forked from kubernetes-sigs/security-profiles-operator
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Makefile
574 lines (477 loc) · 21.1 KB
/
Makefile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
# Copyright 2020 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
GO ?= go
GOLANGCI_LINT_VERSION = v1.49.0
REPO_INFRA_VERSION = v0.2.5
KUSTOMIZE_VERSION = 4.5.5
OPERATOR_SDK_VERSION ?= v1.25.0
CONTROLLER_GEN_CMD := CGO_LDFLAGS= $(GO) run -tags generate sigs.k8s.io/controller-tools/cmd/controller-gen
PROJECT := security-profiles-operator
BUILD_DIR := build
APPARMOR_ENABLED ?= 1
BPF_ENABLED ?= 1
BPFTOOL ?= bpftool
CLANG ?= clang
LLVM_STRIP ?= llvm-strip
BPF_PATH := internal/pkg/daemon/bpfrecorder/bpf
ARCH ?= $(shell uname -m | \
sed 's/x86_64/x86/' | \
sed 's/aarch64/arm64/' | \
sed 's/ppc64le/powerpc/' | \
sed 's/mips.*/mips/')
INCLUDES := -I$(BUILD_DIR)
DATE_FMT = +'%Y-%m-%dT%H:%M:%SZ'
ifdef SOURCE_DATE_EPOCH
BUILD_DATE ?= $(shell date -u -d "@$(SOURCE_DATE_EPOCH)" "$(DATE_FMT)" 2>/dev/null || date -u -r "$(SOURCE_DATE_EPOCH)" "$(DATE_FMT)" 2>/dev/null || date -u "$(DATE_FMT)")
else
BUILD_DATE ?= $(shell date -u "$(DATE_FMT)")
endif
VERSION := $(shell cat VERSION)
ifneq ($(shell uname -s), Darwin)
BUILDTAGS := netgo osusergo seccomp
CGO_LDFLAGS=-lseccomp
else
BUILDTAGS := netgo osusergo
APPARMOR_ENABLED = 0
BPF_ENABLED = 0
endif
ifneq ($(shell uname -s), Darwin)
LINT_BUILDTAGS := e2e,netgo,osusergo,seccomp,-tools
else
LINT_BUILDTAGS := e2e,netgo,osusergo,-tools
endif
ifneq ($(shell uname -s), Darwin)
OS := linux
else
OS := darwin
endif
ifeq ($(APPARMOR_ENABLED), 1)
BUILDTAGS := $(BUILDTAGS) apparmor
LINT_BUILDTAGS := $(LINT_BUILDTAGS),apparmor
endif
ifeq ($(BPF_ENABLED), 1)
CGO_LDFLAGS := $(CGO_LDFLAGS) -lelf -lz -lbpf
else
BUILDTAGS := $(BUILDTAGS) no_bpf
endif
export CGO_LDFLAGS
export CGO_ENABLED=1
BUILD_FILES := $(shell find . -type f -name '*.go' -or -name '*.mod' -or -name '*.sum' -not -name '*_test.go')
export GOFLAGS?=-mod=vendor
GO_PROJECT := sigs.k8s.io/$(PROJECT)
LDVARS := \
-X $(GO_PROJECT)/internal/pkg/version.buildDate=$(BUILD_DATE) \
-X $(GO_PROJECT)/internal/pkg/version.version=$(VERSION)
LINKMODE_EXTERNAL ?= yes
ifeq ($(LINKMODE_EXTERNAL), yes)
LDFLAGS := -s -w -linkmode external -extldflags "-static" $(LDVARS)
else
LDFLAGS := -s -w -extldflags "-static" $(LDVARS)
endif
export CONTAINER_RUNTIME ?= $(if $(shell which podman 2>/dev/null),podman,docker)
ifeq ($(CONTAINER_RUNTIME), podman)
LOGIN_PUSH_OPTS="--tls-verify=false"
else ifeq ($(CONTAINER_RUNTIME), docker)
LOGIN_PUSH_OPTS=
endif
IMAGE ?= $(PROJECT):latest
CRD_OPTIONS ?= "crd:crdVersions=v1"
export E2E_CLUSTER_TYPE ?= kind
DOCKERFILE ?= Dockerfile
# Utility targets
all: $(BUILD_DIR)/$(PROJECT) ## Build the security-profiles-operator binary
.PHONY: help
help: ## Display this help
@awk \
-v "col=${COLOR}" -v "nocol=${NOCOLOR}" \
' \
BEGIN { \
FS = ":.*##" ; \
printf "Available targets:\n"; \
} \
/^[a-zA-Z0-9_-]+:.*?##/ { \
printf " %s%-25s%s %s\n", col, $$1, nocol, $$2 \
} \
/^##@/ { \
printf "\n%s%s%s\n", col, substr($$0, 5), nocol \
} \
' $(MAKEFILE_LIST)
$(BUILD_DIR):
mkdir -p $(BUILD_DIR)
$(BUILD_DIR)/$(PROJECT): $(BUILD_DIR) $(BUILD_FILES)
$(GO) build -trimpath -ldflags '$(LDFLAGS)' -tags '$(BUILDTAGS)' -o $@ ./cmd/security-profiles-operator
.PHONY: clean
clean: ## Clean the build directory
rm -rf $(BUILD_DIR)
.PHONY: $(BUILD_DIR)/kustomize
$(BUILD_DIR)/kustomize: $(BUILD_DIR)
if [ ! -f $@ ]; then \
export URL=https://raw.githubusercontent.com/kubernetes-sigs/kustomize && \
curl -sfL $$URL/master/hack/install_kustomize.sh \
| bash -s $(KUSTOMIZE_VERSION) $(PWD)/$(BUILD_DIR); \
fi
$(BUILD_DIR)/kubernetes-split-yaml: $(BUILD_DIR)
$(call go-build,./vendor/github.com/mogensen/kubernetes-split-yaml)
.PHONY: deployments
deployments: $(BUILD_DIR)/kustomize manifests generate ## Generate the deployment files with kustomize
$(BUILD_DIR)/kustomize build --reorder=none deploy/overlays/cluster -o deploy/operator.yaml
$(BUILD_DIR)/kustomize build --reorder=none deploy/overlays/namespaced -o deploy/namespace-operator.yaml
$(BUILD_DIR)/kustomize build --reorder=none deploy/overlays/openshift-dev -o deploy/openshift-dev.yaml
$(BUILD_DIR)/kustomize build --reorder=none deploy/overlays/helm -o deploy/helm/templates/static-resources.yaml
$(BUILD_DIR)/kustomize build --reorder=none deploy/base-crds -o deploy/helm/crds/crds.yaml
$(BUILD_DIR)/kustomize build --reorder=legacy deploy/overlays/webhook -o deploy/webhook-operator.yaml
.PHONY: image
image: ## Build the container image
$(CONTAINER_RUNTIME) build -f $(DOCKERFILE) --build-arg version=$(VERSION) -t $(IMAGE) .
.PHONY: image-arm64
image-arm64: ## Build the container image for arm64
$(CONTAINER_RUNTIME) build -f $(DOCKERFILE) \
--build-arg version=$(VERSION) \
--build-arg target=nix/default-arm64.nix \
-t $(IMAGE) .
.PHONY: image-cross
image-cross: ## Build and push the container image manifest
hack/image-cross.sh
.PHONY: nix
nix: ## Build the binary via nix for the current system
nix-build nix
.PHONY: nix-arm64
nix-arm64: ## Build the binary via nix for arm64
nix-build nix/default-arm64.nix
.PHONY: update-nixpkgs
update-nixpkgs: ## Update the pinned nixpkgs to the latest master
@nix run -f channel:nixpkgs-unstable nix-prefetch-git -- \
--no-deepClone https://github.com/nixos/nixpkgs > nix/nixpkgs.json
.PHONY: update-go-mod
update-go-mod: ## Cleanup, vendor and verify go modules
export GO111MODULE=on && \
$(GO) mod tidy && \
$(GO) mod vendor && \
$(GO) mod verify
.PHONY: update-mocks
update-mocks: ## Update all generated mocks
$(GO) generate ./...
for f in $(shell find . -path ./vendor -prune -false -o -name fake_*.go); do \
cp hack/boilerplate/boilerplate.generatego.txt tmp ;\
cat $$f >> tmp ;\
mv tmp $$f ;\
done
export BPF_IMPL=internal/pkg/daemon/bpfrecorder/bpfrecorderfakes/fake_impl.go && \
printf "//go:build linux && !no_bpf\n// +build linux,!no_bpf\n\n" | \
cat - $$BPF_IMPL | \
tee $$BPF_IMPL >/dev/null
define go-build
CGO_LDFLAGS= $(GO) build -o $(BUILD_DIR)/$(shell basename $(1)) $(1)
@echo > /dev/null
endef
$(BUILD_DIR)/protoc-gen-go-grpc: $(BUILD_DIR)
$(call go-build,./vendor/google.golang.org/grpc/cmd/protoc-gen-go-grpc)
$(BUILD_DIR)/protoc-gen-go: $(BUILD_DIR)
$(call go-build,./vendor/google.golang.org/protobuf/cmd/protoc-gen-go)
.PHONY: update-proto
update-proto: $(BUILD_DIR)/protoc-gen-go $(BUILD_DIR)/protoc-gen-go-grpc ## Update GRPC server protocol definitions
for PROTO in \
api/grpc/metrics \
api/grpc/enricher \
api/grpc/bpfrecorder \
; do \
PATH=$(BUILD_DIR):$$PATH \
protoc \
--go_out=. \
--go_opt=paths=source_relative \
--go-grpc_out=. \
--go-grpc_opt=paths=source_relative \
$$PROTO/api.proto ;\
done
define vagrant-up
if [ ! -f image.tar ]; then \
make image IMAGE=$(IMAGE) && \
$(CONTAINER_RUNTIME) save -o image.tar $(IMAGE); \
fi
ln -sf hack/ci/Vagrantfile-$(1) Vagrantfile
# Retry in case provisioning failed because of some temporarily unavailable
# remote resource (like the VM image)
vagrant up
endef
.PHONY: vagrant-up-fedora
vagrant-up-fedora: ## Boot the Vagrant Fedora based test VM
$(call vagrant-up,fedora)
.PHONY: vagrant-up-ubuntu
vagrant-up-ubuntu: ## Boot the Vagrant Ubuntu based test VM
$(call vagrant-up,ubuntu)
.PHONY: vagrant-up-flatcar
vagrant-up-flatcar: ## Boot the Vagrant Flatcar based test VM
$(call vagrant-up,flatcar)
$(BUILD_DIR)/mdtoc: $(BUILD_DIR)
$(call go-build,./vendor/sigs.k8s.io/mdtoc)
.PHONY: update-toc
update-toc: $(BUILD_DIR)/mdtoc ## Update the table of contents for the documentation
$(BUILD_DIR)/mdtoc --inplace installation-usage.md
$(BUILD_DIR)/recorder.bpf.o: $(BUILD_DIR) ## Build the BPF module
$(CLANG) -g -O2 \
-target bpf \
-D__TARGET_ARCH_$(ARCH) \
$(CFLAGS) \
-I ./internal/pkg/daemon/bpfrecorder/vmlinux/$(ARCH) \
-c $(BPF_PATH)/recorder.bpf.c \
-o $@
$(LLVM_STRIP) -g $@
.PHONY: update-vmlinux
update-vmlinux: ## Generate the vmlinux.h required for building the BPF modules.
./hack/update-vmlinux
.PHONY: update-btf
update-btf: update-bpf ## Build and update all generated BTF code for supported kernels
./hack/update-btf
.PHONY: update-bpf
update-bpf: $(BUILD_DIR) ## Build and update all generated BPF code with nix
for arch in amd64 arm64; do \
nix-build nix/default-bpf-$$arch.nix ;\
cp -f result/recorder.bpf.o $(BUILD_DIR)/recorder.bpf.o.$$arch ;\
done
chmod 0644 $(BUILD_DIR)/recorder.bpf.o.*
$(GO) run ./internal/pkg/daemon/bpfrecorder/generate
# Verification targets
.PHONY: verify
verify: verify-boilerplate verify-go-mod verify-go-lint verify-deployments verify-dependencies verify-toc verify-mocks ## Run all verification targets
.PHONY: verify-boilerplate
verify-boilerplate: $(BUILD_DIR)/verify_boilerplate.py ## Verify the boilerplate headers for all files
$(BUILD_DIR)/verify_boilerplate.py \
--boilerplate-dir hack/boilerplate \
--skip api/grpc/metrics/api_grpc.pb.go \
--skip api/grpc/enricher/api_grpc.pb.go \
--skip api/grpc/bpfrecorder/api_grpc.pb.go \
--skip api/grpc/bpfrecorder/api.pb.go \
--skip api/grpc/enricher/api.pb.go \
--skip api/grpc/metrics/api.pb.go \
--skip api/apparmorprofile/v1alpha1/zz_generated.deepcopy.go \
--skip api/profilebinding/v1alpha1/zz_generated.deepcopy.go \
--skip api/profilerecording/v1alpha1/zz_generated.deepcopy.go \
--skip api/seccompprofile/v1beta1/zz_generated.deepcopy.go \
--skip api/secprofnodestatus/v1alpha1/zz_generated.deepcopy.go \
--skip api/selinuxprofile/v1alpha2/zz_generated.deepcopy.go \
--skip api/spod/v1alpha1/zz_generated.deepcopy.go \
--skip internal/pkg/daemon/bpfrecorder/bpfrecorderfakes/fake_impl.go \
--skip internal/pkg/daemon/enricher/enricherfakes/fake_impl.go \
--skip internal/pkg/daemon/metrics/metricsfakes/fake_impl.go \
--skip internal/pkg/nonrootenabler/nonrootenablerfakes/fake_impl.go \
--skip internal/pkg/webhooks/binding/bindingfakes/fake_impl.go \
--skip internal/pkg/webhooks/recording/recordingfakes/fake_impl.go \
--skip internal/pkg/daemon/profilerecorder/profilerecorderfakes/fake_impl.go
$(BUILD_DIR)/verify_boilerplate.py: $(BUILD_DIR)
curl -sfL https://raw.githubusercontent.com/kubernetes/repo-infra/$(REPO_INFRA_VERSION)/hack/verify_boilerplate.py \
-o $(BUILD_DIR)/verify_boilerplate.py
chmod +x $(BUILD_DIR)/verify_boilerplate.py
.PHONY: verify-go-mod
verify-go-mod: update-go-mod ## Verify the go modules
hack/tree-status
.PHONY: verify-deployments
verify-deployments: deployments ## Verify the generated deployments
hack/tree-status
.PHONY: verify-go-lint
verify-go-lint: $(BUILD_DIR)/golangci-lint ## Verify the golang code by linting
GL_DEBUG=gocritic $(BUILD_DIR)/golangci-lint run --build-tags $(LINT_BUILDTAGS)
$(BUILD_DIR)/golangci-lint:
export \
VERSION=$(GOLANGCI_LINT_VERSION) \
URL=https://raw.githubusercontent.com/golangci/golangci-lint \
BINDIR=$(BUILD_DIR) && \
curl -sfL $$URL/$$VERSION/install.sh | sh -s $$VERSION
$(BUILD_DIR)/golangci-lint version
$(BUILD_DIR)/golangci-lint linters
.PHONY: verify-dependencies
verify-dependencies: $(BUILD_DIR)/zeitgeist ## Verify external dependencies
$(BUILD_DIR)/zeitgeist validate --local-only --base-path . --config dependencies.yaml
$(BUILD_DIR)/zeitgeist: $(BUILD_DIR)
$(call go-build,./vendor/sigs.k8s.io/zeitgeist)
.PHONY: verify-toc
verify-toc: update-toc ## Verify the table of contents for the documentation
hack/tree-status
.PHONY: verify-mocks
verify-mocks: update-mocks ## Verify the content of the generated mocks
hack/tree-status
.PHONY: verify-bpf
verify-bpf: update-bpf ## Verify the generated bpf code
hack/tree-status
.PHONY: verify-btf
verify-btf: update-btf ## Verify the generated btf code
git diff
# Test targets
.PHONY: test-unit
test-unit: $(BUILD_DIR) ## Run the unit tests
# remove all coverage files if exists
rm -rf *.out
# run the go tests and gen the file coverage-all used to do the integration with coverrals.io
$(GO) test -ldflags '$(LDVARS)' -tags '$(BUILDTAGS)' -race -v -test.coverprofile=$(BUILD_DIR)/coverage.out ./internal/...
$(GO) tool cover -html $(BUILD_DIR)/coverage.out -o $(BUILD_DIR)/coverage.html
.PHONY: test-e2e
test-e2e: ## Run the end-to-end tests
CGO_LDFLAGS= \
E2E_SKIP_FLAKY_TESTS=true \
$(GO) test -parallel 1 -timeout 60m -count=1 ./test/... -v
.PHONY: test-flaky-e2e
test-flaky-e2e: ## Only run the flaky end-to-end tests
CGO_LDFLAGS= \
E2E_SKIP_FLAKY_TESTS=false \
$(GO) test -parallel 1 -timeout 20m -count=1 ./test/... -v -testify.m '^(TestSecurityProfilesOperator_Flaky)$$'
# Generate CRD manifests
manifests: $(BUILD_DIR)/kubernetes-split-yaml $(BUILD_DIR)/kustomize
./hack/sort-crds.sh "$(CONTROLLER_GEN_CMD) $(CRD_OPTIONS) paths='./api/spod/...' output:crd:stdout" "deploy/base-crds/crds/securityprofilesoperatordaemon.yaml"
./hack/sort-crds.sh "$(CONTROLLER_GEN_CMD) $(CRD_OPTIONS) paths='./api/secprofnodestatus/...' output:crd:stdout" "deploy/base-crds/crds/securityprofilenodestatus.yaml"
./hack/sort-crds.sh "$(CONTROLLER_GEN_CMD) $(CRD_OPTIONS) paths='./api/seccompprofile/...' output:crd:stdout" "deploy/base-crds/crds/seccompprofile.yaml"
./hack/sort-crds.sh "$(CONTROLLER_GEN_CMD) $(CRD_OPTIONS) paths='./api/selinuxprofile/...' output:crd:stdout" "deploy/base-crds/crds/selinuxpolicy.yaml"
./hack/sort-crds.sh "$(CONTROLLER_GEN_CMD) $(CRD_OPTIONS) paths='./api/profilebinding/...' output:crd:stdout" "deploy/base-crds/crds/profilebinding.yaml"
./hack/sort-crds.sh "$(CONTROLLER_GEN_CMD) $(CRD_OPTIONS) paths='./api/profilerecording/...' output:crd:stdout" "deploy/base-crds/crds/profilerecording.yaml"
# Generate deepcopy code
generate:
$(CONTROLLER_GEN_CMD) object:headerFile="hack/boilerplate/boilerplate.go.txt",year=$(shell date -u "+%Y") paths="./api/..."
$(CONTROLLER_GEN_CMD) rbac:roleName=security-profiles-operator paths="./internal/pkg/manager/..." output:rbac:stdout > deploy/base/role.yaml
$(CONTROLLER_GEN_CMD) rbac:roleName=spod paths="./internal/pkg/daemon/..." output:rbac:stdout >> deploy/base/role.yaml
$(CONTROLLER_GEN_CMD) rbac:roleName=spo-webhook paths="./internal/pkg/webhooks/..." output:rbac:stdout >> deploy/base/role.yaml
## Bundle packaging begins here
## read more at https://sdk.operatorframework.io/docs/olm-integration/tutorial-bundle/
.PHONY: operator-sdk
OPERATOR_SDK = $(BUILD_DIR)/operator-sdk
operator-sdk: $(BUILD_DIR) ## Download sdk locally if necessary.
ifeq (,$(wildcard $(OPERATOR_SDK)))
ifeq (,$(shell which operator-sdk 2>/dev/null))
@{ \
set -e ;\
mkdir -p $(dir $(OPERATOR_SDK)) ;\
OS=$(shell go env GOOS) && ARCH=$(shell go env GOARCH) && \
curl -sSLo $(OPERATOR_SDK) https://github.com/operator-framework/operator-sdk/releases/download/${OPERATOR_SDK_VERSION}/operator-sdk_$${OS}_$${ARCH} ;\
chmod +x $(OPERATOR_SDK) ;\
}
else
OPERATOR_SDK = $(shell which operator-sdk)
endif
endif
# CHANNELS define the bundle channels used in the bundle.
# Add a new line here if you would like to change its default config. (E.g CHANNELS = "candidate,fast,stable")
# To re-generate a bundle for other specific channels without changing the standard setup, you can:
# - use the CHANNELS as arg of the bundle target (e.g make bundle CHANNELS=candidate,fast,stable)
# - use environment variables to overwrite this value (e.g export CHANNELS="candidate,fast,stable")
CHANNELS="stable"
ifneq ($(origin CHANNELS), undefined)
BUNDLE_CHANNELS := --channels=$(CHANNELS)
endif
# DEFAULT_CHANNEL defines the default channel used in the bundle.
# Add a new line here if you would like to change its default config. (E.g DEFAULT_CHANNEL = "stable")
# To re-generate a bundle for any other default channel without changing the default setup, you can:
# - use the DEFAULT_CHANNEL as arg of the bundle target (e.g make bundle DEFAULT_CHANNEL=stable)
# - use environment variables to overwrite this value (e.g export DEFAULT_CHANNEL="stable")
DEFAULT_CHANNEL="stable"
ifneq ($(origin DEFAULT_CHANNEL), undefined)
BUNDLE_DEFAULT_CHANNEL := --default-channel=$(DEFAULT_CHANNEL)
endif
BUNDLE_METADATA_OPTS ?= $(BUNDLE_CHANNELS) $(BUNDLE_DEFAULT_CHANNEL)
# BUNDLE_IMG defines the image:tag used for the bundle.
# You can use it as an arg. (E.g make bundle-build BUNDLE_IMG=<some-registry>/<project-name-bundle>:<tag>)
BUNDLE_IMG ?= $(PROJECT)-bundle:v$(VERSION)
# The operator manifest to include in the CSV. Defaults to the cluster-scoped
# operator. Can be only one
BUNDLE_OPERATOR_MANIFEST ?= deploy/operator.yaml
# These examples are added to the alm-examples annotation and subsequently
# displayed in the UI
OLM_EXAMPLES := \
examples/apparmorprofile.yaml \
examples/config.yaml \
examples/profilerecording-seccomp-bpf.yaml \
examples/profilebinding.yaml \
examples/rawselinuxprofile.yaml \
examples/seccompprofile.yaml \
examples/selinuxprofile.yaml
.PHONY: bundle
bundle: operator-sdk deployments ## Generate bundle manifests and metadata, then validate generated files.
sed -i "s/\(olm.skipRange: '>=.*\)<.*'/\1<$(VERSION)'/" deploy/base/clusterserviceversion.yaml
sed -i "s/\(\"name\": \"security-profiles-operator.v\).*\"/\1$(VERSION)\"/" deploy/catalog-preamble.json
sed -i "s/\(\"skipRange\": \">=.*\)<.*\"/\1<$(VERSION)\"/" deploy/catalog-preamble.json
cat $(OLM_EXAMPLES) $(BUNDLE_OPERATOR_MANIFEST) deploy/base/clusterserviceversion.yaml | $(OPERATOR_SDK) generate bundle -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS)
git restore deploy/base/clusterserviceversion.yaml
mkdir -p ./bundle/tests/scorecard
cp deploy/bundle-test-config.yaml ./bundle/tests/scorecard/config.yaml
$(OPERATOR_SDK) bundle validate ./bundle
.PHONY: bundle-build
bundle-build: ## Build the bundle image.
$(CONTAINER_RUNTIME) build -f bundle.Dockerfile -t $(BUNDLE_IMG) .
.PHONY: bundle-push
bundle-push: ## Push the bundle image.
$(CONTAINER_RUNTIME) push $(BUNDLE_IMG)
.PHONY: verify-bundle
verify-bundle: bundle ## Verify the bundle doesn't alter the state of the tree
hack/tree-status
.PHONY: opm
OPM = $(BUILD_DIR)/opm
opm: $(BUILD_DIR) ## Download opm locally if necessary.
ifeq (,$(wildcard $(OPM)))
ifeq (,$(shell which opm 2>/dev/null))
@{ \
set -e ;\
mkdir -p $(dir $(OPM)) ;\
OS=$(shell go env GOOS) && ARCH=$(shell go env GOARCH) && \
curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/$(OPERATOR_SDK_VERSION)/$${OS}-$${ARCH}-opm ;\
chmod +x $(OPM) ;\
}
else
OPM = $(shell which opm)
endif
endif
# A comma-separated list of bundle images (e.g. make catalog-build BUNDLE_IMGS=example.com/operator-bundle:v0.1.0,example.com/operator-bundle:v0.2.0).
# These images MUST exist in a registry and be pull-able.
BUNDLE_IMGS ?= $(BUNDLE_IMG)
# The image tag given to the resulting catalog image (e.g. make catalog-build CATALOG_IMG=example.com/operator-catalog:v0.2.0).
CATALOG_IMG ?= $(PROJECT)-catalog:v$(VERSION)
# Build a catalog image by adding bundle images to an empty catalog using the operator package manager tool, 'opm'.
# This target uses the file-based catalog format (https://olm.operatorframework.io/docs/reference/file-based-catalogs/)
.PHONY: catalog-build
catalog-build: opm ## Build a catalog image.
$(eval TMP_DIR := $(shell mktemp -d))
$(eval CATALOG_DOCKERFILE := $(TMP_DIR).Dockerfile)
cp deploy/catalog-preamble.json $(TMP_DIR)/security-profiles-operator-catalog.json
$(OPM) $(OPM_EXTRA_ARGS) render $(BUNDLE_IMGS) >> $(TMP_DIR)/security-profiles-operator-catalog.json
$(OPM) generate dockerfile $(TMP_DIR)
$(CONTAINER_RUNTIME) build -f $(CATALOG_DOCKERFILE) -t $(CATALOG_IMG)
rm -rf $(TMP_DIR) $(CATALOG_DOCKERFILE)
# Push the catalog image.
.PHONY: catalog-push
catalog-push: ## Push a catalog image.
$(CONTAINER_RUNTIME) push $(CATALOG_IMG)
## OpenShift-only
## These targets are meant to make development in OpenShift easier.
.PHONY: openshift-user
openshift-user:
ifeq ($(shell oc whoami 2> /dev/null),kube:admin)
$(eval OPENSHIFT_USER = kubeadmin)
else
$(eval OPENSHIFT_USER = $(shell oc whoami))
endif
.PHONY: set-openshift-image-params
set-openshift-image-params:
$(eval DOCKERFILE = Dockerfile.ubi)
.PHONY: push-openshift-dev
push-openshift-dev: set-openshift-image-params openshift-user image
@echo "Exposing the default route to the image registry"
@oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge
@echo "Pushing image $(IMAGE) to the image registry"
@IMAGE_REGISTRY_HOST=$$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}'); \
$(CONTAINER_RUNTIME) login $(LOGIN_PUSH_OPTS) -u $(OPENSHIFT_USER) -p $(shell oc whoami -t) $${IMAGE_REGISTRY_HOST}; \
$(CONTAINER_RUNTIME) push $(LOGIN_PUSH_OPTS) localhost/$(IMAGE) $${IMAGE_REGISTRY_HOST}/openshift/$(IMAGE)
.PHONY: do-deploy-openshift-dev
do-deploy-openshift-dev: $(BUILD_DIR)/kustomize
@echo "Deploying"
oc apply -f deploy/openshift-dev.yaml
@echo "Setting triggers to track image"
oc set triggers -n security-profiles-operator deployment/security-profiles-operator --from-image openshift/security-profiles-operator:latest -c security-profiles-operator
# Deploy for development into OpenShift
.PHONY: deploy-openshift-dev
deploy-openshift-dev: push-openshift-dev do-deploy-openshift-dev