= v1.47.0

.PHONY: operator-sdk
operator-sdk: $(OPERATOR_SDK) ## Download operator-sdk locally if necessary.
$(OPERATOR_SDK): $(LOCALBIN)
	@if [ ! -f "$(OPERATOR_SDK)" ]; then \
	  OS=$$(uname | awk '{print tolower($$0)}'); \
	  ARCH=$$(case $$(uname -m) in x86_64) echo amd64;; aarch64|arm64) echo arm64;; esac); \
	  echo "Downloading operator-sdk $(OPERATOR_SDK_VERSION) ($${OS}/$${ARCH})"; \
	  curl -sSLo "$(OPERATOR_SDK)" "https://github.com/operator-framework/operator-sdk/releases/download/$(OPERATOR_SDK_VERSION)/operator-sdk_$${OS}_$${ARCH}"; \
	  chmod +x "$(OPERATOR_SDK)"; \
	fi

.PHONY: opm
opm: $(OPM) ## Download opm locally if necessary.
$(OPM): $(LOCALBIN)
	@if [ ! -f "$(OPM)" ]; then \
	  OS=$$(uname | awk '{print tolower($$0)}'); \
	  ARCH=$$(case $$(uname -m) in x86_64) echo amd64;; aarch64|arm64) echo arm64;; esac); \
	  echo "Downloading opm $(OPM_VERSION) ($${OS}/$${ARCH})"; \
	  curl -sSLo "$(OPM)" "https://github.com/operator-framework/operator-registry/releases/download/$(OPM_VERSION)/$${OS}-$${ARCH}-opm"; \
	  chmod +x "$(OPM)"; \
	fi

.PHONY: bundle
bundle: manifests sync-bundle-crds sync-bundle-rbac ## Refresh bundle manifests from current source.

.PHONY: bundle-validate
bundle-validate: operator-sdk ## Validate the OLM bundle.
	$(OPERATOR_SDK) bundle validate ./bundle --select-optional suite=operatorframework

.PHONY: bundle-build
bundle-build: bundle bundle-validate ## Build the OLM bundle image.
	docker build -f bundle.Dockerfile -t $(BUNDLE_IMG) .

.PHONY: bundle-push
bundle-push: ## Push the OLM bundle image.
	docker push $(BUNDLE_IMG)

.PHONY: catalog-build
catalog-build: opm ## Build a single-bundle catalog image (FBC).
	$(OPM) index add --container-tool docker --mode semver --tag $(CATALOG_IMG) --bundles $(BUNDLE_IMG)

.PHONY: catalog-push
catalog-push: ## Push the catalog image.
	docker push $(CATALOG_IMG)

.PHONY: scorecard
scorecard: operator-sdk ## Run operator-sdk scorecard tests (requires a kind cluster).
	$(OPERATOR_SDK) scorecard bundle --wait-time 120s

.PHONY: verify-signing
verify-signing: ## Verify the latest published release is Cosign-signed and SBOM-attested.
	@VERSION=$$(gh release view --repo paperclipinc/hermes-operator --json tagName --jq .tagName); \
	IMAGE="ghcr.io/paperclipinc/hermes-operator:$${VERSION}"; \
	echo "Verifying $${IMAGE}..."; \
	cosign verify "$${IMAGE}" \
	  --certificate-identity-regexp 'https://github.com/paperclipinc/hermes-operator/.github/workflows/.*' \
	  --certificate-oidc-issuer https://token.actions.githubusercontent.com >/dev/null || { echo "::error::signature verification failed for $${IMAGE}"; exit 1; }; \
	echo "Verifying SBOM attestation..."; \
	cosign verify-attestation "$${IMAGE}" --type spdxjson \
	  --certificate-identity-regexp 'https://github.com/paperclipinc/hermes-operator/.github/workflows/.*' \
	  --certificate-oidc-issuer https://token.actions.githubusercontent.com >/dev/null || { echo "::error::SBOM attestation verification failed for $${IMAGE}"; exit 1; }; \
	echo "OK: $${IMAGE} is signed and SBOM-attested."