Taskfile.test-env.yml

# Copyright AGNTCY Contributors (https://github.com/agntcy)
# SPDX-License-Identifier: Apache-2.0

version: "3"

tasks:
  default:
    cmd: echo "Run the main Taskfile instead of this one."

  test-env:kubernetes:setup-cluster:
    desc: Create a kind cluster and load Docker images
    deps:
      - deps:helm
      - deps:kubectl
      - deps:kind
    vars:
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "agntcy-cluster" }}'
      KIND_CREATE_OPTS: '{{ .KIND_CREATE_OPTS | default "" }}'
      KIND_CLUSTER_CONFIG_PATH:
        sh: mktemp
      # Port mapping is defined in the format of "hostPort1:containerPort1,hostPort2:containerPort2".
      # Container port should match the NodePort of the service defined in the Helm chart.
      KIND_EXTRA_PORT_MAPPING: '{{ .KIND_EXTRA_PORT_MAPPING | default "" }}'
      E2E_COVERAGE_ENABLED: '{{ .E2E_COVERAGE_ENABLED | default "false" }}'
      DEPLOY_BAKE_ENV: '{{ if eq .E2E_COVERAGE_ENABLED "true" }}{{ .COVERAGE_BAKE_ENV }}{{ else }}{{ .BAKE_ENV }}{{ end }}'
      DEPLOY_BAKE_GROUP: '{{ if eq .E2E_COVERAGE_ENABLED "true" }}coverage{{ else }}default{{ end }}'
    cmds:
      # Create cluster config
      - |
        cat <<EOF > {{.KIND_CLUSTER_CONFIG_PATH}}
        kind: Cluster
        apiVersion: kind.x-k8s.io/v1alpha4
        nodes:
          - role: control-plane
        {{ if .KIND_EXTRA_PORT_MAPPING }}
            extraPortMappings:
        {{ range .KIND_EXTRA_PORT_MAPPING | splitList "," }}
            - hostPort: {{ index (splitList ":" .) 0 }}
              containerPort: {{ index (splitList ":" .) 1 }}
              listenAddress: "127.0.0.1"
              protocol: TCP
        {{ end }}
        {{ end }}
        EOF

      # Create cluster
      - |
        {{ .KIND_BIN }} create cluster {{ .KIND_CREATE_OPTS }} --name {{ .KIND_CLUSTER_NAME }} --config {{ .KIND_CLUSTER_CONFIG_PATH }}
        {{ .KIND_BIN }} export kubeconfig --name {{ .KIND_CLUSTER_NAME }}
        {{ .KUBECTL_BIN }} cluster-info

      # Load images
      - |
        images=$({{.DEPLOY_BAKE_ENV}} docker buildx bake {{.DEPLOY_BAKE_GROUP}} --print | jq -r '.target | with_entries(.value |= .tags[0]) | to_entries[] | .value')
        echo "$images" | while read image; do
          {{ .KIND_BIN }} load docker-image $image --name {{ .KIND_CLUSTER_NAME }}
        done

  test-env:kubernetes:gen-htpasswd-creds:
    desc: Generate htpasswd credentials and files for DIR deployment
    vars:
      HTPASSWD_USERNAME: '{{ .HTPASSWD_USERNAME | default "apiserver" }}'
      HTPASSWD_SYNC_USERNAME: '{{ .HTPASSWD_SYNC_USERNAME | default "sync-user" }}'
      CREDS_FILE: '{{ .CREDS_FILE | default "/tmp/dir-htpasswd-creds.env" }}'
      HTPASSWD_FILE: '{{ .HTPASSWD_FILE | default "/tmp/dir-htpasswd" }}'
    cmds:
      - |
        # Generate fresh passwords
        HTPASSWD_PASSWORD="$(openssl rand -hex 16)"
        HTPASSWD_SYNC_PASSWORD="$(openssl rand -hex 16)"

        # Generate derived values
        HTPASSWD_AUTH_HEADER="$(echo -n "{{ .HTPASSWD_USERNAME }}:${HTPASSWD_PASSWORD}" | base64)"
        HTPASSWD_ADMIN="$(htpasswd -nbB "{{ .HTPASSWD_USERNAME }}" "${HTPASSWD_PASSWORD}" | sed 's/^{{ .HTPASSWD_USERNAME }}://')"
        HTPASSWD_SYNC="$(htpasswd -nbB "{{ .HTPASSWD_SYNC_USERNAME }}" "${HTPASSWD_SYNC_PASSWORD}" | sed 's/^{{ .HTPASSWD_SYNC_USERNAME }}://')"

        # Write credentials to env file (for helm --set commands)
        cat > {{ .CREDS_FILE }} << EOF
        export HTPASSWD_USERNAME="{{ .HTPASSWD_USERNAME }}"
        export HTPASSWD_PASSWORD="${HTPASSWD_PASSWORD}"
        export HTPASSWD_AUTH_HEADER="${HTPASSWD_AUTH_HEADER}"
        export HTPASSWD_SYNC_USERNAME="{{ .HTPASSWD_SYNC_USERNAME }}"
        export HTPASSWD_SYNC_PASSWORD="${HTPASSWD_SYNC_PASSWORD}"
        EOF

        # Write htpasswd file (for helm --set-file commands)
        cat > {{ .HTPASSWD_FILE }} << EOF
        {{ .HTPASSWD_USERNAME }}:${HTPASSWD_ADMIN}
        {{ .HTPASSWD_SYNC_USERNAME }}:${HTPASSWD_SYNC}
        EOF

  test-env:kubernetes:cleanup-htpasswd-creds:
    desc: Cleanup htpasswd credentials and files
    vars:
      CREDS_FILE: '{{ .CREDS_FILE | default "/tmp/dir-htpasswd-creds.env" }}'
      HTPASSWD_FILE: '{{ .HTPASSWD_FILE | default "/tmp/dir-htpasswd" }}'
    cmds:
      - rm -f {{ .CREDS_FILE }}
      - rm -f {{ .HTPASSWD_FILE }}

  test-env:kubernetes:local:
    aliases: [deploy:local]
    desc: Deploy a local Directory server in Kubernetes
    deps:
      - task: test-env:kubernetes:setup-cluster
        vars:
          KIND_EXTRA_PORT_MAPPING: "{{.API_HOSTPORT}}:{{.API_NODEPORT}},{{.METRICS_HOSTPORT}}:{{.METRICS_NODEPORT}}"
    vars:
      # Kind args
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "agntcy-cluster" }}'
      KIND_CREATE_OPTS: '{{ .KIND_CREATE_OPTS | default "" }}'
      # Helm args
      HELM_NAMESPACE: '{{ .HELM_NAMESPACE | default "dir-server" }}'
      HELM_CHART_PATH: "{{ .ROOT_DIR }}/install/charts/dir"
      HELM_VALUES_PATH: "{{ .ROOT_DIR }}/install/charts/dir/values.yaml"
      # Coverage config
      E2E_COVERAGE_ENABLED: '{{ .E2E_COVERAGE_ENABLED | default "false" }}'
      DEPLOY_IMAGE_TAG: '{{ if eq .E2E_COVERAGE_ENABLED "true" }}{{ .COVERAGE_IMAGE_TAG }}{{ else }}{{ .IMAGE_TAG }}{{ end }}'
      # API config
      API_HOSTPORT: '{{ .API_HOSTPORT | default "8888" }}'
      API_NODEPORT: '{{ .API_NODEPORT | default "30088" }}'
      METRICS_HOSTPORT: '{{ .METRICS_HOSTPORT | default "9090" }}'
      METRICS_NODEPORT: '{{ .METRICS_NODEPORT | default "30090" }}'
    cmds:
      # TODO: make logic idempotent so that running functional tests does not change previous contexts

      # Generate credentials and htpasswd file (using defaults)
      - task: test-env:kubernetes:gen-htpasswd-creds

      # Cleanup credentials on exit (using defaults)
      - defer:
          task: test-env:kubernetes:cleanup-htpasswd-creds

      # Build helm dependencies
      - task: helm:dep:build

      # Deploy chart
      - |
        # Load credentials
        source /tmp/dir-htpasswd-creds.env

        {{ .HELM_BIN }} upgrade dir \
          {{ .HELM_CHART_PATH }} \
          -f {{ .HELM_VALUES_PATH }} \
          --set apiserver.image.tag="{{ .DEPLOY_IMAGE_TAG }}" \
          --set apiserver.service.type="NodePort" \
          --set apiserver.service.nodePort="{{.API_NODEPORT}}" \
          --set apiserver.service.metricsNodePort="{{.METRICS_NODEPORT}}" \
          {{ if .DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL }}--set apiserver.config.publication.scheduler_interval="{{ .DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL }}"{{ end }} \
          {{ if .DIRECTORY_SERVER_NAMING_TTL }}--set apiserver.config.naming.ttl="{{ .DIRECTORY_SERVER_NAMING_TTL }}"{{ end }} \
          --set apiserver.config.routing.refresh_interval="1s" \
          --set apiserver.secrets.ociAuth.username="${HTPASSWD_USERNAME}" \
          --set apiserver.secrets.ociAuth.password="${HTPASSWD_PASSWORD}" \
          --set apiserver.zot.authHeader="${HTPASSWD_AUTH_HEADER}" \
          --set-file apiserver.zot.secretFiles.htpasswd="/tmp/dir-htpasswd" \
          --set apiserver.secrets.syncAuth.username="${HTPASSWD_SYNC_USERNAME}" \
          --set apiserver.secrets.syncAuth.password="${HTPASSWD_SYNC_PASSWORD}" \
          {{ if .DIRECTORY_SERVER_RATELIMIT_ENABLED }}--set apiserver.config.ratelimit.enabled="{{ .DIRECTORY_SERVER_RATELIMIT_ENABLED }}"{{ end }} \
          {{ if .DIRECTORY_SERVER_RATELIMIT_GLOBAL_RPS }}--set apiserver.config.ratelimit.global_rps="{{ .DIRECTORY_SERVER_RATELIMIT_GLOBAL_RPS }}"{{ end }} \
          {{ if .DIRECTORY_SERVER_RATELIMIT_GLOBAL_BURST }}--set apiserver.config.ratelimit.global_burst="{{ .DIRECTORY_SERVER_RATELIMIT_GLOBAL_BURST }}"{{ end }} \
          {{ if .DIRECTORY_SERVER_RATELIMIT_PER_CLIENT_RPS }}--set apiserver.config.ratelimit.per_client_rps="{{ .DIRECTORY_SERVER_RATELIMIT_PER_CLIENT_RPS }}"{{ end }} \
          {{ if .DIRECTORY_SERVER_RATELIMIT_PER_CLIENT_BURST }}--set apiserver.config.ratelimit.per_client_burst="{{ .DIRECTORY_SERVER_RATELIMIT_PER_CLIENT_BURST }}"{{ end }} \
          {{ if eq .E2E_COVERAGE_ENABLED "true" }}--set-json 'apiserver.extraEnv=[{"name":"GOCOVERDIR","value":"/tmp/coverage"}]' --set apiserver.coverageVolume=true{{ end }} \
          {{ if .DIRECTORY_SERVER_OASF_API_VALIDATION_SCHEMA_URL }}--set apiserver.config.oasf_api_validation.schema_url="{{ .DIRECTORY_SERVER_OASF_API_VALIDATION_SCHEMA_URL }}"{{ end }} \
          --set apiserver.reconciler.image.tag="{{ .DEPLOY_IMAGE_TAG }}" \
          --set apiserver.reconciler.config.regsync.interval="10s" \
          --set apiserver.reconciler.config.indexer.interval="10s" \
          --set apiserver.reconciler.config.name.interval="5s" \
          --set apiserver.reconciler.config.signature.interval="5s" \
          --namespace {{ .HELM_NAMESPACE }} \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

  test-env:kubernetes:local:ghcr:
    aliases: [deploy:local:ghcr]
    desc: Deploy a local Directory server in Kubernetes using GHCR as backend (no Zot)
    deps:
      - task: test-env:kubernetes:setup-cluster
        vars:
          KIND_EXTRA_PORT_MAPPING: "{{.API_HOSTPORT}}:{{.API_NODEPORT}},{{.METRICS_HOSTPORT}}:{{.METRICS_NODEPORT}}"
    vars:
      # Kind args
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "agntcy-cluster" }}'
      # Helm args
      HELM_NAMESPACE: '{{ .HELM_NAMESPACE | default "dir-server-ghcr" }}'
      HELM_CHART_PATH: "{{ .ROOT_DIR }}/install/charts/dir"
      HELM_VALUES_PATH: "{{ .ROOT_DIR }}/install/charts/dir/values.yaml"
      # Coverage config
      E2E_COVERAGE_ENABLED: '{{ .E2E_COVERAGE_ENABLED | default "false" }}'
      DEPLOY_IMAGE_TAG: '{{ if eq .E2E_COVERAGE_ENABLED "true" }}{{ .COVERAGE_IMAGE_TAG }}{{ else }}{{ .IMAGE_TAG }}{{ end }}'
      # API config
      API_HOSTPORT: '{{ .API_HOSTPORT | default "8888" }}'
      API_NODEPORT: '{{ .API_NODEPORT | default "30088" }}'
      METRICS_HOSTPORT: '{{ .METRICS_HOSTPORT | default "9090" }}'
      METRICS_NODEPORT: '{{ .METRICS_NODEPORT | default "30090" }}'
    cmds:
      # Validate required environment variables
      - |
        if [ -z "${DIRECTORY_SERVER_STORE_OCI_AUTH_CONFIG_USERNAME:-}" ] || [ -z "${DIRECTORY_SERVER_STORE_OCI_AUTH_CONFIG_PASSWORD:-}" ] || [ -z "${DIRECTORY_SERVER_STORE_OCI_REPOSITORY_NAME:-}" ]; then
          echo "ERROR: DIRECTORY_SERVER_STORE_OCI_AUTH_CONFIG_USERNAME, DIRECTORY_SERVER_STORE_OCI_AUTH_CONFIG_PASSWORD, and DIRECTORY_SERVER_STORE_OCI_REPOSITORY_NAME must be set for GHCR deployment"
          exit 1
        fi

        if [ -z "${DIRECTORY_SERVER_SYNC_AUTH_CONFIG_USERNAME:-}" ] || [ -z "${DIRECTORY_SERVER_SYNC_AUTH_CONFIG_PASSWORD:-}" ]; then
          echo "ERROR: DIRECTORY_SERVER_SYNC_AUTH_CONFIG_USERNAME and DIRECTORY_SERVER_SYNC_AUTH_CONFIG_PASSWORD must be set for GHCR deployment"
          echo "These credentials are shared with remote directories that want to sync to your GHCR registry"
          exit 1
        fi

        echo "Using GHCR repository: ${DIRECTORY_SERVER_STORE_OCI_REPOSITORY_NAME}"
        echo "Using GHCR username: ${DIRECTORY_SERVER_STORE_OCI_AUTH_CONFIG_USERNAME}"

      # Build helm dependencies
      - task: helm:dep:build

      # Deploy chart with GHCR backend (no Zot)
      - |
        {{ .HELM_BIN }} upgrade dir \
          {{ .HELM_CHART_PATH }} \
          -f {{ .HELM_VALUES_PATH }} \
          --set apiserver.image.tag="{{ .DEPLOY_IMAGE_TAG }}" \
          --set apiserver.service.type="NodePort" \
          --set apiserver.service.nodePort="{{.API_NODEPORT}}" \
          --set apiserver.service.metricsNodePort="{{.METRICS_NODEPORT}}" \
          --set apiserver.config.store.oci.type=ghcr \
          --set apiserver.config.store.oci.registry_address="${DIRECTORY_SERVER_STORE_OCI_REGISTRY_ADDRESS}" \
          --set apiserver.config.store.oci.repository_name="${DIRECTORY_SERVER_STORE_OCI_REPOSITORY_NAME}" \
          --set apiserver.config.store.oci.auth_config.username="${DIRECTORY_SERVER_STORE_OCI_AUTH_CONFIG_USERNAME}" \
          --set apiserver.config.store.oci.auth_config.password="${DIRECTORY_SERVER_STORE_OCI_AUTH_CONFIG_PASSWORD}" \
          --set apiserver.config.store.oci.auth_config.insecure=false \
          --set apiserver.zot.enabled=false \
          --set apiserver.secrets.ociAuth.username="${DIRECTORY_SERVER_STORE_OCI_AUTH_CONFIG_USERNAME}" \
          --set apiserver.secrets.ociAuth.password="${DIRECTORY_SERVER_STORE_OCI_AUTH_CONFIG_PASSWORD}" \
          --set apiserver.secrets.syncAuth.username="${DIRECTORY_SERVER_SYNC_AUTH_CONFIG_USERNAME}" \
          --set apiserver.secrets.syncAuth.password="${DIRECTORY_SERVER_SYNC_AUTH_CONFIG_PASSWORD}" \
          {{ if .DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL }}--set apiserver.config.publication.scheduler_interval="{{ .DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL }}"{{ end }} \
          --set apiserver.config.routing.refresh_interval="1s" \
          --set apiserver.config.database.postgres.host=dir-postgresql.{{ .HELM_NAMESPACE }}.svc.cluster.local \
          --set apiserver.config.database.postgres.port=5432 \
          --set apiserver.postgresql.enabled=true \
          --set apiserver.postgresql.auth.username=dir \
          --set apiserver.postgresql.auth.password=dirpassword \
          --set apiserver.postgresql.auth.database=dir \
          --set apiserver.reconciler.config.regsync.interval="10s" \
          --set apiserver.reconciler.config.indexer.interval="10s" \
          --set apiserver.reconciler.config.name.interval="5s" \
          --set apiserver.reconciler.config.signature.interval="5s" \
          --set apiserver.reconciler.image.tag="{{ .DEPLOY_IMAGE_TAG }}" \
          --set apiserver.config.oasf_api_validation.disable=true \
          --namespace {{ .HELM_NAMESPACE }} \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

  test-env:kubernetes:local:ghcr:cleanup:
    aliases: [deploy:local:ghcr:cleanup]
    desc: Cleanup Kubernetes environment for local GHCR deployment
    cmds:
      - "{{ .KIND_BIN }} delete cluster --name {{ .KIND_CLUSTER_NAME }}"

  deploy:kubernetes:context:
    desc: Switch context to given Kubernetes cluster
    vars:
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "agntcy-cluster" }}'
    cmds:
      - "{{ .KIND_BIN }} export kubeconfig --name {{ .KIND_CLUSTER_NAME }}"

  test-env:kubernetes:dir:
    desc: Deploy DIR helm chart
    vars:
      HELM_NAMESPACE: '{{ .HELM_NAMESPACE | default "dir-server" }}'
      HELM_CHART_PATH: "{{ .ROOT_DIR }}/install/charts/dir"
      HELM_VALUES_PATH: "{{ .ROOT_DIR }}/install/charts/dir/values.yaml"
      HELM_EXTRA_ARGS: '{{ .HELM_EXTRA_ARGS | default "" }}'
    cmds:
      # Generate credentials and htpasswd file (using defaults)
      - task: test-env:kubernetes:gen-htpasswd-creds

      # Cleanup credentials on exit (using defaults)
      - defer:
          task: test-env:kubernetes:cleanup-htpasswd-creds

      # Build helm dependencies
      - task: helm:dep:build

      # Deploy chart
      - |
        # Load credentials
        source /tmp/dir-htpasswd-creds.env

        {{ .HELM_BIN }} upgrade --install dir \
          {{ .HELM_CHART_PATH }} \
          -f {{ .HELM_VALUES_PATH }} \
          --set apiserver.image.tag="{{ .IMAGE_TAG }}" \
          {{ if .DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL }}--set apiserver.config.publication.scheduler_interval="{{ .DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL }}"{{ end }} \
          --set apiserver.secrets.ociAuth.username="${HTPASSWD_USERNAME}" \
          --set apiserver.secrets.ociAuth.password="${HTPASSWD_PASSWORD}" \
          --set apiserver.zot.authHeader="${HTPASSWD_AUTH_HEADER}" \
          --set-file apiserver.zot.secretFiles.htpasswd="/tmp/dir-htpasswd" \
          --set apiserver.secrets.syncAuth.username="${HTPASSWD_SYNC_USERNAME}" \
          --set apiserver.secrets.syncAuth.password="${HTPASSWD_SYNC_PASSWORD}" \
          --set apiserver.log_level="DEBUG" \
          --set apiserver.reconciler.image.tag="{{ .IMAGE_TAG }}" \
          --set apiserver.reconciler.config.regsync.interval="10s" \
          --set apiserver.reconciler.config.indexer.interval="10s" \
          --set apiserver.reconciler.config.name.interval="5s" \
          --set apiserver.reconciler.config.signature.interval="5s" \
          {{ .HELM_EXTRA_ARGS }} \
          --namespace {{ .HELM_NAMESPACE }} \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

  test-env:kubernetes:dirctl:
    desc: Deploy DIRCTL helm chart
    vars:
      HELM_NAMESPACE: '{{ .HELM_NAMESPACE | default "dir-client" }}'
      HELM_CHART_PATH: "{{ .ROOT_DIR }}/install/charts/dirctl"
      HELM_VALUES_PATH: "{{ .ROOT_DIR }}/install/charts/dirctl/values.yaml"
      HELM_EXTRA_ARGS: '{{ .HELM_EXTRA_ARGS | default "" }}'
    cmds:
      - |
        {{ .HELM_BIN }} upgrade --install dirctl \
          {{ .HELM_CHART_PATH }} \
          -f {{ .HELM_VALUES_PATH }} \
          --set image.tag="{{ .IMAGE_TAG }}" \
          {{ .HELM_EXTRA_ARGS }} \
          --namespace {{ .HELM_NAMESPACE }} \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

  test-env:kubernetes:spire:
    desc: Deploy SPIRE helm chart
    vars:
      TRUST_DOMAIN: '{{ .TRUST_DOMAIN | default "example.org" }}'
      SERVICE_TYPE: '{{ .SERVICE_TYPE | default "LoadBalancer" }}'
      BUNDLE_PATH: '{{ .BUNDLE_PATH | default "/tmp/spire-bundle.spiffe" }}'
    cmds:
      - |
        {{ .HELM_BIN }} upgrade --install spire-crds spire-crds \
          --repo https://spiffe.github.io/helm-charts-hardened/ \
          --namespace spire-crds \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

      - |
        {{ .HELM_BIN }} upgrade --install spire spire \
          --repo https://spiffe.github.io/helm-charts-hardened/ \
          --set global.spire.trustDomain="{{ .TRUST_DOMAIN }}" \
          --set spire-server.image.tag="{{ .SPIRE_VERSION }}" \
          --set spire-agent.image.tag="{{ .SPIRE_VERSION }}" \
          --set spire-server.service.type="{{ .SERVICE_TYPE }}" \
          --set spire-server.federation.enabled="true" \
          --set spire-server.controllerManager.watchClassless="true" \
          --set spire-server.controllerManager.className="dir-spire" \
          --namespace spire \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

      - |
        {{ .KUBECTL_BIN }} get configmap -n spire spire-bundle -o json | jq '.data."bundle.spiffe"' -r > {{ .BUNDLE_PATH }}

  test-env:kubernetes:local:cleanup:
    aliases: [deploy:local:cleanup, deploy:kubernetes:cleanup]
    desc: Cleanup Kubernetes environment for local deployment
    deps:
      - deps:kind
    vars:
      # Kind args
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "agntcy-cluster" }}'
    cmds:
      - "{{ .KIND_BIN }} delete cluster --name {{ .KIND_CLUSTER_NAME }}"

  test-env:kubernetes:network:bootstrap:
    internal: true
    desc: Deploy a bootstrap Directory server in Kubernetes
    deps:
      - task: test-env:kubernetes:setup-cluster
        vars:
          E2E_COVERAGE_ENABLED: "{{ .E2E_COVERAGE_ENABLED }}"
          KIND_EXTRA_PORT_MAPPING: "{{ .KIND_EXTRA_PORT_MAPPING }}"
      - deps:dirctl
    vars:
      # Helm args
      HELM_CHART_PATH: "{{ .ROOT_DIR }}/install/charts/dir"
      HELM_VALUES_PATH: "{{ .ROOT_DIR }}/install/charts/dir/values.yaml"
      # Coverage config
      E2E_COVERAGE_ENABLED: '{{ .E2E_COVERAGE_ENABLED | default "false" }}'
      DEPLOY_IMAGE_TAG: '{{ if eq .E2E_COVERAGE_ENABLED "true" }}{{ .COVERAGE_IMAGE_TAG }}{{ else }}{{ .IMAGE_TAG }}{{ end }}'
      # API config
      KIND_EXTRA_PORT_MAPPING: '{{ .KIND_EXTRA_PORT_MAPPING | default "" }}'
    cmds:
      # Generate private key if it doesn't exist
      - |
        test -f /tmp/node.privkey || {{ .BIN_DIR }}/dirctl network init --output /tmp/node.privkey

      # Generate the bootstrap peer ID and export it to the environment file
      - |
        bootstrap_peerid=$({{ .BIN_DIR }}/dirctl network info /tmp/node.privkey)
        echo "PEER ID: ${bootstrap_peerid}"
        echo BOOTSTRAP_PEER_ID="${bootstrap_peerid}" > .env

      # Generate credentials and htpasswd file
      - task: test-env:kubernetes:gen-htpasswd-creds
        vars:
          CREDS_FILE: "/tmp/dir-htpasswd-creds-bootstrap.env"
          HTPASSWD_FILE: "/tmp/zot-htpasswd-bootstrap"

      # Cleanup credentials on exit
      - defer:
          task: test-env:kubernetes:cleanup-htpasswd-creds
          vars:
            CREDS_FILE: "/tmp/dir-htpasswd-creds-bootstrap.env"
            HTPASSWD_FILE: "/tmp/zot-htpasswd-bootstrap"

      # Build helm dependencies
      - task: helm:dep:build

      # Deploy the bootstrap server using Helm
      - |
        # Load credentials
        source /tmp/dir-htpasswd-creds-bootstrap.env

        {{ .HELM_BIN }} upgrade agntcy-dir \
          {{ .HELM_CHART_PATH }} \
          -f {{ .HELM_VALUES_PATH }} \
          --set apiserver.image.tag="{{ .DEPLOY_IMAGE_TAG }}" \
          {{ if .PUBLICATION_SCHEDULER_INTERVAL }}--set apiserver.config.publication.scheduler_interval="{{ .PUBLICATION_SCHEDULER_INTERVAL }}"{{ end }} \
          --set apiserver.config.routing.refresh_interval="1s" \
          --set apiserver.secrets.privKey="$(cat /tmp/node.privkey)" \
          --set apiserver.config.routing.key_path="/etc/agntcy/dir/node.privkey" \
          --set apiserver.config.routing.listen_address="/ip4/0.0.0.0/tcp/8999" \
          --set apiserver.config.routing.directory_api_address="agntcy-dir-apiserver.bootstrap.svc.cluster.local:8888" \
          --set apiserver.config.store.oci.registry_address="agntcy-dir-zot.bootstrap.svc.cluster.local:5000" \
          --set apiserver.secrets.ociAuth.username="${HTPASSWD_USERNAME}" \
          --set apiserver.secrets.ociAuth.password="${HTPASSWD_PASSWORD}" \
          --set apiserver.zot.authHeader="${HTPASSWD_AUTH_HEADER}" \
          --set-file apiserver.zot.secretFiles.htpasswd="/tmp/zot-htpasswd-bootstrap" \
          --set apiserver.secrets.syncAuth.username="${HTPASSWD_SYNC_USERNAME}" \
          --set apiserver.secrets.syncAuth.password="${HTPASSWD_SYNC_PASSWORD}" \
          {{ if eq .E2E_COVERAGE_ENABLED "true" }}--set-json 'apiserver.extraEnv=[{"name":"GOCOVERDIR","value":"/tmp/coverage"}]' --set apiserver.coverageVolume=true{{ end }} \
          --set apiserver.config.oasf_api_validation.schema_url="https://schema.oasf.outshift.com" \
          --set apiserver.reconciler.image.tag="{{ .DEPLOY_IMAGE_TAG }}" \
          --set apiserver.reconciler.config.regsync.interval="10s" \
          --set apiserver.reconciler.config.indexer.interval="10s" \
          --set apiserver.reconciler.config.name.interval="5s" \
          --set apiserver.reconciler.config.signature.interval="5s" \
          --namespace "bootstrap" \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

  test-env:kubernetes:network:
    aliases: [deploy:network]
    desc: Deploy a network of Directory servers in Kubernetes (1 bootstrap + 3 peers)
    vars:
      HELM_CHART_PATH: "{{ .ROOT_DIR }}/install/charts/dir"
      HELM_VALUES_PATH: "{{ .ROOT_DIR }}/install/charts/dir/values.yaml"
      # Coverage config
      E2E_COVERAGE_ENABLED: '{{ .E2E_COVERAGE_ENABLED | default "false" }}'
      DEPLOY_IMAGE_TAG: '{{ if eq .E2E_COVERAGE_ENABLED "true" }}{{ .COVERAGE_IMAGE_TAG }}{{ else }}{{ .IMAGE_TAG }}{{ end }}'
      # Peers config
      KIND_EXTRA_PORT_MAPPING: '8890:30090,8891:30091,8892:30092'
      PEERS_MAP:
        map:
          peer1:
            apiNodePort: "30090"
            metricsNodePort: "31090"
          peer2:
            apiNodePort: "30091"
            metricsNodePort: "31091"
          peer3:
            apiNodePort: "30092"
            metricsNodePort: "31092"
    cmds:
      # Build helm dependencies once (shared across deployments)
      - task: helm:dep:build

      # Deploy bootstrap with explicit var passing (not as dependency)
      - task: test-env:kubernetes:network:bootstrap
        vars:
          PUBLICATION_SCHEDULER_INTERVAL: "{{ .PUBLICATION_SCHEDULER_INTERVAL }}"
          E2E_COVERAGE_ENABLED: "{{ .E2E_COVERAGE_ENABLED }}"
          KIND_EXTRA_PORT_MAPPING: "{{ .KIND_EXTRA_PORT_MAPPING }}"

      # Step 1: Deploy all peer servers without waiting (fast)
      - for:
          var: PEERS_MAP
        cmd: |
          export $(cat .env)

          # Generate fresh credentials for this peer
          task test-env:kubernetes:gen-htpasswd-creds \
            CREDS_FILE=/tmp/dir-htpasswd-creds-{{ .KEY }}.env \
            HTPASSWD_FILE=/tmp/zot-htpasswd-{{ .KEY }}

          # Load credentials
          source /tmp/dir-htpasswd-creds-{{ .KEY }}.env

          {{ .HELM_BIN }} upgrade agntcy-dir \
            {{ .HELM_CHART_PATH }} \
            -f {{ .HELM_VALUES_PATH }} \
            --set apiserver.image.tag="{{ .DEPLOY_IMAGE_TAG }}" \
            --set apiserver.service.type="NodePort" \
            --set apiserver.service.nodePort="{{ .ITEM.apiNodePort }}" \
            --set apiserver.service.metricsNodePort="{{ .ITEM.metricsNodePort }}" \
            {{ if .PUBLICATION_SCHEDULER_INTERVAL }}--set apiserver.config.publication.scheduler_interval="{{ .PUBLICATION_SCHEDULER_INTERVAL }}"{{ end }} \
            --set apiserver.config.routing.refresh_interval="1s" \
            --set apiserver.config.store.oci.registry_address="agntcy-dir-zot.{{ .KEY }}.svc.cluster.local:5000" \
            --set apiserver.config.routing.bootstrap_peers[0]="/dns4/agntcy-dir-apiserver-routing.bootstrap.svc.cluster.local/tcp/8999/p2p/${BOOTSTRAP_PEER_ID}" \
            --set apiserver.config.routing.directory_api_address="agntcy-dir-apiserver.{{ .KEY }}.svc.cluster.local:8888" \
            --set apiserver.secrets.ociAuth.username="${HTPASSWD_USERNAME}" \
            --set apiserver.secrets.ociAuth.password="${HTPASSWD_PASSWORD}" \
            --set apiserver.zot.authHeader="${HTPASSWD_AUTH_HEADER}" \
            --set-file apiserver.zot.secretFiles.htpasswd="/tmp/zot-htpasswd-{{ .KEY }}" \
            --set apiserver.secrets.syncAuth.username="${HTPASSWD_SYNC_USERNAME}" \
            --set apiserver.secrets.syncAuth.password="${HTPASSWD_SYNC_PASSWORD}" \
            {{ if eq .E2E_COVERAGE_ENABLED "true" }}--set-json 'apiserver.extraEnv=[{"name":"GOCOVERDIR","value":"/tmp/coverage"}]' --set apiserver.coverageVolume=true{{ end }} \
            --set apiserver.config.oasf_api_validation.schema_url="https://schema.oasf.outshift.com" \
            --set apiserver.reconciler.image.tag="{{ .DEPLOY_IMAGE_TAG }}" \
            --set apiserver.reconciler.config.regsync.interval="10s" \
            --set apiserver.reconciler.config.indexer.interval="10s" \
            --set apiserver.reconciler.config.name.interval="5s" \
            --set apiserver.reconciler.config.signature.interval="5s" \
            --namespace "{{ .KEY }}" \
            --create-namespace \
            --install

          # Cleanup temp files
          rm -f /tmp/zot-htpasswd-{{ .KEY }}
          rm -f /tmp/dir-htpasswd-creds-{{ .KEY }}.env

      # Step 2: Wait for all peer deployments to be ready
      - for:
          var: PEERS_MAP
        cmd: |
          echo "Waiting for {{ .KEY }} deployments to be ready..."
          {{ .KUBECTL_BIN }} wait --for=condition=available deployment/agntcy-dir-apiserver -n {{ .KEY }} --timeout=15m
          {{ .KUBECTL_BIN }} wait --for=condition=available deployment/agntcy-dir-reconciler -n {{ .KEY }} --timeout=15m
          {{ .KUBECTL_BIN }} wait --for=condition=ready pod -l app.kubernetes.io/name=zot -n {{ .KEY }} --timeout=15m
          {{ .KUBECTL_BIN }} wait --for=condition=ready pod -l app.kubernetes.io/name=postgresql -n {{ .KEY }} --timeout=15m
          echo "{{ .KEY }} is ready"

  test-env:kubernetes:network:cleanup:
    aliases: [deploy:network:cleanup]
    desc: Cleanup Kubernetes environment for network deployment
    vars:
      # Kind args
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "agntcy-cluster" }}'
    cmds:
      - "{{ .KIND_BIN }} delete cluster --name {{ .KIND_CLUSTER_NAME }}"