Taskfile.yml

version: '3.7'

run: when_changed
output: prefixed

vars:
  PACKAGE: github.com/Azure/azure-service-operator/v2

  GENERATOR_APP: aso-gen
  GENERATOR_ROOT: v2/tools/generator/

  ASOCTL_APP: asoctl
  ASOCTL_ROOT: v2/tools/asoctl/

  CONTROLLER_APP: aso-controller
  CONTROLLER_ROOT: v2/
  CONTROLLER_OUTPUT:
    sh: 'realpath v2/config'

  TEST_RESOURCE_PREFIX: asotest
  TEST_LIVE_RESOURCE_PREFIX: asolivetest
  SCRIPTS_ROOT: ./scripts

  HEADER_FILE: 
    sh: 'realpath v2/boilerplate.go.txt'

  TEST_OUT:
    sh: 'realpath reports'

  VERSION: 
    # Version tags for the v2 controller must start with "v2", e.g. "v2.0.0-alpha.0".
    sh: "{{.SCRIPTS_ROOT}}/build-version.py v2"

  LATEST_VERSION_TAG: $(git describe --tags $(git rev-list --tags=v2* --max-count=1))

  VERSION_FLAGS: -ldflags "-X {{.PACKAGE}}/internal/version.BuildVersion={{.VERSION}}"

  CONTROLLER_DOCKER_IMAGE: azureserviceoperator:{{.VERSION}}
  PUBLIC_REGISTRY: mcr.microsoft.com/k8s/
  LOCAL_REGISTRY_CONTROLLER_DOCKER_IMAGE: localhost:5000/azureserviceoperator:latest

  CROSSPLANE_APP: crossplane-gen
  CROSSPLANE_ROOT: ./hack/crossplane/
  CROSSPLANE_OUTPUT:
    sh: 'realpath hack/crossplane/config'

  KUBE_RBAC_PROXY: gcr.io/kubebuilder/kube-rbac-proxy

  # how long to let tests against live resources run for
  LIVE_TEST_TIMEOUT: 3h

  ASO_NAMESPACE: azureserviceoperator-system

tasks:
  default:
    desc: Perform all fast local pre-commit tasks.
    deps:
    - generator:quick-checks
    - controller:quick-checks
    - asoctl:quick-checks
    - crossplane:generate-crds
    - crossplane:quick-checks
    - format-code

  ci:
    desc: Run all CI checks.
    deps: 
    - generator:ci
    - controller:ci
    - asoctl:ci
    - crossplane:ci
    cmds:
    - task: verify-no-changes

  ci-live:
    desc: Run all CI checks with live Azure resources. Requires that auth environment variables are set.
    deps: 
    - generator:ci
    - controller:ci-live

  format-code:
    desc: Ensure all code is formatted
    dir: v2
    cmds:
    - gofmt -l -s -w .

  build-docs-site:
    dir: docs/hugo
    cmds:
    - npm install -g postcss postcss-cli autoprefixer
    - hugo
    # - htmltest 
    # disabled pending: https://github.com/wjdp/htmltest/issues/45
    # , or us moving to a no-directory URL
    env:
      NODE_PATH:
        sh: npm root -g

  check-docs-site-links:
    dir: docs/hugo
    cmds:
      - npm install -g markdown-link-check # TODO: Add to devcontainer?
      # Excluding './content/reference/*' path as it contains all auto-generated API docs.
      - find . -type f -name "*.md" -not -path "./content/reference/*/*.md" -print0 | xargs -0 -n1 markdown-link-check -c link-checker.json
    env:
      NODE_PATH:
        sh: npm root -g

  basic-checks:
    deps: [header-check, specifier-check]

  ############### Asoctl targets ###############

  asoctl:quick-checks:
    cmds:
      - task: asoctl:unit-tests
      - task: basic-checks
      - task: asoctl:lint

  asoctl:ci:
    cmds:
      - task: asoctl:unit-tests-cover
      - task: basic-checks
      - task: asoctl:lint

  asoctl:unit-tests:
    desc: Run {{.ASOCTL_APP}} unit tests.
    dir: '{{.ASOCTL_ROOT}}'
    deps: [controller:generate-crds]
    cmds:
      - go test ./... -tags=noexit -run '{{default ".*" .TEST_FILTER}}'

  asoctl:unit-tests-cover:
    desc: Run {{.ASOCTL_APP}} unit tests and output coverage.
    dir: '{{.ASOCTL_ROOT}}'
    deps: [controller:generate-crds]
    cmds:
      - defer: # want to run even on failure
          task: produce-markdown-summary
          vars:
            INPUT_FILE: '{{.TEST_OUT}}/asoctl-unit-tests.json'
            OUTPUT_FILE: '{{.TEST_OUT}}/asoctl-unit-tests.md'
      - go test ./... -tags=noexit -race -covermode atomic -coverprofile=asoctl-coverage.out -json -coverpkg=./... -run '{{default ".*" .TEST_FILTER}}' > '{{.TEST_OUT}}/asoctl-unit-tests.json'

  asoctl:lint:
    desc: Run {{.ASOCTL_APP}} fast lint checks.
    dir: '{{.ASOCTL_ROOT}}'
    deps: [controller:generate-crds]
    cmds:
      - golangci-lint run --verbose --fast=false --timeout 5m --skip-dirs="(^|/)vendor($|/)" ./...

  asoctl:build:
    desc: Generate the {{.ASOCTL_APP}} binary.
    dir: '{{.ASOCTL_ROOT}}'
    deps: [controller:generate-crds]
    cmds:
      - go build {{.VERSION_FLAGS}} -o ../../bin/{{.ASOCTL_APP}} ./cmd/

  ############### Generator targets ###############

  generator:quick-checks:
    cmds:
    - task: generator:unit-tests
    - task: basic-checks
    - task: generator:lint

  generator:ci:
    cmds:
    - task: generator:unit-tests-cover
    - task: basic-checks
    - task: generator:lint

  generator:unit-tests:
    desc: Run {{.GENERATOR_APP}} unit tests.
    dir: '{{.GENERATOR_ROOT}}'
    cmds:
    - go test ./... -tags=noexit -run '{{default ".*" .TEST_FILTER}}'

  generator:unit-tests-cover:
    desc: Run {{.GENERATOR_APP}} unit tests and output coverage.
    dir: '{{.GENERATOR_ROOT}}'
    cmds:
    - defer: # want to run even on failure
        task: produce-markdown-summary
        vars:
          INPUT_FILE: '{{.TEST_OUT}}/generator-unit-tests.json'
          OUTPUT_FILE: '{{.TEST_OUT}}/generator-unit-tests.md'
    - go test ./... -tags=noexit -race -covermode atomic -coverprofile=generator-coverage.out -json -coverpkg=./... -run '{{default ".*" .TEST_FILTER}}' > '{{.TEST_OUT}}/generator-unit-tests.json'

  generator:update-golden-tests:
    desc: Update {{.GENERATOR_APP}} golden test outputs.
    dir: '{{.GENERATOR_ROOT}}'
    cmds:
    - go test ./... -run ^TestGolden -update

  generator:lint:
    desc: Run {{.GENERATOR_APP}} fast lint checks.
    dir: '{{.GENERATOR_ROOT}}'
    cmds:
    - golangci-lint run --verbose --fast=false --skip-dirs="(^|/)vendor($|/)"

  generator:build:
    desc: Generate the {{.GENERATOR_APP}} binary.
    dir: '{{.GENERATOR_ROOT}}'
    cmds:
    - go build {{.VERSION_FLAGS}} -o ../../bin/{{.GENERATOR_APP}} .

  generator:diagrams:
    desc: Regenerate all GraphViz diagrams
    dir: "./docs/hugo/content"
    sources: ["**/*.dot"]
    cmds:
    - "for f in $(find . -name '*.dot'); do dot -Tpng -o${f%.dot}.png $f; done"


  ############### Controller targets ###############
  controller:quick-checks:
    cmds:
      - task: controller:test
      # checks must be after test as that will generate code
      - task: basic-checks
      - task: controller:verify-samples
      # Lint is forced to the end because it expects the code is formatted
      - task: controller:lint

  controller:ci:
    cmds:
    - task: controller:verify-samples
    - task: controller:test-cover
    - task: controller:test-integration-ci
    # checks must be after test as that will generate code
    - task: basic-checks
    # lint must be at end after code is formatted
    - task: controller:lint

  controller:ci-integration-tests:
    cmds:
      - task: cleanup-old-live-azure-resources
      - task: controller:test-integration-kind-ci
      - task: controller:test-multitenant-integration-kind-ci

  controller:ci-live:
    cmds:
    - task: controller:test-integration-ci-live
    - task: basic-checks
    - task: controller:lint

  controller:lint:
    desc: Run fast lint checks.
    deps: [controller:generate-crds]
    dir: "{{.CONTROLLER_ROOT}}"
    cmds:
      # Setting GOGC to increase how much debris is tolerated before running GC
      - GOGC=200 golangci-lint run --verbose --fast=false --timeout 10m --skip-dirs="(^|/)vendor($|/)" ./...

  controller:verify-samples:
    desc: Verify that a sample exists for each supported resource
    deps: [ controller:generate-crds ]
    cmds:
      - "{{.SCRIPTS_ROOT}}/check_samples.py v2/"

  controller:test:
    desc: Run {{.CONTROLLER_APP}} unit tests.
    dir: "{{.CONTROLLER_ROOT}}"
    # controller:run-kustomize-for-envtest isn't strictly required here, but running it here so that
    # integration tests can be run manually (via IDE) after running "task"
    deps: [controller:generate-crds, controller:run-kustomize-for-envtest]
    cmds:
    - go test -short -tags=noexit -timeout 10m -run '{{default ".*" .TEST_FILTER}}' ./...

  controller:test-cover:
    desc: Run {{.CONTROLLER_APP}} unit tests and output coverage.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:generate-crds]
    cmds:
    - defer: # want to run even on failure
        task: produce-markdown-summary
        vars:
          INPUT_FILE: '{{.TEST_OUT}}/controller-unit-tests.json'
          OUTPUT_FILE: '{{.TEST_OUT}}/controller-unit-tests.md'
    # -race fails at the moment in gopter - possibly due to our shared generator variable?
    - go test -short -tags=noexit -timeout 10m -covermode atomic -coverprofile=controller-coverage.out -json -coverpkg="./..." -run '{{default ".*" .TEST_FILTER}}' ./... > '{{.TEST_OUT}}/controller-unit-tests.json'

  controller:test-upgrade:
    desc: Test upgrading {{.CONTROLLER_APP}} and helm chart for new release
    dir: "{{.CONTROLLER_ROOT}}"
    cmds:
    - task: controller:kind-create
    - task: controller:install-cert-manager
    - task: controller:docker-push-local
    - task: controller:gen-helm-manifest
    # We need the below to wait until cert-manager is up, otherwise the subsequent installation of webhooks fails. See https://cert-manager.io/next-docs/installation/verify/
    - "cmctl check api --wait=2m"
    - "helm repo add asov2 https://raw.githubusercontent.com/Azure/azure-service-operator/main/v2/charts"
    - "helm repo update"
    - "helm upgrade --install --devel asov2 asov2/azure-service-operator \
      --create-namespace \
      --namespace={{.ASO_NAMESPACE}} \
      --set azureSubscriptionID=$AZURE_SUBSCRIPTION_ID \
      --set azureTenantID=$AZURE_TENANT_ID \
      --set azureClientID=$AZURE_CLIENT_ID \
      --set azureClientSecret=$AZURE_CLIENT_SECRET"
    - "kubectl create namespace pre-release"
    - "kubectl wait --for=condition=ready --timeout=2m pod -n {{.ASO_NAMESPACE}} -l control-plane=controller-manager"
    - "go test -timeout 15m -v -run Test_Pre_Release_ResourceCanBeCreated_BeforeUpgrade ./test/pre-release"
    - task: controller:install-helm
    - "kubectl wait --for=condition=ready --timeout=2m pod -n {{.ASO_NAMESPACE}} -l control-plane=controller-manager"
#   TODO: Will have to change versions in 'Test_Pre_Release_ResourceCanBeCreated_AfterUpgrade' test once we move from beta to stable
    - "go test -timeout 15m -v -run Test_Pre_Release_ResourceCanBeCreated_AfterUpgrade ./test/pre-release"

  controller:build:
    desc: Generate the {{.CONTROLLER_APP}} binary.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:generate-crds]
    sources:
    # excluding the ./apis directory here
    - "go.mod"
    - "go.sum"
    - "*.go"
    - "internal/**/*.go"
    - "pkg/**/*.go"
    - "cmd/main.go"
    cmds:
    - CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build {{.VERSION_FLAGS}} -o ./bin/{{.CONTROLLER_APP}} ./cmd/controller/

  controller:docker-build:
    desc: Builds the {{.CONTROLLER_APP}} Docker image.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:build]
    run: always
    sources:
    - Dockerfile
    - ./bin/{{.CONTROLLER_APP}}
    cmds:
    - docker build . -t {{.CONTROLLER_DOCKER_IMAGE}}
    status:
    - "docker manifest inspect {{.CONTROLLER_DOCKER_IMAGE}} > /dev/null"

  controller:docker-build-and-save:
    desc: Builds the {{.CONTROLLER_APP}} Docker image and saves it using docker save.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:docker-build]
    cmds:
    - docker save {{.CONTROLLER_DOCKER_IMAGE}} > bin/$(echo '{{.CONTROLLER_DOCKER_IMAGE}}' | sed -e 's/:/_/g').tar

  controller:docker-tag-version:
    desc: Tags the {{.CONTROLLER_APP}} Docker image with the appropriate version.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:docker-build]
    cmds:
    - 'if [ -z "{{.DOCKER_PUSH_TARGET}}" ]; then echo "Error: DOCKER_PUSH_TARGET must be set"; exit 1; fi'
    - docker tag {{.CONTROLLER_DOCKER_IMAGE}} "{{.DOCKER_PUSH_TARGET}}/{{.CONTROLLER_DOCKER_IMAGE}}"

  controller:docker-push-local:
    desc: Pushes the controller container image to a local registry
    deps: [controller:docker-build]
    dir: "{{.CONTROLLER_ROOT}}"
    run: always
    cmds:
    - docker tag {{.CONTROLLER_DOCKER_IMAGE}} {{.LOCAL_REGISTRY_CONTROLLER_DOCKER_IMAGE}}
    - docker push {{.LOCAL_REGISTRY_CONTROLLER_DOCKER_IMAGE}}
    status:
    - "docker manifest inspect {{.LOCAL_REGISTRY_CONTROLLER_DOCKER_IMAGE}} > /dev/null"

  controller:test-integration-envtest:
    desc: Run integration tests with envtest using record/replay.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:run-kustomize-for-envtest]
    cmds:
    # -race fails at the moment in controller-runtime
    # We run these in sequence right now because it doesn't gain us much speed to go in parallel
    - go test -timeout {{.TIMEOUT}} -run '{{default ".*" .TEST_FILTER}}' {{.VERBOSE}} ./internal/controllers
    - go test -timeout {{.TIMEOUT}} -run '{{default ".*" .TEST_FILTER}}' {{.VERBOSE}} ./pkg/genruntime/test
    - go test -timeout {{.TIMEOUT}} -run '{{default ".*" .TEST_FILTER}}' {{.VERBOSE}} ./internal/genericarmclient
    vars:
      VERBOSE:
        sh: if [ $TEST_FILTER ];  then echo "-v"; fi
      TIMEOUT: '{{default "15m" .TIMEOUT}}'

  # This target is intended for local use only
  controller:test-integration-envtest-record:
    desc: Run integration tests with envtest with a longer timeout suitable for recording the tests.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:run-kustomize-for-envtest]
    cmds:
       - go test -timeout {{.TIMEOUT}} -run '{{default ".*" .TEST_FILTER}}' {{.VERBOSE}} ./internal/controllers -args -live
    vars:
      VERBOSE:
        sh: if [ $TEST_FILTER ];  then echo "-v"; fi
      TIMEOUT: '{{.LIVE_TEST_TIMEOUT}}'

  controller:test-integration-envtest-cover:
    desc: Run integration tests with envtest using record/replay and output coverage.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:run-kustomize-for-envtest]
    cmds:
    - defer: # want to run even on failure
        task: produce-markdown-summary
        vars:
          INPUT_FILE: '{{.TEST_OUT}}/controller-integration-tests.json'
          OUTPUT_FILE: '{{.TEST_OUT}}/controller-integration-tests.md'
    - defer: # want to run even on failure
        task: produce-markdown-summary
        vars:
          INPUT_FILE: '{{.TEST_OUT}}/controller-integration-genruntime-tests.json'
          OUTPUT_FILE: '{{.TEST_OUT}}/controller-integration-genruntime-tests.md'
    - defer: # want to run even on failure
        task: produce-markdown-summary
        vars:
          INPUT_FILE: '{{.TEST_OUT}}/controller-integration-genericarmclient-tests.json'
          OUTPUT_FILE: '{{.TEST_OUT}}/controller-integration-genericarmclient-tests.md'
    # -race fails at the moment in controller-runtime
    - go test -covermode atomic -coverprofile=coverage-integration-envtest.out -coverpkg="./..." -json -timeout 15m -run '{{default ".*" .TEST_FILTER}}' ./internal/controllers > '{{.TEST_OUT}}/controller-integration-tests.json'
    - go test -covermode atomic -coverprofile=coverage-integration-genruntime-envtest.out -coverpkg="./..." -json -timeout 15m -run '{{default ".*" .TEST_FILTER}}' ./pkg/genruntime/test > '{{.TEST_OUT}}/controller-integration-genruntime-tests.json'
    - go test -covermode atomic -coverprofile=coverage-integration-genericarmclient-envtest.out -coverpkg="./..." -json -timeout 15m -run '{{default ".*" .TEST_FILTER}}' ./internal/genericarmclient > '{{.TEST_OUT}}/controller-integration-genericarmclient-tests.json'

  controller:test-integration-envtest-live:
    desc: Run integration tests with envtest against live data and output coverage.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:run-kustomize-for-envtest, cleanup-azure-resources]
    cmds:
    # -race fails at the moment in controller-runtime
    - go test -timeout {{.LIVE_TEST_TIMEOUT}} -covermode atomic -coverprofile=coverage-integration-envtest-live.out -coverpkg="./..." -run '{{default ".*" .TEST_FILTER}}' ./internal/controllers -args -live
    env:
      RECORD_REPLAY: 0

  controller:test-integration-kind-ci:
    desc: Run live integration tests in kind and deletes the kind cluster afterwards.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:kind-create-helm-podidentity]
    cmds:
      # This timeout is purposefully low - if we find that this job is taking a long time we may need to think of other ways
      # to keep CI fast
      # TODO: Below pattern was taken from https://github.com/go-task/task/pull/474 to ensure cleanup runs after the test.
      - |
        (go test -timeout 40m -run '{{default ".*" .TEST_FILTER}}' ./test); # Run the tests in a subshell
        TEST_EXIT=$?;
        kind delete cluster --name=asov2
        exit $TEST_EXIT

  # Note that this target isn't used in CI and is intended for use when running locally on a kind cluster
  # that you don't want to delete (in contrast to test-integration-kind which will delete the kind cluster
  # when it is done.
  controller:test-integration-kind:
    desc: Run live integration tests in kind.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:kind-create-helm-podidentity]
    cmds:
      # This timeout is purposefully low - if we find that this job is taking a long time we may need to think of other ways
      # to keep CI fast
      - go test -timeout 40m -v -run '{{default ".*" .TEST_FILTER}}' ./test

  controller:test-multitenant-integration-kind-ci:
    desc: Run live multitenant integration tests in kind.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:kind-create-multitenant-cluster]
    cmds:
      # This timeout is purposefully low - if we find that this job is
      # taking a long time we may need to think of other ways to keep
      # CI fast
      # TODO: Below pattern was taken from
      # https://github.com/go-task/task/pull/474 to ensure cleanup
      # runs after the test.
      - |
        (go test -timeout 15m -v -run '{{default ".*" .TEST_FILTER}}' ./test/multitenant); # Run the tests in a subshell.
        TEST_EXIT=$?;
        kind delete cluster --name=asov2
        exit $TEST_EXIT

  # Note that this target isn't used in CI and is intended for use
  # when running locally on a kind cluster that you don't want to
  # delete (in contrast to test-multitenant-integration-kind which
  # will delete the kind cluster when it is done.
  controller:test-multitenant-integration-kind:
    desc: Run live multitenant integration tests in kind.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:kind-create-multitenant-cluster]
    cmds:
      # This timeout is purposefully low - if we find that this job is
      # taking a long time we may need to think of other ways to keep
      # CI fast
      - go test -timeout 15m -v -run '{{default ".*" .TEST_FILTER}}' ./test/multitenant

  controller:test-integration-ci:
    desc: Run integration tests for CI
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:test-integration-envtest-cover]

  controller:test-integration-ci-live:
    desc: Run integration tests for CI in live mode
    dir: "{{.CONTROLLER_ROOT}}"
    deps:
      - controller:test-integration-envtest-live
      - controller:test-integration-kind-ci
      - cleanup-old-live-azure-resources

  controller:generate-types:
    desc: Run {{.GENERATOR_APP}} to generate input files for controller-gen for {{.CONTROLLER_APP}}.
    dir: v2
    deps: [generator:build]
    sources:
      - ./bin/{{.GENERATOR_APP}}
      - azure-arm.yaml
    cmds:
      - ./bin/{{.GENERATOR_APP}} gen-types azure-arm.yaml

  controller:generate-crds:
    desc: Run controller-gen to generate {{.CONTROLLER_APP}} CRD files.
    deps: [controller:generate-types, controller:generate-genruntime-deepcopy]
    sources:
    - "v2/api/**/*_gen.go" # depends on all generated types
    - "v2/pkg/genruntime/**/*.go" # Also depends on the genruntime types as they're embedded into the CRDs
    cmds:
    - mkdir -p v2/api
    - find v2/api -type f -name "zz_generated.*" -delete
    - if [ -d "{{.CONTROLLER_OUTPUT}}/crd/bases" ]; then find "{{.CONTROLLER_OUTPUT}}/crd/bases" -type f -delete; fi
    - if [ -d "{{.CONTROLLER_OUTPUT}}/crd/patches" ]; then find "{{.CONTROLLER_OUTPUT}}/crd/patches" -type f -delete; fi
    - cd v2/api && controller-gen {{.OBJECT_OPTIONS}} paths=./... 
    - cd v2/api && controller-gen {{.CRD_OPTIONS}} {{.WEBHOOK_OPTIONS}} {{.RBAC_OPTIONS}} paths=./...
    - cd v2/api && gofmt -l -s -w . # format all generated code
    vars:
      OBJECT_OPTIONS: object:headerFile={{.HEADER_FILE}} 
      CRD_OPTIONS: crd:crdVersions=v1,allowDangerousTypes=true output:crd:artifacts:config={{.CONTROLLER_OUTPUT}}/crd/bases 
      WEBHOOK_OPTIONS: webhook output:webhook:artifacts:config={{.CONTROLLER_OUTPUT}}/webhook 
      RBAC_OPTIONS: rbac:roleName=manager-role output:rbac:artifacts:config={{.CONTROLLER_OUTPUT}}/rbac

  controller:generate-genruntime-deepcopy:
    desc: Run controller-gen to generate {{.CONTROLLER_APP}} CRD files.
    dir: "{{.CONTROLLER_ROOT}}"
    sources:
      - "pkg/genruntime/**/*.go"
    cmds:
      - find ./pkg/genruntime -type f -name "zz_generated.*" -delete
      - cd pkg/genruntime && controller-gen {{.OBJECT_OPTIONS}} paths=./...
      - cd pkg/genruntime && gofmt -l -s -w .  # We do this because controller-gen can generate these files in a way that isn't gofmt'ed which can break things down the line
    vars:
      OBJECT_OPTIONS: object:headerFile={{.HEADER_FILE}}

  controller:generate-kustomize:
    desc: Run {{.GENERATOR_APP}} to generate the Kustomize file for registering CRDs.
    deps: [controller:generate-crds]
    dir: v2
    sources:
      - bin/{{.GENERATOR_APP}}
      - config/crd/bases/**/*.yaml
    generates:
      - config/crd/kustomization.yaml
    cmds:
      - bin/{{.GENERATOR_APP}} gen-kustomize config/crd

  controller:run-kustomize:
    desc: Generates the CRD & configuration bundle.
    deps: [controller:generate-kustomize]
    dir: "v2/"
    cmds:
      - mkdir -p bin # in case it doesn't exist
      - kustomize build config/default | sed -e 's@localhost:5000/azureserviceoperator:latest@{{.PUBLIC_REGISTRY}}{{.CONTROLLER_DOCKER_IMAGE}}@g' > bin/azureserviceoperator_{{.VERSION}}.yaml

  controller:make-multitenant-files:
    desc: Splits the deployment yaml into cluster and tenant files for multitenant deployment
    deps: [controller:run-kustomize]
    dir: "v2/bin"
    cmds:
      - '../../{{.SCRIPTS_ROOT}}/make-multitenant-cluster.sh "{{.VERSION}}" "azureserviceoperator_{{.VERSION}}.yaml"'
      - '../../{{.SCRIPTS_ROOT}}/make-multitenant-tenant.sh "{{.VERSION}}" "azureserviceoperator_{{.VERSION}}.yaml"'

  controller:run-kustomize-for-envtest:
    desc: Generates the CRDs for use in envtest
    deps: [controller:generate-kustomize]
    dir: "v2/"
    sources:
      - config/crd/bases/**/*.yaml
      - config/crd/patches/**/*.yaml
      - config/crd/kustomization.yaml
      - config/crd/kustomizeconfig.yaml
    generates:
      - config/crd/out/azureserviceoperator.yaml
    cmds:
      - mkdir -p config/crd/out
      - find "config/crd/out" -type f -delete
      - kustomize build config/crd > config/crd/out/azureserviceoperator.yaml

  controller:gen-helm-manifest:
    desc: Generate helm manifest using Kustomize for the release
    deps: [controller:generate-kustomize]
    cmds:
     - "{{.SCRIPTS_ROOT}}/generate-helm-manifest.sh {{.KUBE_RBAC_PROXY}} {{.LOCAL_REGISTRY_CONTROLLER_DOCKER_IMAGE}} {{.PUBLIC_REGISTRY}} {{.LATEST_VERSION_TAG}} `pwd`/{{.CONTROLLER_ROOT}}"

  controller:install-helm:
    desc: Generate and install helm chart on cluster
    dir: "{{.CONTROLLER_ROOT}}"
    cmds:
    - "helm upgrade --install --set azureSubscriptionID=$AZURE_SUBSCRIPTION_ID \
      --set azureSubscriptionID=$AZURE_SUBSCRIPTION_ID \
      --set azureTenantID=$AZURE_TENANT_ID \
      --set azureClientID=$AZURE_CLIENT_ID \
      --set azureClientSecret=$AZURE_CLIENT_SECRET \
      --set image.repository={{.LOCAL_REGISTRY_CONTROLLER_DOCKER_IMAGE}} \
      asov2 -n {{.ASO_NAMESPACE}} --create-namespace ./charts/azure-service-operator/"
    - "kubectl wait --for=condition=ready --timeout=2m pod -n {{.ASO_NAMESPACE}} -l control-plane=controller-manager"

  controller:delete-helm:
    desc: Delete helm release
    cmds:
      - "helm delete asov2 -n {{.ASO_NAMESPACE}}"

  controller:kind-create-helm:
    desc: Creates a local kind cluster with ASO helm chart built and installed.
    cmds:
      - task: controller:kind-create
      - task: controller:install-cert-manager
      - task: controller:docker-push-local
      - task: controller:gen-helm-manifest
      # We need the below to wait until cert-manager is up, otherwise the subsequent installation of webhooks fails. See https://cert-manager.io/next-docs/installation/verify/
      - "cmctl check api --wait=2m"
      - task: controller:install-helm

  controller:kind-create-helm-podidentity:
    desc: Creates a local kind cluster with 'AAD Pod Identity' installed alongside ASO helm chart.
    deps: [controller:kind-create-helm]
    cmds:
      - task: controller:install-aad-pod-identity-local
      - task: controller:make-aadpodidentity-secret
      - "kubectl wait --for=condition=ready --timeout=2m pod -n {{.ASO_NAMESPACE}} -l control-plane=controller-manager"

  controller:kind-delete:
    desc: Deletes a kind cluster
    run: always
    cmds:
      - "kind delete cluster --name=asov2"

  controller:kind-create:
    desc: Creates a kind cluster and local Docker registry. Images in the local registry can be pulled in the kind cluster
    run: always
    cmds:
      - "export KIND_CLUSTER_NAME=asov2 && {{.SCRIPTS_ROOT}}/kind-with-registry.sh"
    status:
      - "kind get clusters | grep \"^asov2$\""

  controller:scan-image:
    desc: Builds a local image and scans the image using trivy
    deps: [controller:docker-build]
    cmds:
      - "trivy image {{.CONTROLLER_DOCKER_IMAGE}}"
      - "trivy image --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL {{.CONTROLLER_DOCKER_IMAGE}} || exit 1"

  controller:install:
    desc: Installs the controller, webhooks, and CRDs into the default kubectl cluster
    deps: [controller:generate-kustomize]
    cmds:
      - "cd v2/ && kustomize build config/default  | kubectl apply --server-side=true -f -" # TODO: may need | sed "s_${CONFIG_REGISTRY}_${REGISTRY}/${IMG}_" at some point

  controller:install-cert-manager:
    desc: Installs cert manager
    run: always
    cmds:
      - "kubectl create namespace cert-manager"
      - "kubectl label namespace cert-manager cert-manager.io/disable-validation=true"
      - "kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.8.2/cert-manager.yaml"
    status:
      - "kubectl get namespace cert-manager"

  controller:install-aad-pod-identity-local:
    desc: Installs 'aad-pod-identity' in managed mode
    cmds:
      - "kubectl apply -f https://raw.githubusercontent.com/Azure/aad-pod-identity/master/deploy/infra/managed-mode-deployment.yaml"
      - "kubectl wait --for=condition=Ready --timeout=2m pods --all --namespace kube-system"
      # Also wait for the CRDs to be established, because we have seen situations where for some reason creating resources of that type fails
      # shortly after installation. Error looks like this:
      # [controller:make-aadpodidentity-secret] unable to recognize "STDIN": no matches for kind "AzureIdentity" in version "aadpodidentity.k8s.io/v1"
      # [controller:make-aadpodidentity-secret] unable to recognize "STDIN": no matches for kind "AzureIdentityBinding" in version "aadpodidentity.k8s.io/v1"
      - "kubectl wait --for condition=established --timeout=2m crd/azureidentities.aadpodidentity.k8s.io"
      - "kubectl wait --for condition=established --timeout=2m crd/azureidentitybindings.aadpodidentity.k8s.io"

  controller:make-sp-secret:
    desc: Creates a service principal aso-controller-settings secret for testing purposes
    cmds:
      - "{{.SCRIPTS_ROOT}}/deploy_testing_secret.sh sp"

  controller:make-aadpodidentity-secret:
    desc: Creates an aad-pod-identity secret for testing purposes
    cmds:
      - "{{.SCRIPTS_ROOT}}/deploy_testing_secret.sh aadpodidentity"

  controller:kind-create-with-service-principal:
    desc: Creates a local kind cluster with ASO using service principal auth.
    cmds:
      - task: controller:kind-create
      - task: controller:install-cert-manager
      - task: controller:docker-push-local
      # We need the below to wait until cert-manager is up, otherwise the subsequent installation of webhooks fails. See https://cert-manager.io/next-docs/installation/verify/
      - "cmctl check api --wait=2m"
      - task: controller:install
      - task: controller:make-sp-secret
      - "kubectl wait --for=condition=ready --timeout=2m pod -n {{.ASO_NAMESPACE}} -l control-plane=controller-manager"

  controller:kind-create-with-podidentity:
    desc: Creates a local kind cluster with 'AAD Pod Identity' installed alongside ASO.
    cmds:
      - task: controller:kind-create
      - task: controller:install-cert-manager
      - task: controller:docker-push-local
      # We need the below to wait until cert-manager is up, otherwise the subsequent installation of webhooks fails. See https://cert-manager.io/next-docs/installation/verify/
      - "cmctl check api --wait=2m"
      - task: controller:install
      - task: controller:install-aad-pod-identity-local
      - task: controller:make-aadpodidentity-secret
      - "kubectl wait --for=condition=ready --timeout=2m pod -n {{.ASO_NAMESPACE}} -l control-plane=controller-manager"
      # Wait for the webhook client config caBundles to be set on the
      # ASO CRDs.
      - "{{.SCRIPTS_ROOT}}/wait-for-ca-bundles.sh"

  controller:kind-create-multitenant-cluster:
    desc: Creates a local kind cluster with ASO installed in multitenant configuration.
    deps: [controller:make-multitenant-files]
    cmds:
      - task: controller:kind-create
      - task: controller:install-cert-manager
      - task: controller:docker-push-local
      # We need the below to wait until cert-manager is up, otherwise the subsequent installation of webhooks fails. See https://cert-manager.io/next-docs/installation/verify/
      - "cmctl check api --wait=2m"
      # Install cluster yaml - we need to switch the image to the local one.
      - "cat v2/bin/multitenant-cluster_{{.VERSION}}.yaml | sed -e 's|image: mcr.microsoft.com/k8s/azureserviceoperator:.*|image: localhost:5000/azureserviceoperator:latest|' | kubectl apply --server-side=true -f -"
      # Install tenant yaml - with same image switch
      - "cat v2/bin/multitenant-tenant_{{.VERSION}}.yaml | sed -e 's|image: mcr.microsoft.com/k8s/azureserviceoperator:.*|image: localhost:5000/azureserviceoperator:latest|' | kubectl apply --server-side=true -f -"
      # Make sp secret for tenant watching some target namespaces.
      - "{{.SCRIPTS_ROOT}}/deploy_multitenant_testing_secret.sh"
      # Create the namespaces that the tenant is watching.
      - "kubectl create namespace t1-items"
      - "kubectl create namespace t1-more"
      # Wait for all the operator pods to be ready.
      - "kubectl wait --for=condition=ready --timeout=2m pod -n {{.ASO_NAMESPACE}} -l control-plane=controller-manager"
      - "kubectl wait --for=condition=ready --timeout=2m pod -n tenant1-system -l control-plane=controller-manager"
      # Wait for the webhook client config caBundles to be set on the
      # ASO CRDs.
      - "{{.SCRIPTS_ROOT}}/wait-for-ca-bundles.sh"

  controller:gen-crd-docs:
    desc: Generates API docs for CRDs
    deps: [controller:generate-crds]
    dir: "{{.CONTROLLER_ROOT}}"
    cmds:
      - ../{{.SCRIPTS_ROOT}}/gen-api-docs.sh ./api ../docs/hugo/content/reference ../docs/v2/api/template

  ############### Crossplane targets ###############
  crossplane:quick-checks:
    cmds:
      - task: basic-checks

# TODO: We currently have no tests
#  crossplane:test:
#    desc: Run {{.CROSSPLANE_APP}} unit tests.
#    dir: "{{.CROSSPLANE_ROOT}}"
#    cmds:
#      - go test ./... -tags=noexit -timeout 10m

#  crossplane:update-golden-tests:
#    desc: Update {{.CROSSPLANE_APP}} golden test outputs.
#    dir: "{{.CROSSPLANE_ROOT}}"
#    cmds:
#      - go test ./pkg/codegen -run ^TestGolden$ -update -timeout 10m

  # TODO: No non-generated code in this directory at the moment
  # crossplane:lint:
  #   desc: Run {{.CROSSPLANE_APP}} fast lint checks.
  #   dir: "{{.CROSSPLANE_ROOT}}"
  #   cmds:
  #     - golangci-lint run --verbose

  crossplane:generate-crds:
    desc: Run controller-gen to generate {{.CROSSPLANE_APP}} CRD files.
    deps: [crossplane:generate-types]
    dir: "{{.CROSSPLANE_ROOT}}"
    sources:
      - "apis/**/*_gen.go" # depends on all generated types
    cmds:
      - mkdir -p ./apis
      - find ./apis -type f -name "zz_generated.*" -delete
      - if [ -d "{{.CROSSPLANE_OUTPUT}}/crd/bases" ]; then find "{{.CROSSPLANE_OUTPUT}}/crd/bases" -type f -delete; fi
      - if [ -d "{{.CROSSPLANE_OUTPUT}}/crd/patches" ]; then find "{{.CROSSPLANE_OUTPUT}}/crd/patches" -type f -delete; fi
      - cd apis && controller-gen {{.OBJECT_OPTIONS}} paths=./...
      - cd apis && controller-gen {{.CRD_OPTIONS}} {{.WEBHOOK_OPTIONS}} {{.RBAC_OPTIONS}} paths=./...
      - cd apis && gofmt -l -s -w . # format all generated code
    vars:
      OBJECT_OPTIONS: object:headerFile={{.HEADER_FILE}}
      CRD_OPTIONS: crd:crdVersions=v1,allowDangerousTypes=true output:crd:artifacts:config={{.CROSSPLANE_OUTPUT}}/crd/bases
      WEBHOOK_OPTIONS: webhook output:webhook:artifacts:config={{.CROSSPLANE_OUTPUT}}/webhook
      RBAC_OPTIONS: rbac:roleName=manager-role # output:rbac:artifacts:config={{.CROSSPLANE_OUTPUT}}/rbac # not output currently?

  crossplane:generate-types:
    desc: Run {{.GENERATOR_APP}} to generate input files for controller-gen for {{.CROSSPLANE_APP}}.
    dir: "{{.CROSSPLANE_ROOT}}"
    deps: [generator:build]
    sources:
      - ../../v2/bin/{{.GENERATOR_APP}}
      - azure-crossplane.yaml
    cmds:
      - ../../v2/bin/{{.GENERATOR_APP}} gen-types azure-crossplane.yaml

  crossplane:ci:
    deps: [header-check, specifier-check, crossplane:generate-crds]

  ############### Shared targets ###############
  cleanup-azure-resources:
    desc: Removes any resources created by the integration tests.
    deps: [az-login]
    cmds:
      - '{{.SCRIPTS_ROOT}}/delete-old-resourcegroups.sh -p "{{.TEST_RESOURCE_PREFIX}}"'

  cleanup-old-live-azure-resources:
    desc: Removes any old resources created by the integration tests (old means older than 3 hours).
    deps: [az-login]
    # This finds all resource groups which match the specified pattern (asolivetest*)
    # and are older than 3 hours (10800 seconds).
    cmds:
      - '{{.SCRIPTS_ROOT}}/delete-old-resourcegroups.sh -p "{{.TEST_LIVE_RESOURCE_PREFIX}}" -a 10800'

  az-login:
    desc: Runs AZ login
    cmds:
      - az login --service-principal -u {{.AZURE_CLIENT_ID}} -p {{.AZURE_CLIENT_SECRET}} --tenant {{.AZURE_TENANT_ID}}
      - az account set --subscription {{.AZURE_SUBSCRIPTION_ID}}

  header-check:
    desc: Ensure all files have an appropriate license header.
    cmds:
      - "{{.SCRIPTS_ROOT}}/check_headers.py"

  frontmatter-check:
    desc: Ensure all Markdown documentation has frontmatter.
    dir: docs/hugo/content
    cmds:
      - "../../../{{.SCRIPTS_ROOT}}/check_frontmatter.py"

  specifier-check:
    desc: Check that format specifiers %v and %+v are not used
    # Both %v and %+v result in all the values from structs being dumped into the string. If that 
    # struct happens to contain a secret or sensitive information, it ends up dumped out in an 
    # uncontrolled way, potentially leading to a security issue or a problem with PII disclosure.
    # The buried risk here is that while %v might be safe now, a future change to the struct might
    # introduce a disclosure later on. 
    cmds:
      - cmd: echo "==> Checking format specifiers <=="
        silent: true
      - cmd: '! git grep -e "%+v" -e "%v" --break --heading --line-number -I "*.go"'

  verify-no-changes:
    desc: Checks that there are no uncommitted modifications to files
    cmds:
    - cmd: 'if [ -n "{{.CHANGED}}" ]; then echo "Error: files were modified during the build (did you forget to commit generated files?):"; echo "{{.CHANGED}}"; git diff; exit 1; fi'
      silent: true
    vars:
      CHANGED:
        sh: git status --porcelain

  produce-markdown-summary:
    desc: Builds a test output summary for Github
    cmds:
    - cmd: go run v2/tools/mangle-test-json/main.go "{{.INPUT_FILE}}" > "{{.OUTPUT_FILE}}"