CILIUM_TAG=$(shell awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml)

export NAME=cilium
export NAMESPACE=cozy-$(NAME)

include ../../../hack/common-envs.mk
include ../../../hack/package.mk

# hack/helm-unit-tests.sh discovers work by probing for this target, so a
# package without one is skipped in silence however many suites sit under
# tests/.
#
# Phony because hack/package.mk's .PHONY line deliberately does not carry
# `test` -- it lists only the targets that file defines, and hack/package-mk-phony.bats
# pins that -- so a path named `test` next to this Makefile would otherwise make
# the target up to date and skip the recipe. That matters here beyond tidiness:
# tests/kube_proxy_replacement_test.yaml is the pin two other packages' deny
# policies rely on, and a skipped recipe removes it in silence.
.PHONY: test
test:
	helm unittest .

update:
	rm -rf charts
	helm repo add cilium https://helm.cilium.io/
	helm repo update cilium
	helm pull cilium/cilium --untar --untardir charts --version 1.19
	$(SED_INPLACE) -e '/Used in iptables/d' -e '/SYS_MODULE/d' charts/cilium/values.yaml
	# Drop the whole k8s<1.30 AppArmor annotations block from the cilium-agent
	# DaemonSet. Cozystack manages these annotations through cilium.podAnnotations
	# in values.yaml on every k8s version, so keeping the upstream block would
	# produce duplicate mapping keys on k8s<1.30.
	perl -i -0pe 's|\n        \{\{- if not \.Values\.securityContext\.privileged \}\}\n        \{\{- if semverCompare "<1\.30\.0".*?\n        \{\{- end \}\}\n        \{\{- end \}\}\n        \{\{- end \}\}||s' \
		charts/cilium/templates/cilium-agent/daemonset.yaml
	@! grep -q 'container\.apparmor\.security\.beta\.kubernetes\.io' \
		charts/cilium/templates/cilium-agent/daemonset.yaml || \
		{ echo 'ERROR: perl patch did not remove the upstream AppArmor block from cilium-agent/daemonset.yaml (upstream template format may have changed)' >&2; exit 1; }
	version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \
	$(SED_INPLACE) "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile
	# Verify the IPv6-passthrough BPF patch still applies to the new upstream tag,
	# so the bump author learns about drift immediately instead of at image build.
	version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \
	tmpdir=$$(mktemp -d) && \
	{ curl --fail --silent --show-error --location \
		"https://raw.githubusercontent.com/cilium/cilium/v$${version}/bpf/bpf_host.c" \
		-o "$$tmpdir/bpf_host.c" || { rm -rf "$$tmpdir"; exit 1; }; } && \
	{ patch --dry-run --batch --forward --fuzz=0 -p1 -d "$$tmpdir" \
		< images/cilium/patches/pass-ipv6-to-stack-when-ipv6-datapath-disabled.diff || \
		{ echo "ERROR: images/cilium/patches/pass-ipv6-to-stack-when-ipv6-datapath-disabled.diff no longer applies to upstream bpf/bpf_host.c v$${version}; regenerate it for the new cilium version" >&2; \
		rm -rf "$$tmpdir"; exit 1; }; } && \
	rm -rf "$$tmpdir"

image:
	docker buildx build images/cilium \
		$(call image-tags,cilium,$(CILIUM_TAG)) \
		$(call cache-args,cilium) \
		--metadata-file images/cilium.json \
		$(BUILDX_ARGS)
	REPOSITORY="$(REGISTRY)/cilium" \
		yq -i '.cilium.image.repository = strenv(REPOSITORY)' values.yaml
	TAG=$(IMAGE_TAG) \
		yq -i '.cilium.image.tag = strenv(TAG)' values.yaml
	DIGEST=$$(yq e '."containerimage.digest"' images/cilium.json -o json -r) \
		yq -i '.cilium.image.digest = strenv(DIGEST)' values.yaml
	rm -f images/cilium.json
