Makefile

# Copyright 2017-2021 Authors of Cilium
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

include Makefile.defs

MIN_CLANG_VERSION := 18.1.8
COMPILER_DEP := clang.bazelrc

ENVOY_BINS = cilium-envoy bazel-bin/cilium-envoy cilium-envoy-starter bazel-bin/cilium-envoy-starter cilium-envoy-healthcheck bazel-bin/bin/cilium-envoy-healthcheck
ENVOY_TESTS = bazel-bin/tests/*_test

BUILD_DEP_FILES = ENVOY_VERSION WORKSPACE .bazelrc envoy.bazelrc bazel/toolchains/BUILD bazel/toolchains/cc_toolchain_config.bzl

SHELL=/bin/bash -o pipefail
BAZEL ?= $(QUIET) bazel
BAZEL_FILTER ?=
BAZEL_OPTS ?=
BAZEL_BUILD_OPTS ?=
ifdef BAZEL_REMOTE_CACHE
  BAZEL_BUILD_OPTS += --remote_cache=$(BAZEL_REMOTE_CACHE)
endif

BAZEL_TEST_OPTS ?= --jobs=HOST_RAM*.0002 --test_timeout=100 --local_test_jobs=1 --flaky_test_attempts=3
BAZEL_TEST_OPTS += --test_output=errors

BUILDARCH := $(subst aarch64,arm64,$(subst x86_64,amd64,$(shell uname -m)))
# Default for the host architecture
ifndef TARGETARCH
  TARGETARCH := $(BUILDARCH)
endif

# ARCH=multi is only valid for docker builds, and gets resolved to individual targets for builds
# within the Dockerfile.
ifdef ARCH
  ifneq ($(ARCH),multi)
    TARGETARCH := $(ARCH)
  else
    # Split the cores when building for both targets
    BAZEL_BUILD_OPTS += --jobs=HOST_CPUS*.5
  endif
endif

# Extra opts are passed to docker targets, which will choose the bazel platform themselves
EXTRA_BAZEL_BUILD_OPTS := $(BAZEL_BUILD_OPTS)

BAZEL_ASAN_BUILD_OPTS ?= $(EXTRA_BAZEL_BUILD_OPTS) -c dbg --config=asan --config=clang-asan
BAZEL_ASAN_TEST_OPTS ?= --jobs=HOST_RAM*.0001 --test_timeout=600 --local_test_jobs=2 --flaky_test_attempts=1 --test_output=errors

BAZEL_MSAN_BUILD_OPTS ?= --config=msan $(EXTRA_BAZEL_BUILD_OPTS) -c dbg
BAZEL_MSAN_TEST_OPTS ?= --jobs=HOST_RAM*.00005 --test_timeout=900 --local_test_jobs=1 --flaky_test_attempts=1 --test_output=errors
PROXYLIB_MSAN_CC ?= clang
PROXYLIB_MSAN_GO_BUILD_FLAGS ?= -msan -buildvcs=false

BAZEL_TSAN_BUILD_OPTS ?= --config=tsan $(EXTRA_BAZEL_BUILD_OPTS) -c dbg
BAZEL_TSAN_TEST_OPTS ?= --jobs=HOST_RAM*.00005 --test_timeout=900 --local_test_jobs=1 --flaky_test_attempts=1 --test_output=errors
PROXYLIB_TSAN_CC ?= clang
PROXYLIB_TSAN_CGO_CFLAGS ?= -fsanitize=thread
PROXYLIB_TSAN_GO_BUILD_FLAGS ?= -installsuffix=tsan -buildvcs=false

ifdef DEBUG
  BAZEL_BUILD_OPTS += -c dbg
else ifdef RELEASE_DEBUG
  BAZEL_BUILD_OPTS += --config=release_debug
else
  BAZEL_BUILD_OPTS += --config=release
endif

SUDO=
ifneq ($(shell whoami),root)
  SUDO=$(shell if sudo -h 1>/dev/null 2>/dev/null; then echo "sudo"; fi)
endif

BAZEL_PLATFORM := //bazel:linux_$(subst amd64,x86_64,$(subst arm64,aarch64,$(TARGETARCH)))
ifdef PKG_BUILD
  $(info BUILDING on $(BUILDARCH) for $(TARGETARCH) using $(BAZEL_PLATFORM))
  BAZEL_BUILD_OPTS += --platforms=$(BAZEL_PLATFORM)

  all: cilium-envoy-starter cilium-envoy-healthcheck cilium-envoy

  .PHONY: install-bazelisk
  install-bazelisk:
	echo "Bazel assumed to be installed in the builder image"

  define install_clang
	echo "Clang assumed to be installed in the builder image"
  endef
else
  ifneq ($(TARGETARCH),$(BUILDARCH))
    $(error local cross-builds are not supported: BUILDARCH=$(BUILDARCH), TARGETARCH=$(TARGETARCH))
  endif

  all: precheck cilium-envoy-starter cilium-envoy-healthcheck cilium-envoy

  include Makefile.docker

  # Fetch and install Bazel if needed
  .PHONY: install-bazelisk
  install-bazelisk:
	tools/install_bazelisk.sh

  # Install clang if needed
  define install_clang
	add_llvm_source() { \
		if [ ! -f /etc/apt/trusted.gpg.d/apt.llvm.org.asc ]; then \
		  $(SUDO) wget -q -O /etc/apt/trusted.gpg.d/apt.llvm.org.asc https://apt.llvm.org/llvm-snapshot.gpg.key; \
		fi; \
		local CODENAME=$$(lsb_release -cs); \
		apt_source="deb http://apt.llvm.org/$$CODENAME/ llvm-toolchain-$$CODENAME-18 main" && \
		$(SUDO) apt-add-repository -y "$${apt_source}" && \
		$(SUDO) apt update; \
	}; \
	version="$$(dpkg-query -W -f='$${Version}' clang-18 2>/dev/null || echo 0)"; \
	if dpkg --compare-versions "$$version" ge 1:$(MIN_CLANG_VERSION)~ && [ -x /usr/lib/llvm-18/bin/llvm-config ]; then \
		echo "clang-18 $$version satisfies minimum $(MIN_CLANG_VERSION); skipping apt install"; \
	else \
		add_llvm_source; \
		$(SUDO) apt install -y clang-18 clangd-18 llvm-18-dev lld-18 lldb-18 clang-format-18 clang-tools-18 clang-tidy-18 libc++-18-dev libc++abi-18-dev; \
	fi
  endef
endif

include Makefile.dev

BUILD_DEP_HASHES: $(BUILD_DEP_FILES)
	sha256sum $^ >$@

clang.bazelrc: bazel/setup_clang.sh
	@$(call install_clang)
	bazel/setup_clang.sh /usr/lib/llvm-18
	echo "# Use system LLVM instead of hermetic download to avoid libtinfo.so.5 mismatch" >> $@
	echo "build:clang-local --repo_env=BAZEL_LLVM_PATH=/usr/lib/llvm-18" >> $@
	echo "# Disable module_maps/layering_check — abseil module maps are incompatible with system clang" >> $@
	echo "build:clang-local --features=-module_maps --features=-layering_check" >> $@
	echo "build:clang-local --host_features=-module_maps --host_features=-layering_check" >> $@
	echo "build --config=clang-local" >> $@

.PHONY: cargo-repin
cargo-repin: install-bazelisk
	@$(ECHO_BAZEL)
	test -e bazel/envoy_dynamic_modules_rust_sdk.Cargo.Bazel.lock || touch bazel/envoy_dynamic_modules_rust_sdk.Cargo.Bazel.lock
	CARGO_BAZEL_REPIN=workspace CARGO_BAZEL_REPIN_ONLY=envoy_rust_crate_index bazel $(BAZEL_OPTS) sync --only=envoy_rust_crate_index

.PHONY: bazel-bin/cilium-envoy
bazel-bin/cilium-envoy: $(COMPILER_DEP) SOURCE_VERSION install-bazelisk
	@$(ECHO_BAZEL)
	$(BAZEL) $(BAZEL_OPTS) build $(BAZEL_BUILD_OPTS) //:cilium-envoy $(BAZEL_FILTER)

cilium-envoy: bazel-bin/cilium-envoy
	rm -f $@
	cp -f $< $@
	chmod 0755 $@

.PHONY: bazel-bin/cilium-envoy-starter
bazel-bin/cilium-envoy-starter: $(COMPILER_DEP) SOURCE_VERSION install-bazelisk
	@$(ECHO_BAZEL)
	$(BAZEL) $(BAZEL_OPTS) build $(BAZEL_BUILD_OPTS) //:cilium-envoy-starter $(BAZEL_FILTER)

cilium-envoy-starter: bazel-bin/cilium-envoy-starter
	rm -f $@
	cp -f $< $@
	chmod 0755 $@

.PHONY: bazel-bin/bin/cilium-envoy-healthcheck
bazel-bin/bin/cilium-envoy-healthcheck: SOURCE_VERSION install-bazelisk
	@$(ECHO_BAZEL)
	$(BAZEL) $(BAZEL_OPTS) build $(BAZEL_BUILD_OPTS) //:cilium-envoy-healthcheck $(BAZEL_FILTER)

cilium-envoy-healthcheck: bazel-bin/bin/cilium-envoy-healthcheck
	rm -f $@
	cp -f $< $@
	chmod 0755 $@

BAZEL_CACHE := $(subst --disk_cache=,,$(filter --disk_cache=%, $(BAZEL_BUILD_OPTS)))

GLIBC_VERSION ?= $(shell ldd --version | sed -n 's/.*GLIBC \([0-9.]\+\).*/\1/p')
GLIBC_DIR ?= $(LIBDIR)/glibc-$(GLIBC_VERSION)

$(DESTDIR)$(GLIBC_DIR): bazel-bin/cilium-envoy
	$(SUDO) $(INSTALL) -m 0755 -d $@
	LIBS=$$(readelf -d bazel-bin/cilium-envoy | sed -n 's/.*(NEEDED).*Shared library: \[\(.*\)\]/\1/p'); \
	ARCH_TAG=$$(echo $$LIBS | sed -n 's/.*ld-linux-\(.*\)\.so.*/\1/p' | tr - _); \
	echo "BUILD for $${ARCH_TAG}"; \
	for lib in $${LIBS}; do \
		$(SUDO) cp /usr/$${ARCH_TAG}-linux-gnu/lib/$$lib $@; \
	done

install: bazel-bin/cilium-envoy-starter bazel-bin/bin/cilium-envoy-healthcheck bazel-bin/cilium-envoy
	$(SUDO) $(INSTALL) -m 0755 -d $(DESTDIR)$(BINDIR)
	$(SUDO) $(INSTALL) -m 0755 -T bazel-bin/cilium-envoy-starter $(DESTDIR)$(BINDIR)/cilium-envoy-starter
	$(SUDO) $(INSTALL) -m 0755 -T bazel-bin/bin/cilium-envoy-healthcheck $(DESTDIR)$(BINDIR)/cilium-envoy-healthcheck
	$(SUDO) $(INSTALL) -m 0755 -T bazel-bin/cilium-envoy $(DESTDIR)$(BINDIR)/cilium-envoy

install-local: install
	$(SUDO) setcap 'cap_net_admin,cap_bpf+pe' $(DESTDIR)$(BINDIR)/cilium-envoy-starter
	$(SUDO) chmod u+s $(DESTDIR)$(BINDIR)/cilium-envoy-starter

install-glibc: install $(DESTDIR)$(GLIBC_DIR)
	LD_LINUX=$$(basename $$(patchelf --print-interpreter bazel-bin/cilium-envoy)); \
	$(SUDO) patchelf --set-interpreter $(GLIBC_DIR)/$${LD_LINUX} --set-rpath $(GLIBC_DIR) $(DESTDIR)$(BINDIR)/cilium-envoy-starter
	$(SUDO) patchelf --set-interpreter $(GLIBC_DIR)/$${LD_LINUX} --set-rpath $(GLIBC_DIR) $(DESTDIR)$(BINDIR)/cilium-envoy

# Remove the binaries
clean: force
	@$(ECHO_CLEAN) $(notdir $(shell pwd))
	-$(QUIET) rm -f $(ENVOY_BINS) $(ENVOY_TESTS)

proxylib/libcilium.so:
	make -C proxylib

.PHONY: envoy-test-deps
envoy-test-deps: $(COMPILER_DEP) SOURCE_VERSION proxylib/libcilium.so
	@$(ECHO_BAZEL)
	$(BAZEL) $(BAZEL_OPTS) build $(BAZEL_BUILD_OPTS) $(BAZEL_TEST_OPTS) //tests/... @envoy//test/integration:tcp_proxy_integration_test $(BAZEL_FILTER)

.PHONY: envoy-tests
envoy-tests: $(COMPILER_DEP) SOURCE_VERSION proxylib/libcilium.so
	@$(ECHO_BAZEL)
	# Upstream tcp_proxy_integration_test included to validate that our custom patches
	# didn't break anything
	$(BAZEL) $(BAZEL_OPTS) test $(BAZEL_BUILD_OPTS) $(BAZEL_TEST_OPTS) //tests/... @envoy//test/integration:tcp_proxy_integration_test $(BAZEL_FILTER)

.PHONY: envoy-asan-tests
envoy-asan-tests:
	$(MAKE) envoy-tests BAZEL_BUILD_OPTS="$(BAZEL_ASAN_BUILD_OPTS)" BAZEL_TEST_OPTS="$(BAZEL_ASAN_TEST_OPTS)"

.PHONY: proxylib-msan
proxylib-msan:
	$(MAKE) -C proxylib all CC="$(PROXYLIB_MSAN_CC)" GO_BUILD_FLAGS="$(PROXYLIB_MSAN_GO_BUILD_FLAGS)"

.PHONY: envoy-msan-tests
envoy-msan-tests: proxylib-msan
	$(MAKE) envoy-tests BAZEL_BUILD_OPTS="$(BAZEL_MSAN_BUILD_OPTS)" BAZEL_TEST_OPTS="$(BAZEL_MSAN_TEST_OPTS)"

.PHONY: proxylib-tsan
proxylib-tsan:
	$(MAKE) -C proxylib all CC="$(PROXYLIB_TSAN_CC)" CGO_CFLAGS="$(PROXYLIB_TSAN_CGO_CFLAGS)" GO_BUILD_FLAGS="$(PROXYLIB_TSAN_GO_BUILD_FLAGS)"

.PHONY: envoy-tsan-tests
envoy-tsan-tests: proxylib-tsan
	$(MAKE) envoy-tests BAZEL_BUILD_OPTS="$(BAZEL_TSAN_BUILD_OPTS)" BAZEL_TEST_OPTS="$(BAZEL_TSAN_TEST_OPTS)"

.PHONY: \
	install \
	force \
	force-non-root \
	force-root

force :;

force-root:
ifndef PKG_BUILD
  ifneq ($(USER),root)
	$(error This target must be run as root!)
  endif
endif

force-non-root:
ifeq ($(USER),root)
	$(error This target cannot be run as root!)
endif