Makefile

# SPDX-FileCopyrightText: 2025 SAP SE or an SAP affiliate company and Gardener contributors
#
# SPDX-License-Identifier: Apache-2.0

ENSURE_GARDENER_MOD         := $(shell go get github.com/gardener/gardener@$$(go list -m -f "{{.Version}}" github.com/gardener/gardener))
ENSURE_GARDENER_TOOLS_MOD   := $(shell go get github.com/gardener/gardener/hack/tools@$$(go list -m -f "{{.Version}}" github.com/gardener/gardener/hack/tools))
GARDENER_HACK_DIR    		:= $(shell go list -m -f "{{.Dir}}" github.com/gardener/gardener)/hack
EXTENSION_PREFIX            := gardener-extension
NAME                        := provider-aws
ADMISSION_NAME              := admission-aws
REGISTRY                    := europe-docker.pkg.dev/gardener-project/public/gardener
IMAGE_PREFIX                := $(REGISTRY)/extensions
REPO_ROOT                   := $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))
HACK_DIR                    := $(REPO_ROOT)/hack
VERSION                     := $(shell cat "$(REPO_ROOT)/VERSION")
EFFECTIVE_VERSION           := $(VERSION)-$(shell git rev-parse HEAD)
LD_FLAGS                    := "-w $(shell bash $(GARDENER_HACK_DIR)/get-build-ld-flags.sh k8s.io/component-base $(REPO_ROOT)/VERSION $(EXTENSION_PREFIX))"
LEADER_ELECTION             := false
IGNORE_OPERATION_ANNOTATION := true

WEBHOOK_CONFIG_PORT	:= 8443
WEBHOOK_CONFIG_MODE	:= url
WEBHOOK_CONFIG_URL	:= host.docker.internal:$(WEBHOOK_CONFIG_PORT)
EXTENSION_NAMESPACE	:= garden
GARDEN_KUBECONFIG 	?=

TARGET_PLATFORMS    ?= linux/$(shell go env GOARCH)

WEBHOOK_PARAM := --webhook-config-url=$(WEBHOOK_CONFIG_URL)
ifeq ($(WEBHOOK_CONFIG_MODE), service)
  WEBHOOK_PARAM := --webhook-config-namespace=$(EXTENSION_NAMESPACE)
endif

REGION                 := eu-west-1
ACCESS_KEY_ID_FILE     := .kube-secrets/aws/access_key_id.secret
SECRET_ACCESS_KEY_FILE := .kube-secrets/aws/secret_access_key.secret
IT_LOGLEVEL := info
IT_USE_EXISTING_CLUSTER := false # set to true if you want to use an existing cluster for backupbucket integration tests

ifneq ($(strip $(shell git status --porcelain 2>/dev/null)),)
	EFFECTIVE_VERSION := $(EFFECTIVE_VERSION)-$(shell { git diff HEAD; git status --porcelain; } | sha256sum | cut -c1-8)-dirty
endif

#########################################
# Tools                                 #
#########################################

TOOLS_DIR := $(HACK_DIR)/tools
include $(GARDENER_HACK_DIR)/tools.mk

#########################################
# Rules for local development scenarios #
#########################################

.PHONY: start
start:
	@LEADER_ELECTION_NAMESPACE=$(EXTENSION_NAMESPACE) \
		GARDEN_KUBECONFIG=$(GARDEN_KUBECONFIG) \
		GARDENER_SHOOT_CLIENT="external" \
		go run \
		-ldflags $(LD_FLAGS) \
		./cmd/$(EXTENSION_PREFIX)-$(NAME) \
		--config-file=./example/00-componentconfig.yaml \
		--ignore-operation-annotation=$(IGNORE_OPERATION_ANNOTATION) \
		--leader-election=$(LEADER_ELECTION) \
		--webhook-config-server-host=0.0.0.0 \
		--webhook-config-server-port=$(WEBHOOK_CONFIG_PORT) \
		--webhook-config-mode=$(WEBHOOK_CONFIG_MODE) \
		--webhook-config-namespace=$(EXTENSION_NAMESPACE) \
		--gardener-version="v1.39.0" \
		--heartbeat-namespace=$(EXTENSION_NAMESPACE) \
		--heartbeat-renew-interval-seconds=30 \
		--webhook-config-service-port=443 \
		--metrics-bind-address=:8080 \
		--health-bind-address=:8081 \
		$(WEBHOOK_PARAM)

.PHONY: start-admission
start-admission:
	@LEADER_ELECTION_NAMESPACE=$(EXTENSION_NAMESPACE) go run \
		-ldflags $(LD_FLAGS) \
		./cmd/$(EXTENSION_PREFIX)-$(ADMISSION_NAME) \
		--webhook-config-server-host=0.0.0.0 \
		--webhook-config-server-port=$(WEBHOOK_CONFIG_PORT) \
		--webhook-config-mode=$(WEBHOOK_CONFIG_MODE) \
        $(WEBHOOK_PARAM)

.PHONY: hook-me
hook-me: $(KUBECTL)
	bash $(GARDENER_HACK_DIR)/hook-me.sh $(EXTENSION_PREFIX)-$(NAME) $$(kubectl get namespace -o custom-columns=NAME:.metadata.name | grep $(NAME) | head -n1) $(WEBHOOK_CONFIG_PORT)

#################################################################
# Rules related to binary build, Docker image build and release #
#################################################################

.PHONY: install
install:
	@LD_FLAGS=$(LD_FLAGS) EFFECTIVE_VERSION=$(EFFECTIVE_VERSION) \
	bash $(GARDENER_HACK_DIR)/install.sh ./...

BUILD_OUTPUT_FILE ?= .
BUILD_PACKAGES ?= ./...

.PHONY: build
build:
	@LD_FLAGS=$(LD_FLAGS) EFFECTIVE_VERSION=$(EFFECTIVE_VERSION) \
	bash $(GARDENER_HACK_DIR)/build.sh -o $(BUILD_OUTPUT_FILE) $(BUILD_PACKAGES)

.PHONY: docker-login
docker-login:
	@gcloud auth activate-service-account --key-file .kube-secrets/gcr/gcr-readwrite.json

.PHONY: docker-image-provider
docker-image-provider:
	@docker buildx build --load --platform=$(TARGET_PLATFORMS) --build-arg EFFECTIVE_VERSION=$(EFFECTIVE_VERSION) -t $(IMAGE_PREFIX)/$(NAME):$(VERSION) -t $(IMAGE_PREFIX)/$(NAME):latest -f Dockerfile -m 6g --target $(EXTENSION_PREFIX)-$(NAME) .

.PHONY: docker-image-admission
docker-image-admission:
	@docker buildx build --load --platform=$(TARGET_PLATFORMS) --build-arg EFFECTIVE_VERSION=$(EFFECTIVE_VERSION) -t $(IMAGE_PREFIX)/$(ADMISSION_NAME):$(VERSION) -t $(IMAGE_PREFIX)/$(ADMISSION_NAME):latest -f Dockerfile -m 6g --target $(EXTENSION_PREFIX)-$(ADMISSION_NAME) .

.PHONY: docker-images
docker-images: docker-image-provider docker-image-admission

.PHONY: docker-push-provider
docker-push-provider: $(KUBECTL)
	$(eval REGISTRY_URL := $(shell $(KUBECTL) cluster-info | head -1 | grep -oP 'https://\K[^:]+' | sed 's/^api\./reg./'))
	@docker tag $(IMAGE_PREFIX)/$(NAME):$(VERSION) $(REGISTRY_URL)/$(NAME):$(EFFECTIVE_VERSION)
	@docker push $(REGISTRY_URL)/$(NAME):$(EFFECTIVE_VERSION)

.PHONY: docker-push-admission
docker-push-admission: $(KUBECTL)
	$(eval REGISTRY_URL := $(shell $(KUBECTL) cluster-info | head -1 | grep -oP 'https://\K[^:]+' | sed 's/^api\./reg./'))
	@docker tag $(IMAGE_PREFIX)/$(ADMISSION_NAME):$(VERSION) $(REGISTRY_URL)/$(ADMISSION_NAME):$(EFFECTIVE_VERSION)
	@docker push $(REGISTRY_URL)/$(ADMISSION_NAME):$(EFFECTIVE_VERSION)

.PHONY: docker-push
docker-push: docker-push-provider docker-push-admission

.PHONY: helm-chart-provider
helm-chart-provider: $(HELM)
	@mkdir -p remote
	@$(HELM) package ./charts/$(EXTENSION_PREFIX)-$(NAME) --version $(EFFECTIVE_VERSION) --app-version $(EFFECTIVE_VERSION) --destination remote

.PHONY: helm-chart-admission
helm-chart-admission: $(HELM)
	@mkdir -p remote
	@$(HELM) package ./charts/$(EXTENSION_PREFIX)-$(ADMISSION_NAME)/charts/application --version $(EFFECTIVE_VERSION) --app-version $(EFFECTIVE_VERSION) --destination remote
	@$(HELM) package ./charts/$(EXTENSION_PREFIX)-$(ADMISSION_NAME)/charts/runtime --version $(EFFECTIVE_VERSION) --app-version $(EFFECTIVE_VERSION) --destination remote

.PHONY: helm-charts
helm-charts: helm-chart-provider helm-chart-admission

.PHONY: helm-push-provider
helm-push-provider: $(HELM) $(KUBECTL)
	$(eval REGISTRY_URL := $(shell $(KUBECTL) cluster-info | head -1 | grep -oP 'https://\K[^:]+' | sed 's/^api\./reg./'))
	@$(HELM) push remote/$(EXTENSION_PREFIX)-$(NAME)-$(EFFECTIVE_VERSION).tgz oci://$(REGISTRY_URL)

.PHONY: helm-push-admission
helm-push-admission: $(HELM) $(KUBECTL)
	$(eval REGISTRY_URL := $(shell $(KUBECTL) cluster-info | head -1 | grep -oP 'https://\K[^:]+' | sed 's/^api\./reg./'))
	@$(HELM) push remote/$(ADMISSION_NAME)-application-$(EFFECTIVE_VERSION).tgz oci://$(REGISTRY_URL)
	@$(HELM) push remote/$(ADMISSION_NAME)-runtime-$(EFFECTIVE_VERSION).tgz oci://$(REGISTRY_URL)

.PHONY: helm-push
helm-push: helm-push-provider helm-push-admission

.PHONY: extension-manifest
extension-manifest: $(KUBECTL) $(YQ)
	$(eval REGISTRY_URL := $(shell $(KUBECTL) cluster-info | head -1 | grep -oP 'https://\K[^:]+' | sed 's/^api\./reg./'))
	@mkdir -p remote
	@$(YQ) eval ".spec.deployment.admission.runtimeCluster.helm.ociRepository.ref = \"$(REGISTRY_URL)/$(ADMISSION_NAME)-runtime:$(EFFECTIVE_VERSION)\" | \
	          .spec.deployment.admission.runtimeCluster.helm.ociRepository.pullSecretRef.name = \"gardener-images\" | \
	          .spec.deployment.admission.virtualCluster.helm.ociRepository.ref = \"$(REGISTRY_URL)/$(ADMISSION_NAME)-application:$(EFFECTIVE_VERSION)\" | \
	          .spec.deployment.admission.virtualCluster.helm.ociRepository.pullSecretRef.name = \"gardener-images\" | \
	          .spec.deployment.extension.helm.ociRepository.ref = \"$(REGISTRY_URL)/$(EXTENSION_PREFIX)-$(NAME):$(EFFECTIVE_VERSION)\" | \
	          .spec.deployment.extension.helm.ociRepository.pullSecretRef.name = \"gardener-images\" | \
	          .spec.deployment.admission.values.image.repository = \"$(REGISTRY_URL)/$(ADMISSION_NAME)\" | \
	          .spec.deployment.admission.values.image.tag = \"$(EFFECTIVE_VERSION)\" | \
	          .spec.deployment.admission.values.image.pullPolicy = \"Always\" | \
	          .spec.deployment.extension.values.image.repository = \"$(REGISTRY_URL)/$(NAME)\" | \
	          .spec.deployment.extension.values.image.tag = \"$(EFFECTIVE_VERSION)\" | \
	          .spec.deployment.extension.values.image.pullPolicy = \"Always\" | \
	          .spec.deployment.extension.runtimeClusterValues.image.repository = \"$(REGISTRY_URL)/$(NAME)\" | \
	          .spec.deployment.extension.runtimeClusterValues.image.tag = \"$(EFFECTIVE_VERSION)\" | \
	          .spec.deployment.extension.runtimeClusterValues.image.pullPolicy = \"Always\"" \
	          example/extension.yaml > remote/extension.yaml
	@echo "Created remote/extension.yaml with registry $(REGISTRY_URL)"

.PHONY: extension-apply
extension-apply: $(KUBECTL)
	@$(KUBECTL) apply -f remote/extension.yaml

.PHONY: deploy-remote
deploy-remote: docker-images docker-push helm-charts helm-push extension-manifest extension-apply
	@echo "Successfully deployed extension to remote cluster"

#####################################################################
# Rules for verification, formatting, linting, testing and cleaning #
#####################################################################

.PHONY: tidy
tidy:
	@GO111MODULE=on go mod tidy
	@GARDENER_HACK_DIR=$(GARDENER_HACK_DIR) bash $(REPO_ROOT)/hack/update-github-templates.sh
	@cp $(GARDENER_HACK_DIR)/cherry-pick-pull.sh $(HACK_DIR)/cherry-pick-pull.sh && chmod +xw $(HACK_DIR)/cherry-pick-pull.sh

.PHONY: clean
clean:
	@$(shell find ./example -type f -name "controller-registration.yaml" -exec rm '{}' \;)
	@bash $(GARDENER_HACK_DIR)/clean.sh ./cmd/... ./pkg/... ./test/...

.PHONY: check-generate
check-generate:
	@bash $(GARDENER_HACK_DIR)/check-generate.sh $(REPO_ROOT)

.PHONY: check
check: $(GOIMPORTS) $(GOLANGCI_LINT)
	@REPO_ROOT=$(REPO_ROOT) bash $(GARDENER_HACK_DIR)/check.sh --golangci-lint-config=./.golangci.yaml ./cmd/... ./pkg/... ./test/...
	@REPO_ROOT=$(REPO_ROOT) bash $(GARDENER_HACK_DIR)/check-charts.sh ./charts

.PHONY: generate
generate: $(CONTROLLER_GEN) $(CRD_REF_DOCS) $(EXTENSION_GEN) $(HELM) $(KUSTOMIZE) $(MOCKGEN) $(YQ)
	@go mod download
	@REPO_ROOT=$(REPO_ROOT) GARDENER_HACK_DIR=$(GARDENER_HACK_DIR) bash $(GARDENER_HACK_DIR)/generate-sequential.sh ./charts/... ./cmd/... ./example/... ./pkg/...
	$(MAKE) format

.PHONY: format
format: $(GOIMPORTS) $(GOIMPORTSREVISER)
	@bash $(GARDENER_HACK_DIR)/format.sh ./cmd ./pkg ./test

.PHONY: sast
sast: $(GOSEC)
	@bash $(GARDENER_HACK_DIR)/sast.sh

.PHONY: sast-report
sast-report: $(GOSEC)
	@bash $(GARDENER_HACK_DIR)/sast.sh --gosec-report true

.PHONY: test
test:
	@bash $(GARDENER_HACK_DIR)/test.sh ./cmd/... ./pkg/...

.PHONY: test-cov
test-cov:
	@bash $(GARDENER_HACK_DIR)/test-cover.sh ./cmd/... ./pkg/...

.PHONY: test-clean
test-clean:
	@bash $(GARDENER_HACK_DIR)/test-cover-clean.sh

.PHONY: verify
verify: check format test sast

.PHONY: verify-extended
verify-extended: check-generate check format test-cov test-clean sast-report

.PHONY: integration-test-infra
integration-test-infra:
	@go test -timeout=0 ./test/integration/infrastructure \
		--v -ginkgo.v -ginkgo.progress \
		--kubeconfig=${KUBECONFIG} \
		--access-key-id='$(shell cat $(ACCESS_KEY_ID_FILE))' \
		--secret-access-key='$(shell cat $(SECRET_ACCESS_KEY_FILE))' \
		--region=$(REGION) \

.PHONY: integration-test-bastion
integration-test-bastion:
	@go test -timeout=0 ./test/integration/bastion \
		--v -ginkgo.v -ginkgo.progress \
		--kubeconfig=${KUBECONFIG} \
		--access-key-id='$(shell cat $(ACCESS_KEY_ID_FILE))' \
		--secret-access-key='$(shell cat $(SECRET_ACCESS_KEY_FILE))' \
		--region=$(REGION)

.PHONY: integration-test-dnsrecord
integration-test-dnsrecord:
	@bash $(GARDENER_HACK_DIR)/test-integration.sh -timeout=0 ./test/integration/dnsrecord \
		--v -ginkgo.v -ginkgo.progress \
		--kubeconfig=${KUBECONFIG} \
		--access-key-id='$(shell cat $(ACCESS_KEY_ID_FILE))' \
		--secret-access-key='$(shell cat $(SECRET_ACCESS_KEY_FILE))'

.PHONY: integration-test-backupbucket
integration-test-backupbucket:
	@go test -timeout=0 ./test/integration/backupbucket \
		--v -ginkgo.v -ginkgo.show-node-events \
		--kubeconfig=${KUBECONFIG} \
		--access-key-id='$(shell cat $(ACCESS_KEY_ID_FILE))' \
		--secret-access-key='$(shell cat $(SECRET_ACCESS_KEY_FILE))' \
		--region=$(REGION) \
		--use-existing-cluster=$(IT_USE_EXISTING_CLUSTER) \
		--log-level=$(IT_LOGLEVEL)