Makefile

# Image URL to use all building/pushing image targets
IMG ?= falcosecurity/falco-operator:latest
RELEASE ?= $(shell git describe --tags --abbrev=0 2>/dev/null || echo v0.0.0-dev)
COMMIT ?= $(shell git rev-parse HEAD)
BUILD_DATE ?= $(shell date -u +'%Y-%m-%dT%H:%M:%SZ')
OPERATOR ?= instance
PROJECT ?= github.com/falcosecurity/falco-operator
ARTIFACT_OPERATOR_IMAGE ?= docker.io/falcosecurity/artifact-operator:latest

IMG_INSTANCE ?= falco-operator:dev
IMG_ARTIFACT ?= artifact-operator:dev
chart ?= chart/falco-operator

include hack/make/tools.mk
include hack/make/cluster.mk

# SED_INPLACE defines the sed in-place flag based on the OS.
# macOS requires an empty string argument after -i, while Linux does not.
ifeq ($(shell uname -s),Darwin)
SED_INPLACE := sed -i ''
else
SED_INPLACE := sed -i
endif

# CONTAINER_TOOL defines the container tool to be used for building images.
# Be aware that the target commands are only tested with Docker which is
# scaffolded by default. However, you might want to replace it to use other
# tools. (i.e. podman)
CONTAINER_TOOL ?= docker

# Setting SHELL to bash allows bash commands to be executed by recipes.
# Options are set to exit when a recipe line exits non-zero or a piped command fails.
SHELL = /usr/bin/env bash -o pipefail
.SHELLFLAGS = -ec

.PHONY: all
all: build

##@ General

# The help target prints out all targets with their descriptions organized
# beneath their categories. The categories are represented by '##@' and the
# target descriptions by '##'. The awk command is responsible for reading the
# entire set of makefiles included in this invocation, looking for lines of the
# file as xyz: ## something, and then pretty-format the target and help. Then,
# if there's a line with ##@ something, that gets pretty-printed as a category.
# More info on the usage of ANSI control characters for terminal formatting:
# https://en.wikipedia.org/wiki/ANSI_escape_code#SGR_parameters
# More info on the awk command:
# http://linuxcommand.org/lc3_adv_awk.php

.PHONY: help
help: ## Display this help.
	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9.-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)

##@ Development

.PHONY: manifests
manifests: ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
	$(CONTROLLER_GEN) rbac:roleName=falco-operator-role crd:generateEmbeddedObjectMeta=true paths="./..." output:crd:artifacts:config=chart/falco-operator/crds output:rbac:stdout | sed -n '/^rules:/,$$p' > chart/falco-operator/files/ClusterRole.yaml

.PHONY: chart.docs
chart.docs: ## Generate Helm chart README.
	$(HELM_DOCS) -c ./$(chart) -t ./README.gotmpl -o ./README.md

.PHONY: chart.docs.check
chart.docs.check: chart.docs ## Verify Helm chart README is up to date.
	git diff --exit-code -- $(chart)/README.md

.PHONY: chart.lint
chart.lint: helm ## Lint the Helm chart.
	$(HELM) lint $(chart)

.PHONY: chart.template
chart.template: helm ## Render the Helm chart.
	$(HELM) template falco-operator $(chart) --namespace falco-operator --include-crds

.PHONY: chart.check
chart.check: chart.lint chart.template chart.docs.check ## Verify the Helm chart.

.PHONY: generate
generate: ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
	$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."

.PHONY: fmt
fmt: ## Run go fmt against code.
	go mod tidy
	go fmt ./...
	find . -type f -name '*.go' ! -path './zz_generated*' -a ! -exec grep -q '// Code generated by' {} \; -exec $(GCI) write -s standard -s default -s "prefix(github.com/falcosecurity/falco-operator)" {} \;
	find . -type f -name '*.go' ! -path './zz_generated*' -a ! -exec grep -q '// Code generated by' {} \; -exec $(ADDLICENSE) -l apache -s -c "(C) The Falco Authors" {} \;
	find . -type f -name '*.go' ! -path './zz_generated*' -a ! -exec grep -q '// Code generated by' {} \; -exec $(SED_INPLACE) -E 's|// Copyright ([0-9]{4}) \(C\) The Falco Authors|// Copyright (C) \1 The Falco Authors|' {} +

.PHONY: vet
vet: ## Run go vet against code.
	go vet ./...

.PHONY: deadcode
deadcode: ## Report functions unreachable from any binary entry point (cmd/).
	$(DEADCODE) ./cmd/...

.PHONY: test
test: manifests generate fmt vet ## Run tests.
	KUBEBUILDER_ASSETS="$(shell $(SETUP_ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" go test $$(go list ./... | grep -v /e2e) -coverprofile cover.out

.PHONY: test.e2e
test.e2e: manifests generate fmt vet cluster.create ## Run the e2e tests. Creates the local dev cluster (see hack/make/cluster.mk) if it doesn't already exist.
	go test ./test/e2e/ -v -ginkgo.v

.PHONY: registry.setup
registry.setup: kubectl falcoctl ## Deploy the local OCI registry and push test artifacts. Requires a running cluster.
	$(KUBECTL) apply -f hack/oci-test-artifacts/registry.yaml
	PATH="$(LOCALBIN):$$PATH" bash hack/oci-test-artifacts/setup-oci-artifacts.sh

# CHAINSAW_ARTIFACT_OPERATOR_IMAGE defaults to IMG_ARTIFACT (the same dev image cluster.load.artifact
# builds/loads) so tests actually use what's already in the cluster. CHAINSAW_FALCO_IMAGE defaults
# to the real, official Falco image at FALCO_VERSION (hack/make/versions.mk) — Falco itself isn't
# built by this repo, so there's no local dev equivalent to point at.
CHAINSAW_FALCO_IMAGE ?= docker.io/falcosecurity/falco:$(FALCO_VERSION)
CHAINSAW_ARTIFACT_OPERATOR_IMAGE ?= $(IMG_ARTIFACT)

.PHONY: test.chainsaw
test.chainsaw: chainsaw ## Run chainsaw e2e tests. Requires a running cluster with falco-operator deployed and KWOK installed (see `make kwok.install`).
	CHAINSAW_FALCO_IMAGE=$(CHAINSAW_FALCO_IMAGE) CHAINSAW_ARTIFACT_OPERATOR_IMAGE=$(CHAINSAW_ARTIFACT_OPERATOR_IMAGE) \
		$(CHAINSAW) test ./test/e2e/chainsaw/ --quiet --config ./test/e2e/chainsaw/.chainsaw.yaml --repeat-count 1

.PHONY: lint
lint: ## Run golangci-lint linter
	$(GOLANGCI_LINT) run --new-from-rev main

.PHONY: lint.fix
lint.fix: ## Run golangci-lint linter and perform fixes
	$(GOLANGCI_LINT) run --fix

.PHONY: lint.config
lint.config: ## Verify golangci-lint linter configuration
	$(GOLANGCI_LINT) config verify

.PHONY: kube-static-scheme-parser.update
kube-static-scheme-parser.update: ## Update the kube-static-structs parser
	hack/update-kube-static-scheme-parser.sh
##@ Build

.PHONY: build
build: manifests generate fmt vet ## Build manager binaries.
	go build -o bin/instance-operator ./cmd/instance
	go build -o bin/artifact-operator ./cmd/artifact

.PHONY: run
run: manifests generate fmt vet ## Run a controller from your host.
	go run ./cmd/instance --artifact-operator-image=$(IMG_ARTIFACT)

GOARCH ?= $(shell go env GOARCH)
.PHONY: docker.binaries
docker.binaries: ## Build Go binaries for Docker image.
	CGO_ENABLED=0 GOOS=linux GOARCH=$(GOARCH) go build -ldflags \
		"-s -w \
		-X '$(PROJECT)/internal/pkg/version.SemVersion=$(RELEASE)' \
		-X '$(PROJECT)/internal/pkg/version.GitCommit=$(COMMIT)' \
		-X '$(PROJECT)/internal/pkg/version.BuildDate=$(BUILD_DATE)' \
		-X '$(PROJECT)/internal/pkg/version.ArtifactOperatorImage=$(ARTIFACT_OPERATOR_IMAGE)'" \
		-o bin/linux/$(GOARCH)/manager ./cmd/$(OPERATOR)/main.go
	chmod 755 bin/linux/$(GOARCH)/manager

.PHONY: docker.build
docker.build: docker.binaries ## Build docker image with the manager.
	$(CONTAINER_TOOL) build \
		-t ${IMG} \
		-f build/Dockerfile .

# ARTIFACT_OPERATOR_IMAGE is baked into the instance operator's binary at build time
# (internal/pkg/version.ArtifactOperatorImage) — it's what the instance operator injects into
# every Falco pod's sidecar spec, so it must match IMG_ARTIFACT below.
.PHONY: docker.build.instance
docker.build.instance: ## Build the instance operator's docker image (IMG_INSTANCE).
	$(MAKE) docker.build OPERATOR=instance IMG=$(IMG_INSTANCE) ARTIFACT_OPERATOR_IMAGE=$(IMG_ARTIFACT)

.PHONY: docker.build.artifact
docker.build.artifact: ## Build the artifact operator's docker image (IMG_ARTIFACT).
	$(MAKE) docker.build OPERATOR=artifact IMG=$(IMG_ARTIFACT)

.PHONY: docker.push
docker.push: ## Push docker image with the manager.
	$(CONTAINER_TOOL) push ${IMG}

# PLATFORMS defines the target platforms for the manager image be built to provide support to multiple
# architectures. (i.e. make docker.buildx IMG=myregistry/mypoperator:0.0.1). To use this option you need to:
# - be able to use docker buildx. More info: https://docs.docker.com/build/buildx/
# - have enabled BuildKit. More info: https://docs.docker.com/develop/develop-images/build_enhancements/
# - be able to push the image to your registry (i.e. if you do not set a valid value via IMG=<myregistry/image:<tag>> then the export will fail)
# To adequately provide solutions that are compatible with multiple platforms, you should consider using this option.
PLATFORMS ?= linux/arm64,linux/amd64
.PHONY: docker.buildx
docker.buildx: ## Build and push docker image for the manager for cross-platform support
	$(MAKE) docker.binaries GOARCH=amd64
	$(MAKE) docker.binaries GOARCH=arm64
	- $(CONTAINER_TOOL) buildx create --name falco-operator-builder
	$(CONTAINER_TOOL) buildx use falco-operator-builder
	- $(CONTAINER_TOOL) buildx build \
		--push \
		--platform=$(PLATFORMS) \
		--tag ${IMG} \
		-f build/Dockerfile .
	- $(CONTAINER_TOOL) buildx rm falco-operator-builder

.PHONY: installer.build
installer.build: manifests generate helm ## Generate a consolidated YAML with CRDs and deployment via Helm.
	mkdir -p dist
	@img="$(IMG)"; \
	$(HELM) template falco-operator chart/falco-operator --namespace falco-operator --include-crds --set image.repository="$${img%:*}" --set-string image.tag="$${img##*:}" > dist/install.yaml

##@ Deployment

ifndef ignore-not-found
  ignore-not-found = false
endif

.PHONY: install
install: manifests kubectl ## Install CRDs into the K8s cluster specified in ~/.kube/config.
	$(KUBECTL) apply --server-side=true --force-conflicts -f chart/falco-operator/crds/

.PHONY: uninstall
uninstall: kubectl ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
	$(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f chart/falco-operator/crds/

.PHONY: deploy.http
deploy.http: manifests helm ## Deploy the local chart with mTLS disabled (plain HTTP artifact server), using the local dev images (IMG_INSTANCE/IMG_ARTIFACT) by default.
	@img="$(IMG_INSTANCE)"; \
	$(HELM) upgrade --install falco-operator chart/falco-operator --namespace falco-operator --create-namespace \
		--set image.repository="$${img%:*}" --set-string image.tag="$${img##*:}" \
		--set-string extraEnv[0].name=ARTIFACT_OPERATOR_IMAGE,extraEnv[0].value=$(IMG_ARTIFACT) \
		--set mtls.enabled=false \
		--wait --timeout 180s

# The trust label must be applied before the chart's own artifact server can read the
# trust-manager Bundle-synced CA ConfigMap (see chart/falco-operator/values.yaml's
# mtls.trustLabel) — without it the operator pod sits in ContainerCreating.
.PHONY: deploy.mtls
deploy.mtls: manifests helm kubectl ## Deploy the local chart with mTLS enabled. Requires cert-manager/trust-manager already installed (see cert-manager.install/trust-manager.install, or cluster.up).
	$(KUBECTL) create namespace falco-operator --dry-run=client -o yaml | $(KUBECTL) apply -f -
	$(KUBECTL) label namespace falco-operator artifact.falcosecurity.dev/trust=true --overwrite
	@img="$(IMG_INSTANCE)"; \
	$(HELM) upgrade --install falco-operator chart/falco-operator --namespace falco-operator --create-namespace \
		--set image.repository="$${img%:*}" --set-string image.tag="$${img##*:}" \
		--set-string extraEnv[0].name=ARTIFACT_OPERATOR_IMAGE,extraEnv[0].value=$(IMG_ARTIFACT) \
		--set mtls.enabled=true \
		--wait --timeout 180s
	$(KUBECTL) wait -n falco-operator certificate/falco-operator-artifact-server-tls --for=condition=Ready --timeout=90s

.PHONY: undeploy
undeploy: helm ## Undeploy operator from the K8s cluster specified in ~/.kube/config via Helm.
	$(HELM) uninstall falco-operator --namespace falco-operator --ignore-not-found

##@ Dependencies

## Tool Versions
#ENVTEST_K8S_VERSION is the version of Kubernetes to use for setting up ENVTEST binaries (i.e. 1.31)
ENVTEST_K8S_VERSION ?= $(shell go list -m -f "{{ .Version }}" k8s.io/api | awk -F'[v.]' '{printf "1.%d", $$3}')