tegwick
1e1e077b27
TokenReview-based caller identity with audience-scoped tokens and exact resource.system to ServiceAccount bindings, per ops-warden's recommendation. Deletes the unwired tenant-engine live-roles adapter (T03) and adds make verify-posture (T05). Source implements A2; running digest is still A0 until promotion, so tenancy.current.A stays 0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
73 lines
2.1 KiB
Makefile
73 lines
2.1 KiB
Makefile
BIN_DIR ?= bin
|
|
BIN := $(BIN_DIR)/flex-auth
|
|
PKG := ./...
|
|
VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo 0.0.0-dev)
|
|
LDFLAGS := -X main.version=$(VERSION)
|
|
|
|
.PHONY: all build test vet lint fmt tidy sbom clean ci overlay-render overlay-dry-run verify-posture
|
|
|
|
all: vet lint test build
|
|
|
|
build:
|
|
@mkdir -p $(BIN_DIR)
|
|
go build -ldflags "$(LDFLAGS)" -o $(BIN) ./cmd/flex-auth
|
|
|
|
test:
|
|
go test -race $(PKG)
|
|
|
|
vet:
|
|
go vet $(PKG)
|
|
|
|
fmt:
|
|
gofmt -l -w .
|
|
|
|
tidy:
|
|
go mod tidy
|
|
|
|
lint:
|
|
@if command -v golangci-lint >/dev/null 2>&1; then \
|
|
golangci-lint run $(PKG); \
|
|
else \
|
|
echo "golangci-lint not installed; run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest"; \
|
|
echo "falling back to: go vet"; \
|
|
go vet $(PKG); \
|
|
fi
|
|
|
|
GOBIN_PATH := $(shell go env GOPATH)/bin
|
|
|
|
sbom:
|
|
@mkdir -p $(BIN_DIR)
|
|
@if command -v cyclonedx-gomod >/dev/null 2>&1; then \
|
|
cyclonedx-gomod mod -json -output $(BIN_DIR)/sbom.cdx.json .; \
|
|
echo "SBOM written to $(BIN_DIR)/sbom.cdx.json (cyclonedx-gomod)"; \
|
|
elif [ -x "$(GOBIN_PATH)/cyclonedx-gomod" ]; then \
|
|
"$(GOBIN_PATH)/cyclonedx-gomod" mod -json -output $(BIN_DIR)/sbom.cdx.json .; \
|
|
echo "SBOM written to $(BIN_DIR)/sbom.cdx.json (cyclonedx-gomod via GOPATH)"; \
|
|
elif command -v syft >/dev/null 2>&1; then \
|
|
syft . -o cyclonedx-json=$(BIN_DIR)/sbom.cdx.json; \
|
|
echo "SBOM written to $(BIN_DIR)/sbom.cdx.json (syft)"; \
|
|
else \
|
|
echo "no SBOM tool found. install one:"; \
|
|
echo " go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest"; \
|
|
echo " or syft: https://github.com/anchore/syft"; \
|
|
exit 1; \
|
|
fi
|
|
|
|
clean:
|
|
rm -rf $(BIN_DIR)
|
|
|
|
ci: vet lint test build overlay-render
|
|
|
|
verify-posture:
|
|
@bash tools/verify-posture.sh
|
|
|
|
overlay-render:
|
|
@tests/stage1.sh
|
|
|
|
overlay-dry-run:
|
|
@test -n "$$KUBECONFIG" || { echo "set KUBECONFIG to the railiance01 kubeconfig"; exit 1; }
|
|
@for values in values/stage2-canary.yaml values/user-engine.yaml values/tenant-engine.yaml; do \
|
|
echo "server-dry-run $$values"; \
|
|
helm template flex-auth charts/flex-auth -f "$$values" --namespace flex-auth \
|
|
| kubectl apply --dry-run=server --server-side -f -; \
|
|
done
|