fix: make targets run on arm64 architecture

Signed-off-by: Oleksii Kurinnyi <[email protected]>

Author: akurinnoy

Makefile

@@ -52,6 +52,9 @@ OPM_VERSION = v1.19.5
 
 CRD_OPTIONS ?= "crd:crdVersions=v1"
 
+GOOS = linux
+GOARCH = amd64
+
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))
   GOBIN=$(shell go env GOPATH)/bin
@@ -185,23 +188,48 @@ generate: controller-gen
 ### docker: Builds and pushes controller image
 docker: _print_vars docker-build docker-push
 
-### docker-build: Builds the controller image
-docker-build:
-	$(DOCKER) build . -t ${DWO_IMG} -f build/Dockerfile
+### docker-build: Builds the images and the local manifest list
+docker-build: _docker-build-amd64 _docker-build-arm64
+	# clean up any old local manifest list to avoid conflicts
+	$(DOCKER) manifest rm ${DWO_IMG} || true
+	# create a new local manifest list from the freshly built images
+	$(DOCKER) manifest create ${DWO_IMG} ${DWO_IMG}-amd64 ${DWO_IMG}-arm64
+
+
+### _docker-build-amd64: Builds the amd64 image
+_docker-build-amd64:
+	$(DOCKER) build . --platform linux/amd64 -t ${DWO_IMG}-amd64 -f build/Dockerfile
+
+### _docker-build-arm64: Builds the arm64 image
+_docker-build-arm64:
+	$(DOCKER) build . --platform linux/arm64 -t ${DWO_IMG}-arm64 -f build/Dockerfile
+
+
+### docker-push: Pushes the images and manifest to the registry
+docker-push: _docker-check-push
+	# pushing architecture-specific images to the registry
+	$(DOCKER) push ${DWO_IMG}-amd64
+	$(DOCKER) push ${DWO_IMG}-arm64
+
+	# clean up any old local manifest list to avoid conflicts
+	$(DOCKER) manifest rm ${DWO_IMG} || true
+	# re-create the manifest right before pushing to ensure its state is clean
+	$(DOCKER) manifest create ${DWO_IMG} ${DWO_IMG}-amd64 ${DWO_IMG}-arm64
+	# push the manifest list and its images
+	$(DOCKER) manifest push --all ${DWO_IMG}
 
-### docker-push: Pushes the controller image
-docker-push:
+### _docker-check-push: Asks for confirmation before pushing the image, unless running in CI
+_docker-check-push:
   ifneq ($(INITIATOR),CI)
     ifeq ($(DWO_IMG),quay.io/devfile/devworkspace-controller:next)
 	    @echo -n "Are you sure you want to push $(DWO_IMG)? [y/N] " && read ans && [ $${ans:-N} = y ]
     endif
   endif
-	$(DOCKER) push ${DWO_IMG}
 
 ### compile-devworkspace-controller: Compiles the devworkspace-controller binary
 .PHONY: compile-devworkspace-controller
 compile-devworkspace-controller:
-	CGO_ENABLED=0 GOOS=linux GOARCH=$(ARCH) GO111MODULE=on go build \
+	CGO_ENABLED=0 GOOS=linux GOARCH=$(GOARCH) GO111MODULE=on go build \
 	  -a -o _output/bin/devworkspace-controller \
 	  -gcflags all=-trimpath=/ \
 	  -asmflags all=-trimpath=/ \
@@ -212,7 +240,7 @@ compile-devworkspace-controller:
 ### compile-webhook-server: Compiles the webhook-server
 .PHONY: compile-webhook-server
 compile-webhook-server:
-	CGO_ENABLED=0 GOOS=linux GOARCH=$(ARCH) GO111MODULE=on go build \
+	CGO_ENABLED=0 GOOS=linux GOARCH=$(GOARCH) GO111MODULE=on go build \
 	  -o _output/bin/webhook-server \
 	  -gcflags all=-trimpath=/ \
 	  -asmflags all=-trimpath=/ \

build/Dockerfile

@@ -14,7 +14,12 @@
 #
 
 # https://access.redhat.com/containers/?tab=tags#/registry.access.redhat.com/ubi9/go-toolset
-FROM registry.access.redhat.com/ubi9/go-toolset:1.24.4-1753853351 as builder
+# Use BUILDPLATFORM to ensure the builder always runs natively on the host machine
+FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:1.24.4-1753853351 AS builder
+
+# Accept TARGETARCH, which is automatically passed by the builder
+ARG TARGETARCH
+
 ENV GOPATH=/go/
 USER root
 WORKDIR /devworkspace-operator
@@ -29,9 +34,9 @@ RUN go env GOPROXY && \
 # Copy the go source
 COPY . .
 
-# compile workspace controller binaries, then webhook binaries
-RUN make compile-devworkspace-controller
-RUN make compile-webhook-server
+# Pass the target ARCH directly to make for robust cross-compilation
+RUN make GOARCH=${TARGETARCH} compile-devworkspace-controller
+RUN make GOARCH=${TARGETARCH} compile-webhook-server
 
 # https://access.redhat.com/containers/?tab=tags#/registry.access.redhat.com/ubi9-minimal
 FROM registry.access.redhat.com/ubi9-minimal:9.6-1749489516

build/Dockerfile.arm64

@@ -0,0 +1,37 @@
+#
+# Copyright (c) 2019-2025 Red Hat, Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# https://access.redhat.com/containers/?tab=tags#/registry.access.redhat.com/ubi9-minimal
+FROM registry.access.redhat.com/ubi9-minimal:9.6-1749489516
+RUN microdnf -y update && \
+    microdnf clean all && \
+    rm -rf /var/cache/yum && \
+    echo "Installed Packages" && \
+    rpm -qa | sort -V && \
+    echo "End Of Installed Packages"
+WORKDIR /
+COPY _output/bin/devworkspace-controller /usr/local/bin/devworkspace-controller
+COPY _output/bin/webhook-server /usr/local/bin/webhook-server
+
+ENV USER_UID=1001 \
+    USER_NAME=devworkspace-controller
+
+COPY build/bin /usr/local/bin
+RUN  /usr/local/bin/user_setup
+
+USER ${USER_UID}
+
+ENTRYPOINT ["/usr/local/bin/entrypoint"]
+CMD ["/usr/local/bin/devworkspace-controller"]

build/index.next.no-cache.Dockerfile

@@ -0,0 +1,14 @@
+# The base image is expected to contain
+# /bin/opm (with a serve subcommand) and /bin/grpc_health_probe
+FROM quay.io/operator-framework/opm:latest
+
+# Configure the entrypoint and command
+ENTRYPOINT ["/bin/opm"]
+CMD ["serve", "/configs"]
+
+# Copy declarative config root into image at /configs
+ADD olm-catalog/next /configs
+
+# Set DC-specific label for the location of the DC root directory
+# in the image
+LABEL operators.operatorframework.io.index.configs.v1=/configs

build/make/deploy.mk

@@ -58,13 +58,13 @@ _gen_configuration_env:
 	cat $(CONTROLLER_ENV_FILE)
 
 _store_tls_cert:
-	mkdir -p /tmp/k8s-webhook-server/serving-certs/
+	mkdir -p $(TMPDIR)/k8s-webhook-server/serving-certs/
   ifeq ($(PLATFORM),kubernetes)
-	  $(K8S_CLI) get secret devworkspace-operator-webhook-cert -n $(NAMESPACE) -o json | jq -r '.data["tls.crt"]' | base64 -d > /tmp/k8s-webhook-server/serving-certs/tls.crt
-	  $(K8S_CLI) get secret devworkspace-operator-webhook-cert -n $(NAMESPACE) -o json | jq -r '.data["tls.key"]' | base64 -d > /tmp/k8s-webhook-server/serving-certs/tls.key
+	  $(K8S_CLI) get secret devworkspace-operator-webhook-cert -n $(NAMESPACE) -o json | jq -r '.data["tls.crt"]' | base64 -d > $(TMPDIR)/k8s-webhook-server/serving-certs/tls.crt
+	  $(K8S_CLI) get secret devworkspace-operator-webhook-cert -n $(NAMESPACE) -o json | jq -r '.data["tls.key"]' | base64 -d > $(TMPDIR)/k8s-webhook-server/serving-certs/tls.key
   else
-	  $(K8S_CLI) get secret devworkspace-webhookserver-tls -n $(NAMESPACE) -o json | jq -r '.data["tls.crt"]' | base64 -d > /tmp/k8s-webhook-server/serving-certs/tls.crt
-	  $(K8S_CLI) get secret devworkspace-webhookserver-tls -n $(NAMESPACE) -o json | jq -r '.data["tls.key"]' | base64 -d > /tmp/k8s-webhook-server/serving-certs/tls.key
+	  $(K8S_CLI) get secret devworkspace-webhookserver-tls -n $(NAMESPACE) -o json | jq -r '.data["tls.crt"]' | base64 -d > $(TMPDIR)/k8s-webhook-server/serving-certs/tls.crt
+	  $(K8S_CLI) get secret devworkspace-webhookserver-tls -n $(NAMESPACE) -o json | jq -r '.data["tls.key"]' | base64 -d > $(TMPDIR)/k8s-webhook-server/serving-certs/tls.key
   endif
 
 _check_controller_running:

build/make/olm.mk

@@ -46,7 +46,8 @@ build_bundle_and_index: _print_vars _check_skopeo_installed _check_opm_version
 		--bundle-repo $${DWO_BUNDLE_IMG%%:*} \
 		--bundle-tag $${DWO_BUNDLE_IMG##*:} \
 		--index-image $(DWO_INDEX_IMG) \
-		--container-tool $(DOCKER)
+		--container-tool $(DOCKER) \
+		--arch $(ARCH)
 
 ### register_catalogsource: create the catalogsource to make the operator be available on the marketplace
 register_catalogsource: _check_skopeo_installed

build/make/version.mk

@@ -23,3 +23,8 @@ export ARCH := amd64
 else ifeq (aarch64,$(ARCH))
 export ARCH := arm64
 endif
+
+# Set GOARCH to the host architecture *only if it's not already set*
+# This allows `make GOARCH=amd64 ...` to override the default.
+GOARCH ?= $(HOST_ARCH)
+export GOARCH

build/scripts/build_index_image.sh

@@ -5,6 +5,7 @@ set -e
 PODMAN=podman
 FORCE="false"
 MULTI_ARCH="false"
+ARCH="amd64"
 ARCHITECTURES="linux/amd64,linux/arm64,linux/ppc64le,linux/s390x"
 DEBUG="false"
 
@@ -43,9 +44,11 @@ Arguments:
                             buildx will be used for building and pushing the images, instead of
                             the container tool selected with --container-tool.
   --debug                 : Don't do any normal cleanup on exit, leaving repo in dirty state
-
-Examples:
-  1. Build and push bundle and index using default image repos
+  --arch <ARCH>           : The host architecture.
+                            This flag is ignored if --multi-arch is used.
+ 
+ Examples:
+   1. Build and push bundle and index using default image repos
       $0 --force
   2. Build index and bundle using custom images
       $0 --bundle-repo <my_bundle_repo> --bundle-tag dev --index-image <my_index_image>
@@ -64,6 +67,7 @@ parse_args() {
       '--force') FORCE="true";;
       '--multi-arch') MULTI_ARCH="true";;
       '--debug') DEBUG="true";;
+      '--arch') ARCH="$2"; shift 1;;
       *) echo "[ERROR] Unknown parameter is used: $1."; usage; exit 1;;
     esac
     shift 1
@@ -202,15 +206,43 @@ yq -Y -i --argjson entry "$ENTRY_JSON" '.entries |= . + [$entry]' "$CHANNEL_FILE
 echo "Validating current index"
 opm validate "$OUTDIR"
 
+# Function to build and push an image for a specific architecture
+build_for_arch() {
+    local IMAGE=$1
+    local TARGET_ARCH=$2
+
+    local CACHE_DIR="build/opm-cache-${TARGET_ARCH}"
+    local ARCH_IMAGE="${IMAGE}-${TARGET_ARCH}"
+
+    # Check if the build is native or a cross-build
+    if [ "${ARCH}" == "${TARGET_ARCH}" ]; then
+        # NATIVE BUILD: Pre-generate the cache
+        ${PODMAN} build . --platform linux/${TARGET_ARCH} -t "$ARCH_IMAGE" -f build/index.next.Dockerfile
+    else
+        # CROSS-BUILD: Build cache at runtime
+        "${PODMAN}" build --platform "linux/${TARGET_ARCH}" \
+            -t "${ARCH_IMAGE}" \
+            -f build/index.next.no-cache.Dockerfile .
+    fi
+
+    "${PODMAN}" push "${ARCH_IMAGE}"
+}
+
 # Build index container
 echo "Building index image $INDEX_IMAGE"
 if [ "$MULTI_ARCH" == "true" ]; then
   docker buildx build . -t "$INDEX_IMAGE" -f "$DOCKERFILE" \
   --platform "$ARCHITECTURES" \
   --push
 else
-  $PODMAN build . -t "$INDEX_IMAGE" -f "$DOCKERFILE"
-  $PODMAN push "$INDEX_IMAGE" 2>&1
+  build_for_arch $INDEX_IMAGE "amd64"
+  build_for_arch $INDEX_IMAGE "arm64"
+
+  # Combine the two images into a single multi-arch manifest list
+  "${PODMAN}" manifest rm "${INDEX_IMAGE}" || true
+  "${PODMAN}" rmi "${INDEX_IMAGE}" || true
+  "${PODMAN}" manifest create "${INDEX_IMAGE}" "${INDEX_IMAGE}-amd64" "${INDEX_IMAGE}-arm64"
+  "${PODMAN}" manifest push "${INDEX_IMAGE}"
 fi