Makefile.cloud

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.

ENVIRONMENT_CONFIG_JSON = $(shell scripts/get-config.sh -o json | jq -c)

SECURITY_ENABLED=true
HELM_NAMESPACE=tyger
HELM_RELEASE=tyger
TYGER_URI = https://$(shell echo '${ENVIRONMENT_CONFIG_JSON}' | jq -r '.api.domainName')
INSTALL_CLOUD=false
AUTO_MIGRATE=false
DOCKER_BUILD_ARCH_FLAGS = --arch amd64
DOCKER_BUILD_PUSH_FLAGS = --push --push-force

pim-elevate:
	default_justification="Deploying Tyger"
	read -p "Enter a justification (default: \"$${default_justification}\"): " justification
	justification=$${justification:-$${default_justification}}

	subscription=$$(echo '${ENVIRONMENT_CONFIG_JSON}' | jq -r '.cloud.subscriptionId')
	subscription_name=$$(az account show --subscription "$${subscription}" --query name -o tsv)
	az-pim-cli activate --name "$${subscription_name}" --role "Owner" --reason "$${justification}"

ensure-environment: check-az-login install-cli
	tyger cloud install -f <(scripts/get-config.sh)

ensure-environment-conditionally: install-cli
	if [[ "${INSTALL_CLOUD}" == "true" ]]; then
		$(MAKE) ensure-environment
	fi

remove-environment: install-cli
	tyger cloud uninstall -f <(scripts/get-config.sh)

# Sets up the az subscription and kubectl config for the current environment
set-context:
	subscription=$$(echo '${ENVIRONMENT_CONFIG_JSON}' | jq -r '.cloud.subscriptionId')
	resource_group=$$(echo '${ENVIRONMENT_CONFIG_JSON}' | jq -r '.cloud.resourceGroup')

	for cluster in $$(echo '${ENVIRONMENT_CONFIG_JSON}' | jq -c '.cloud.compute.clusters | .[]'); do
		if [[ "$$(echo "$$cluster" | jq -r '.apiHost')" == "true" ]]; then
			cluster_name=$$(echo "$$cluster" | jq -r '.name')
			if [[ "$$(az account show --query id -o tsv 2> /dev/null || true)" != "$${subscription}" ]]; then
				az account set --subscription "$${subscription}"
			fi
			
			if [[ "$$(kubectl config view --minify -o json 2> /dev/null | jq -r '.["current-context"]' 2> /dev/null || true)" != "$${cluster_name}" ]]; then
				az aks get-credentials -n "$${cluster_name}" -g "$${resource_group}" --overwrite-existing --only-show-errors
				kubelogin convert-kubeconfig -l azurecli
			fi

			if [[ "$$(kubectl config view --minify -o json | jq --arg context_name $${cluster_name} -r '.contexts[] | select(.name == $$context_name) | .context.namespace')" != "${HELM_NAMESPACE}" ]]; then
				kubectl config set-context --current --namespace=${HELM_NAMESPACE}
			fi
		fi
	done

login-wip-acr:
	registry=$$(scripts/get-config.sh --dev -e .wipContainerRegistry.fqdn)
	if ! ./scripts/check-docker-login.sh "$${registry}"; then
		registry_name=$$(echo "$$registry" | cut -d'.' -f1)
		az acr login --name "$${registry_name}"
	fi

set-localsettings: set-context
	helm_values=$$(helm get values -n ${HELM_NAMESPACE} ${HELM_RELEASE} -o json || true)

	if [[ -z "$${helm_values}" ]]; then
		echo "Run 'make up' and 'make set-context' before this target"; exit 1
	fi

	jq <<- EOF > ${CONTROL_PLANE_SERVER_PATH}/appsettings.local.json
		{
			"logging": { "Console": {"FormatterName": "simple" } },
			"serviceMetadata": {
				"externalBaseUrl": "http://localhost:5000"
			},
			"auth": {
				"enabled": "${SECURITY_ENABLED}",
				"authority": "https://login.microsoftonline.com/$$(echo '${ENVIRONMENT_CONFIG_JSON}' | jq -r '.api.auth.tenantId')",
				"audience": "$$(echo '${ENVIRONMENT_CONFIG_JSON}' | jq -r '.api.auth.apiAppUri')",
				"cliAppUri": "$$(echo '${ENVIRONMENT_CONFIG_JSON}' | jq -r '.api.auth.cliAppUri')"
			},
			"compute": {
				"kubernetes": {
					"kubeconfigPath": "$${HOME}/.kube/config",
					"namespace": "${HELM_NAMESPACE}",
					"jobServiceAccount": "${HELM_RELEASE}-job",
					"noOpConfigMap": "${HELM_RELEASE}-no-op",
					"workerWaiterImage": "$$(echo '${ENVIRONMENT_CONFIG_JSON}' | jq -r '.api.helm.tyger.values.workerWaiterImage')",
					"clusters": $$(echo '${ENVIRONMENT_CONFIG_JSON}' | jq -c '.cloud.compute.clusters'),
					"currentPodUid": "00000000-0000-0000-0000-000000000000",
					"customIdentities":  $$(echo '${ENVIRONMENT_CONFIG_JSON}' | jq '.cloud.compute.identities |  map({(.): ("tyger-custom-" + . + "-job")}) | add')
				}
			},
			"logArchive": {
				"cloudStorage": {
					"storageAccountEndpoint": $$(echo $${helm_values} | jq -c '.logArchive.storageAccountEndpoint')
				}
			},
			"buffers": {
				"cloudStorage": {
					"defaultLocation": "$$(echo $${helm_values} | jq -r '.location')",
					"storageAccounts": $$(echo $${helm_values} | jq -c '.buffers.storageAccounts')
				},
				"bufferSidecarImage": "$$(echo '${ENVIRONMENT_CONFIG_JSON}' | jq -r '.api.helm.tyger.values.bufferSidecarImage')",
				"bufferCopierImage": "$$(echo '${ENVIRONMENT_CONFIG_JSON}' | jq -r '.api.helm.tyger.values.bufferCopierImage')"
			},
			"database": {
				"host": "$$(echo $${helm_values} | jq -r '.database.host')",
				"databaseName": "$$(echo $${helm_values} | jq -r '.database.databaseName')",
				"port": "$$(echo $${helm_values} | jq -r '.database.port')",
				"username": "$$(az account show | jq -r '.user.name')",
				"autoMigrate": ${AUTO_MIGRATE},
				"tygerServerRoleName": "$$(echo $${helm_values} | jq -r '.identity.tygerServer.name')",
				"tygerServerIdentity": "$$(echo $${helm_values} | jq -r '.identity.tygerServer.name')"
			}
		}
	EOF

up: install-cli ensure-environment-conditionally docker-build-tyger-server docker-build-buffer-sidecar docker-build-worker-waiter docker-build-test
	tyger api install -f <(scripts/get-config.sh)
	$(MAKE) cli-ready

down: install-cli
	tyger api uninstall -f <(scripts/get-config.sh)

migrate: ensure-environment-conditionally docker-build-tyger-server
	tyger api migrations apply --latest --wait -f <(scripts/get-config.sh)

download-test-client-cert:
	cert_version=$$(echo '${DEVELOPER_CONFIG_JSON}' | jq -r '.pemCertSecret.version')
	cert_path=$${HOME}/tyger_test_client_cert_$${cert_version}.pem
	if [[ ! -f "$${cert_path}" ]]; then
		rm -f "$${cert_path}"
		subscription=$$(echo '${ENVIRONMENT_CONFIG_JSON}' | yq '.cloud.subscriptionId')
		vault_name=$$(echo '${DEVELOPER_CONFIG_JSON}' | jq -r '.keyVault')
		cert_name=$$(echo '${DEVELOPER_CONFIG_JSON}' | jq -r '.pemCertSecret.name')
		cert_version=$$(echo '${DEVELOPER_CONFIG_JSON}' | jq -r '.pemCertSecret.version')
		az keyvault secret download --vault-name "$${vault_name}" --name "$${cert_name}" --version "$${cert_version}" --file "$${cert_path}" --subscription "$${subscription}"
		chmod 600 "$${cert_path}"
	fi

check-test-client-cert:
	cert_version=$$(echo '${DEVELOPER_CONFIG_JSON}'' | jq -r '.pemCertSecret.version')
	cert_path=$${HOME}/tyger_test_client_cert_$${cert_version}.pem
	[ -f ${TEST_CLIENT_CERT_FILE} ]

login: install-cli download-test-client-cert
	cert_version=$$(echo '${DEVELOPER_CONFIG_JSON}' | jq -r '.pemCertSecret.version')
	cert_path=$${HOME}/tyger_test_client_cert_$${cert_version}.pem
	test_app_uri=$$(echo '${DEVELOPER_CONFIG_JSON}' | jq -r '.testAppUri')

	tyger login -f <(cat <<EOF
	serverUri: ${TYGER_URI}
	servicePrincipal: $${test_app_uri}
	certificatePath: $${cert_path}
	EOF
	)

login-local: install-cli download-test-client-cert
	cert_version=$$(echo '${DEVELOPER_CONFIG_JSON}' | jq -r '.pemCertSecret.version')
	cert_path=$${HOME}/tyger_test_client_cert_$${cert_version}.pem
	test_app_uri=$$(echo '${DEVELOPER_CONFIG_JSON}' | jq -r '.testAppUri')

	tyger login -f <(cat <<EOF
	serverUri: http://localhost:5000
	servicePrincipal: $${test_app_uri}
	certificatePath: $${cert_path}
	EOF
	)

start-proxy: install-cli download-test-client-cert
	cert_version=$$(echo '${DEVELOPER_CONFIG_JSON}' | jq -r '.pemCertSecret.version')
	cert_path=$${HOME}/tyger_test_client_cert_$${cert_version}.pem
	test_app_uri=$$(echo '${DEVELOPER_CONFIG_JSON}' | jq -r '.testAppUri')

	tyger-proxy start -f <(cat <<EOF
	serverUri: ${TYGER_URI}
	servicePrincipal: $${test_app_uri}
	certificatePath: $${cert_path}
	allowedClientCIDRs: ["127.0.0.1/32"]
	logPath: "/tmp/tyger-proxy"
	EOF
	)

kill-proxy:
	killall tyger-proxy

connect-db: set-context
	helm_values=$$(helm get values -n ${HELM_NAMESPACE} ${HELM_RELEASE} -o json || true)

	if [[ -z "$${helm_values}" ]]; then
		echo "Run 'make up' before this target"; exit 1
	fi

	export PGPASSWORD=$$(az account get-access-token --resource-type oss-rdbms | jq -r .accessToken)

	psql \
		--host="$$(echo $${helm_values} | jq -r '.database.host')" \
		--port="$$(echo $${helm_values} | jq -r '.database.port')" \
		--username="$$(az account show | jq -r '.user.name')" \
		--dbname="$$(echo $${helm_values} | jq -r '.database.databaseName')"

purge-runs: set-context
	kubectl delete pod,statefulset,secret,service -n "${HELM_NAMESPACE}" -l tyger-run --cascade=foreground

variant-test:
	# No variant tests for cloud configuration

get-last-server-exception: set-context
	(kubectl logs -l component=tyger-server | grep Exception || true) | tac | head -n 1 | jq -r '.exception'