Makefile

# Copyright IBM Corp. 2026
# SPDX-License-Identifier: MPL-2.0

# Auto-load .env if present (strips 'export ' prefix for Make compatibility)
ifneq (,$(wildcard .env))
  $(shell sed 's/^export //; /^[[:space:]]*#/d; /^$$/d' .env > .env.make)
  include .env.make
  export
endif

# Always export the Kubernetes version matrix selection to recipe sub-shells,
# even when no .env file is present (e.g. `make k8s-matrix-test K8S_MATRIX_VERSIONS=...`).
export K8S_MATRIX_VERSIONS

# ================================
# PHONY Declarations
# ================================
.PHONY: help format deps clean lint test unit-test worker-config
.PHONY: setup-helm setup-kubeconform setup-trivy setup-kubescape setup-helm-unittest lint-helm-k8s trivy-scan kubescape-scan
.PHONY: acceptance-setup acceptance-cluster acceptance-helm acceptance-test acceptance-full acceptance-cleanup acceptance-all
.PHONY: k8s-matrix-test k8s-matrix-cleanup
.PHONY: openshift-smoke-test openshift-helm openshift-acceptance-test openshift-acceptance-full openshift-acceptance-cleanup
.PHONY: crc-setup crc-helm crc-test crc-full crc-cleanup
.PHONY: microshift-setup microshift-helm microshift-test microshift-full microshift-cleanup
.PHONY: eks-setup eks-helm eks-test eks-full eks-cleanup
.PHONY: tf-setup tf-destroy tf-output tf-plan
.PHONY: aks-setup aks-helm aks-test aks-full aks-cleanup
.PHONY: tf-setup-aks tf-plan-aks tf-destroy-aks tf-output-aks
.PHONY: gke-setup gke-helm gke-test gke-full gke-cleanup
.PHONY: tf-setup-gke tf-plan-gke tf-destroy-gke tf-output-gke

# ================================
# Help Target
# ================================
help:
	@echo "================================"
	@echo "Boundary Worker Helm Chart - Lint Targets"
	@echo "================================"
	@echo "Available targets:"
	@echo "  make format            - Format all YAML files with Prettier"
	@echo "  make deps              - Install required tools (macOS)"
	@echo "  make lint              - Run all lints and scans locally (deps + lint + scans)"
	@echo "  make test              - Run unit tests (alias for unit-test)"
	@echo "  make unit-test         - Run Helm unit tests with helm-unittest"
	@echo "  make clean             - Clean generated files"
	@echo "  make worker-config          - Authenticate, create a worker, and generate worker.hcl"
	@echo ""
	@echo "CI/CD targets:"
	@echo "  make setup-helm         - Install Helm for CI"
	@echo "  make setup-helm-unittest - Install helm-unittest plugin for CI"
	@echo "  make setup-kubeconform  - Install Kubeconform for CI"
	@echo "  make setup-trivy        - Install Trivy for CI"
	@echo "  make setup-kubescape    - Install Kubescape for CI"
	@echo "  make lint-helm-k8s      - Run Helm lint, render templates, and K8s validation"
	@echo "  make trivy-scan         - Run security scan with Trivy"
	@echo "  make kubescape-scan     - Run security scan with Kubescape"
	@echo ""
	@echo "Acceptance Testing targets:"
	@echo "  make acceptance-setup   - Install dependencies and setup KIND cluster"
	@echo "  make acceptance-helm    - Install Helm chart from worker.hcl and run Helm tests"
	@echo "  make acceptance-test    - Run acceptance tests"
	@echo "  make acceptance-full    - Run full acceptance workflow (setup + worker-config + helm + tests)"
	@echo "  make acceptance-cleanup    - Delete acceptance cluster"
	@echo "  make acceptance-all        - Run BOTH Kubernetes (KIND) and OpenShift (CRC) acceptance tests"
	@echo "  make k8s-matrix-test       - Run tcp-target-conn-test.sh across kindest/node K8s versions (set K8S_MATRIX_VERSIONS or K8S_VERSIONS)"
	@echo "  make k8s-matrix-cleanup    - Delete the acceptance cluster and generated worker config"
	@echo ""
	@echo "OpenShift Acceptance Testing targets:"
	@echo "  make openshift-smoke-test        - Run OpenShift cluster + chart smoke test (standalone: installs+verifies+cleans up)"
	@echo "  make openshift-helm              - Install Helm chart on an OpenShift cluster (tests/acceptance/values.openshift.yaml)"
	@echo "  make openshift-acceptance-test   - Run full OpenShift acceptance test suite (chart must already be deployed)"
	@echo "  make openshift-acceptance-full   - Full OpenShift workflow (worker-config + openshift-helm + tests)"
	@echo "  make openshift-acceptance-cleanup - Uninstall Helm release from OpenShift"
	@echo ""
	@echo "OpenShift Local (CRC) Acceptance Testing targets:"
	@echo "  make crc-setup     - Start CRC cluster and configure oc context"
	@echo "  make crc-helm      - Install Helm chart on CRC with tests/acceptance/values.openshift.yaml"
	@echo "  make crc-test      - Run full OpenShift acceptance suite against CRC"
	@echo "  make crc-full      - Full CRC workflow (crc-setup + worker-config + crc-helm + crc-test)"
	@echo "  make crc-cleanup   - Uninstall Helm release and stop CRC cluster"
	@echo ""
	@echo "OpenShift MicroShift (CI) Acceptance Testing targets:"
	@echo "  make microshift-setup    - Start MicroShift AIO cluster in Docker (no external cluster needed)"
	@echo "  make microshift-helm     - Install Helm chart on MicroShift with tests/acceptance/values.openshift.yaml"
	@echo "  make microshift-test     - Run full OpenShift acceptance suite against MicroShift"
	@echo "  make microshift-full     - Full MicroShift workflow (setup + worker-config + helm + test)"
	@echo "  make microshift-cleanup  - Remove MicroShift container and cleanup"
	@echo ""
	@echo "AWS EKS Acceptance Testing targets (shell-based, legacy):"
	@echo "  make eks-setup             - Provision EKS cluster via Terraform (tf-setup)"
	@echo "  make eks-helm              - Install Helm chart with EKS values (gp3, NLB)"
	@echo "  make eks-test              - Run full EKS acceptance test suite"
	@echo "  make eks-full              - Full EKS workflow (eks-setup + worker-config + helm + test)"
	@echo "  make eks-cleanup           - Uninstall Helm release from EKS (set DESTROY_CLUSTER=true to delete cluster)"
	@echo ""
	@echo "Terraform EKS targets (recommended):"
	@echo "  make tf-setup              - terraform init + apply (VPC + EKS + EBS CSI + LBC)"
	@echo "  make tf-plan               - terraform plan (preview changes without applying)"
	@echo "  make tf-destroy            - terraform destroy (tear down ALL AWS resources cleanly)"
	@echo "  make tf-output             - Show terraform outputs (cluster name, kubeconfig cmd, etc.)"
	@echo ""
	@echo "Azure AKS Integration Testing targets:"
	@echo "  make aks-setup             - Provision AKS cluster via Terraform (tf-setup-aks)"
	@echo "  make aks-helm              - Install Helm chart with AKS values (managed-csi-premium, LoadBalancer)"
	@echo "  make aks-test              - Run full AKS integration test suite"
	@echo "  make aks-full              - Full AKS workflow (aks-setup + worker-config + helm + test)"
	@echo "  make aks-cleanup           - Uninstall Helm release from AKS (set DESTROY_CLUSTER=true to delete cluster)"
	@echo ""
	@echo "Terraform AKS targets:"
	@echo "  make tf-setup-aks          - terraform init + apply (VNet + AKS + StorageClass)"
	@echo "  make tf-plan-aks           - terraform plan (preview changes without applying)"
	@echo "  make tf-destroy-aks        - terraform destroy (tear down ALL Azure resources cleanly)"
	@echo "  make tf-output-aks         - Show terraform outputs (cluster name, kubeconfig cmd, etc.)"
	@echo ""
	@echo "GCP GKE Integration Testing targets:"
	@echo "  make gke-setup             - Provision GKE cluster via Terraform (tf-setup-gke)"
	@echo "  make gke-helm              - Install Helm chart with GKE values (standard-rwo, LoadBalancer)"
	@echo "  make gke-test              - Run full GKE integration test suite"
	@echo "  make gke-full              - Full GKE workflow (gke-setup + worker-config + helm + test)"
	@echo "  make gke-cleanup           - Uninstall Helm release from GKE (set DESTROY_CLUSTER=true to delete cluster)"
	@echo ""
	@echo "Terraform GKE targets:"
	@echo "  make tf-setup-gke          - terraform init + apply (GKE cluster + node pool)"
	@echo "  make tf-plan-gke           - terraform plan (preview changes without applying)"
	@echo "  make tf-destroy-gke        - terraform destroy (tear down ALL GCP resources cleanly)"
	@echo "  make tf-output-gke         - Show terraform outputs (cluster name, etc.)"
	@echo "================================"

# ================================
# Local Development Targets
# ================================

deps:
	@echo "Installing required tools..."
	@command -v helm >/dev/null 2>&1 || brew install helm
	@command -v kubeconform >/dev/null 2>&1 || brew install kubeconform
	@command -v yamllint >/dev/null 2>&1 || brew install yamllint
	@command -v trivy >/dev/null 2>&1 || brew install trivy
	@command -v kubescape >/dev/null 2>&1 || brew install kubescape
	@command -v prettier >/dev/null 2>&1 || npm install -g prettier
	@helm plugin list | grep -q unittest || helm plugin install https://github.com/helm-unittest/helm-unittest.git
	@echo "✅ All tools installed"

format:
	@echo "================================"
	@echo "Formatting YAML files with Prettier"
	@echo "================================"
	@if ! command -v prettier >/dev/null 2>&1; then \
		echo "❌ Prettier not found. Install with: npm install -g prettier"; \
		exit 1; \
	fi
	@echo "Formatting YAML files..."
	@prettier --write "**/*.{yaml,yml}" \
		--ignore-path .gitignore \
		--print-width 80 \
		--tab-width 2 \
		--prose-wrap preserve
	@echo "✅ All YAML files formatted"
	@echo ""

clean:
	@echo "Cleaning generated files..."
	@rm -f rendered.yaml yamllint-output.txt trivy-output.txt kubescape-output.json
	@echo "✅ Clean complete"

lint: deps
	@echo "================================"
	@echo "Running All Lints and Scans"
	@echo "================================"
	@echo ""
	@$(MAKE) lint-helm-k8s
	@echo ""
	@$(MAKE) trivy-scan
	@echo ""
	@$(MAKE) kubescape-scan
	@echo ""
	@echo "================================"
	@echo "✅ All lints and scans completed successfully!"
	@echo "================================"

# ================================
# Unit Testing Targets
# ================================

test: unit-test

unit-test:
	@echo "================================"
	@echo "Running Helm Unit Tests"
	@echo "================================"
	@if ! helm plugin list | grep -q unittest; then \
		echo "❌ helm-unittest plugin not found. Installing..."; \
		helm plugin install https://github.com/helm-unittest/helm-unittest.git; \
	fi
	@echo "Running unit tests..."
	@helm unittest . -f 'tests/unit/*_test.yaml'
	@echo "✅ Unit tests passed!"

# ================================
# CI/CD Setup Targets
# ================================

setup-helm-unittest:
	@echo "Installing helm-unittest plugin..."
	@helm plugin install https://github.com/helm-unittest/helm-unittest.git || true
	@helm plugin list | grep unittest
	@echo "✅ helm-unittest plugin installed"

setup-helm:
	@echo "Installing Helm..."
	@curl -fsSL -o /tmp/get-helm-3.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
	@chmod +x /tmp/get-helm-3.sh
	@/tmp/get-helm-3.sh
	@helm version
	@echo "✅ Helm installed"

setup-kubeconform:
	@echo "Installing Kubeconform..."
	@curl -fsSL -o /tmp/kubeconform.tar.gz https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz
	@tar -xzf /tmp/kubeconform.tar.gz -C /tmp
	@sudo mv /tmp/kubeconform /usr/local/bin/
	@kubeconform -v
	@echo "✅ Kubeconform installed"

setup-trivy:
	@echo "Installing Trivy..."
	@sudo apt-get install -y wget apt-transport-https gnupg lsb-release
	@wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
	@echo "deb https://aquasecurity.github.io/trivy-repo/deb $$(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
	@sudo apt-get update
	@sudo apt-get install -y trivy
	@trivy --version
	@echo "✅ Trivy installed"

setup-kubescape:
	@echo "Installing Kubescape..."
	@curl -fsSL -o /tmp/kubescape-install.sh https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh
	@chmod +x /tmp/kubescape-install.sh
	@/tmp/kubescape-install.sh
	@export PATH=$$PATH:$$HOME/.kubescape/bin && \
		sudo cp $$HOME/.kubescape/bin/kubescape /usr/local/bin/ && \
		kubescape version
	@echo "✅ Kubescape installed"

# ================================
# CI/CD Lint & Scan Targets
# ================================

lint-helm-k8s:
	@echo "================================"
	@echo "Running Helm Lint"
	@echo "================================"
	helm lint .
	@echo "✅ Helm lint passed!"
	@echo ""
	@echo "================================"
	@echo "Rendering Helm Templates"
	@echo "================================"
	helm template boundary-worker . > rendered.yaml
	@echo "✅ Templates rendered successfully!"
	@echo "Rendered file size: $$(wc -l < rendered.yaml) lines"
	@echo ""
	@echo "================================"
	@echo "Running Kubernetes Validation"
	@echo "================================"
	kubeconform -strict rendered.yaml
	@echo "✅ Kubernetes validation passed!"

trivy-scan:
	@echo "================================"
	@echo "Running Security Scan with Trivy"
	@echo "================================"
	@trivy config rendered.yaml --exit-code 0 2>&1 | tee trivy-output.txt
	@CRITICAL_COUNT=$$(grep -E 'CRITICAL: [0-9]+' trivy-output.txt | sed -E 's/.*CRITICAL: ([0-9]+).*/\1/' | head -1); \
	HIGH_COUNT=$$(grep -E 'HIGH: [0-9]+' trivy-output.txt | sed -E 's/.*HIGH: ([0-9]+).*/\1/' | head -1); \
	MEDIUM_COUNT=$$(grep -E 'MEDIUM: [0-9]+' trivy-output.txt | sed -E 's/.*MEDIUM: ([0-9]+).*/\1/' | head -1); \
	LOW_COUNT=$$(grep -E 'LOW: [0-9]+' trivy-output.txt | sed -E 's/.*LOW: ([0-9]+).*/\1/' | head -1); \
	CRITICAL_COUNT=$${CRITICAL_COUNT:-0}; \
	HIGH_COUNT=$${HIGH_COUNT:-0}; \
	MEDIUM_COUNT=$${MEDIUM_COUNT:-0}; \
	LOW_COUNT=$${LOW_COUNT:-0}; \
	echo ""; \
	echo "Security Scan Results:"; \
	echo "  CRITICAL: $$CRITICAL_COUNT"; \
	echo "  HIGH: $$HIGH_COUNT"; \
	echo "  MEDIUM: $$MEDIUM_COUNT"; \
	echo "  LOW: $$LOW_COUNT"; \
	echo ""; \
	if [ $$CRITICAL_COUNT -gt 0 ] || [ $$HIGH_COUNT -gt 0 ]; then \
		echo "❌ Security scan FAILED: $$CRITICAL_COUNT CRITICAL, $$HIGH_COUNT HIGH issues"; \
		exit 1; \
	elif [ $$MEDIUM_COUNT -gt 0 ] || [ $$LOW_COUNT -gt 0 ]; then \
		echo "⚠️  Security scan completed with warnings: $$MEDIUM_COUNT MEDIUM, $$LOW_COUNT LOW issues"; \
	else \
		echo "✅ Security scan passed!"; \
	fi

kubescape-scan:
	@echo "================================"
	@echo "Running Security Scan with Kubescape"
	@echo "================================"
	@kubescape scan rendered.yaml \
		--format json \
		--output kubescape-output.json \
		--exceptions ./kubescape-exceptions.json \
		--verbose; KUBESCAPE_EXIT=$$?; \
	if [ $$KUBESCAPE_EXIT -ne 0 ] && [ ! -f kubescape-output.json ]; then \
		echo "❌ Kubescape failed to run (exit code: $$KUBESCAPE_EXIT)"; \
		exit $$KUBESCAPE_EXIT; \
	fi
	@echo ""
	@echo "================================"
	@echo "Kubescape Scan Results"
	@echo "================================"
	@if [ -f kubescape-output.json ]; then \
		if command -v jq >/dev/null 2>&1; then \
			COMPLIANCE_SCORE=$$(jq -r '.summaryDetails.complianceScore // 0' kubescape-output.json); \
			PASSED_RESOURCES=$$(jq -r '.summaryDetails.ResourceCounters.passedResources // 0' kubescape-output.json); \
			FAILED_CONTROLS=$$(jq '[.summaryDetails.controls[] | select(.failedResources != null and .failedResources > 0)] | length' kubescape-output.json); \
		else \
			echo "⚠️  jq not found, using grep fallback (less reliable)"; \
			COMPLIANCE_SCORE="N/A"; \
			PASSED_RESOURCES=$$(grep -o '"passedResources":[0-9]*' kubescape-output.json | head -1 | cut -d':' -f2 || echo "0"); \
			FAILED_CONTROLS=0; \
		fi; \
		echo "  Compliance Score: $$COMPLIANCE_SCORE%"; \
		echo "  Passed Resources: $$PASSED_RESOURCES"; \
		echo "  Failed Controls: $$FAILED_CONTROLS"; \
		echo ""; \
		if [ "$$FAILED_CONTROLS" -gt 0 ]; then \
			echo "❌ Kubescape scan FAILED: $$FAILED_CONTROLS control(s) have failed resources"; \
			exit 1; \
		else \
			echo "✅ Kubescape scan passed! All controls passed (compliance: $$COMPLIANCE_SCORE%)"; \
		fi; \
	else \
		echo "⚠️  Kubescape output file not found"; \
	fi


# ================================
# Acceptance Testing Targets
# ================================

acceptance-setup:
	@echo "================================"
	@echo "Setting up Acceptance Environment"
	@echo "================================"
	@echo ""
	@echo "Checking dependencies..."
	@# Check for kubectl
	@if ! command -v kubectl >/dev/null 2>&1; then \
		echo "❌ kubectl is not installed"; \
		echo "Please install kubectl: https://kubernetes.io/docs/tasks/tools/"; \
		exit 1; \
	fi
	@echo "✅ kubectl is installed ($$(kubectl version --client --short 2>/dev/null || kubectl version --client))"
	@# Check for kind
	@if ! command -v kind >/dev/null 2>&1; then \
		echo "❌ kind is not installed"; \
		echo "Installing kind..."; \
		if [ "$$(uname)" = "Darwin" ]; then \
			brew install kind; \
		else \
			curl -Lo ./kind https://kind.sigs.k8s.io/dl/latest/kind-linux-amd64; \
			chmod +x ./kind; \
			sudo mv ./kind /usr/local/bin/kind; \
		fi; \
	fi
	@echo "✅ kind is installed ($$(kind version))"
	@# Check for helm
	@if ! command -v helm >/dev/null 2>&1; then \
		echo "❌ helm is not installed"; \
		echo "Installing helm..."; \
		curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash; \
	fi
	@echo "✅ helm is installed ($$(helm version --short 2>/dev/null || helm version))"
	@# Check for boundary CLI
	@if ! command -v boundary >/dev/null 2>&1; then \
		echo "⚠️  boundary CLI is not installed"; \
		echo "Installing boundary CLI..."; \
		ENV=$$(uname); \
		if [ "$$ENV" = "Darwin" ]; then \
			brew tap hashicorp/tap && brew install hashicorp/tap/boundary; \
		elif [ "$$ENV" = "Linux" ]; then \
			echo "Installing boundary CLI from HashiCorp APT repository..."; \
			wget -O - https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg; \
			echo "deb [arch=$$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $$(grep -oP '(?<=UBUNTU_CODENAME=).*' /etc/os-release || lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list; \
			sudo apt update && sudo apt install -y boundary; \
		else \
			echo "❌ Failed to install Boundary"; \
			exit 1; \
		fi; \
	fi
	@echo "✅ boundary CLI is installed ($$(boundary version 2>/dev/null | head -n1 || echo 'version unknown'))"
	@echo ""
	@echo "Setting up KIND cluster..."
	@if kind get clusters | grep -q "^acceptance$$"; then \
		echo "⚠️  Acceptance cluster already exists"; \
	else \
		kind create cluster --config tests/acceptance/kind-acceptance-config.yaml; \
		echo "✅ Acceptance cluster created"; \
	fi
	@echo ""
	@echo "Verifying cluster..."
	@kubectl cluster-info --context kind-acceptance
	@echo "✅ Cluster is ready"
	@echo ""
	@echo "Installed tools:"
	@echo "  - kubectl: $$(kubectl version --client --short 2>/dev/null | head -n1 || echo 'installed')"
	@echo "  - kind: $$(kind version)"
	@echo "  - helm: $$(helm version --short 2>/dev/null | head -n1 || echo 'installed')"
	@echo "  - boundary: $$(boundary version 2>/dev/null | head -n1 || echo 'installed')"
	@echo ""
	@echo "Next steps:"
	@echo "  - Generate worker config: make worker-config"
	@echo "  - Install Helm chart and run Helm tests: make acceptance-helm"
	@echo "  - Run tests: make acceptance-test"
	@echo "  - Full workflow: make acceptance-full"
	@echo "  - Cleanup: make acceptance-cleanup"

worker-config:
	@echo "================================"
	@echo "Generating Worker Configuration"
	@echo "================================"
	@if [ -z "$$BOUNDARY_ADDR" ]; then \
		echo "❌ BOUNDARY_ADDR environment variable is not set"; \
		echo ""; \
		echo "Please set it to your Boundary controller address:"; \
		echo "  export BOUNDARY_ADDR=https://your-cluster.boundary.hashicorp.cloud"; \
		echo ""; \
		exit 1; \
	fi
	@if [ -z "$$BOUNDARY_LOGIN_NAME" ]; then \
		echo "❌ BOUNDARY_LOGIN_NAME environment variable is not set"; \
		echo ""; \
		echo "Please set it to your Boundary login name:"; \
		echo "  export BOUNDARY_LOGIN_NAME=admin"; \
		echo ""; \
		exit 1; \
	fi
	@if [ -z "$$BOUNDARY_PASSWORD" ]; then \
		echo "❌ BOUNDARY_PASSWORD environment variable is not set"; \
		echo ""; \
		echo "Please set it to your Boundary admin password:"; \
		echo "  export BOUNDARY_PASSWORD=your-password"; \
		echo ""; \
		exit 1; \
	fi
	@if [ -z "$$BOUNDARY_CLUSTER_ID" ]; then \
		echo "❌ BOUNDARY_CLUSTER_ID environment variable is not set"; \
		echo ""; \
		echo "Please set it to your Boundary cluster ID:"; \
		echo "  export BOUNDARY_CLUSTER_ID=your-cluster-id"; \
		echo ""; \
		exit 1; \
	fi

	@echo ""
	@echo "Authenticating with Boundary..."
	@echo "Boundary Address: $$BOUNDARY_ADDR"
	@echo "Login Name: $$BOUNDARY_LOGIN_NAME"
	@AUTH_OUT=$$(boundary authenticate password \
		-login-name $$BOUNDARY_LOGIN_NAME \
		-password env://BOUNDARY_PASSWORD \
		-keyring-type=none 2>&1); \
	STATUS=$$?; \
	if [ $$STATUS -ne 0 ]; then \
		echo "❌ Boundary authentication failed"; \
		printf '%s\n' "$$AUTH_OUT"; \
		exit $$STATUS; \
	fi; \
	AUTH_TOKEN=$$(printf '%s\n' "$$AUTH_OUT" | awk '/The token is:/ { getline; gsub(/^[[:space:]]+|[[:space:]]+$$/, "", $$0); print $$0; exit }'); \
	if [ -z "$$AUTH_TOKEN" ]; then \
		echo "❌ Failed to extract auth token from Boundary authenticate output"; \
		exit 1; \
	fi; \
	export AUTH_TOKEN; \
	echo "✅ Successfully authenticated with Boundary"; \
	echo ""; \
	echo "Creating controller-led worker..."; \
	TOKEN_OUT=$$(boundary workers create controller-led --token env://AUTH_TOKEN 2>&1); \
	STATUS=$$?; \
	if [ $$STATUS -ne 0 ]; then \
		echo "❌ Failed to create controller-led worker"; \
		printf '%s\n' "$$TOKEN_OUT"; \
		exit $$STATUS; \
	fi; \
	ACTIVATION_TOKEN=$$(printf '%s\n' "$$TOKEN_OUT" | awk -F': *' '/Controller-Generated Activation Token:/ { if ($$2 != "") { print $$2; exit } if (getline > 0) { gsub(/^[[:space:]]+|[[:space:]]+$$/, "", $$0); print $$0; exit } }'); \
	WORKER_ID=$$(printf '%s\n' "$$TOKEN_OUT" | awk -F': *' '/^  ID:/ { print $$2; exit }'); \
	if [ -z "$$ACTIVATION_TOKEN" ]; then \
		echo "❌ Failed to extract controller-generated activation token"; \
		exit 1; \
	fi; \
	export ACTIVATION_TOKEN; \
	if [ -n "$$WORKER_ID" ]; then \
		echo "$$WORKER_ID" > "$${BOUNDARY_WORKER_ID_FILE:-/tmp/boundary-worker-id.txt}"; \
		echo "✅ Created worker $$WORKER_ID (id saved for ID-scoped verification & cleanup)"; \
	fi; \
	echo ""; \
	echo "Generating worker configuration from template..."; \
	sed -e "s|<activation-token>|$$ACTIVATION_TOKEN|g" -e "s|<cluster-id>|$$BOUNDARY_CLUSTER_ID|g" tests/acceptance/worker-template.hcl > worker.hcl; \
	echo "✅ Created worker config"

acceptance-helm:
	@echo "============================================"
	@echo "Installing Helm Chart in Acceptance Cluster"
	@echo "============================================"
	@echo ""
	@echo "Checking if Helm is installed..."
	@command -v helm >/dev/null 2>&1 || (echo "❌ Helm not found. Run 'make acceptance-setup' first"; exit 1)
	@if [ ! -f worker.hcl ]; then \
		echo "❌ worker.hcl not found. Run 'make worker-config' first"; \
		exit 1; \
	fi
	@echo "✅ Helm is available"
	@echo ""
	@echo "Installing boundary-worker chart with test values..."
	@helm upgrade --install boundary-worker . \
		--namespace boundary \
		--create-namespace \
		--kube-context kind-acceptance \
		--set worker.service.proxy.type=NodePort \
		--set worker.persistence.recording.enabled=true \
		--set worker.persistence.recording.storageClass=standard \
		--set worker.persistence.authStorage.enabled=true \
		--set worker.persistence.authStorage.storageClass=standard \
		--set tls.ops.disabled=true \
		--set-file worker.config=worker.hcl \
		--timeout 5m
	@echo "✅ Helm chart installed successfully"
	@echo ""
	@echo "Deployed resources:"
	@kubectl get all -n boundary --context kind-acceptance
	@echo ""
	@echo "Waiting for deployment to be ready..."
	@kubectl wait --for=condition=available --timeout=5m \
		deployment/boundary-worker-deployment \
		-n boundary \
		--context kind-acceptance
	@echo "✅ Deployment is ready"
	@echo ""
	@echo "Running Helm Tests..."
	@echo ""
	@echo "Cleaning up stale test pods..."
	@kubectl delete pods -n boundary --context kind-acceptance \
		-l app.kubernetes.io/component=test \
		--field-selector=status.phase=Failed \
		--ignore-not-found 2>/dev/null || true
	@echo "Running Helm test pods in boundary namespace..."
	@helm test boundary-worker \
		--namespace boundary \
		--kube-context kind-acceptance \
		--timeout 10m || true
	@echo ""
	@echo "Checking test results (controller-connection excluded)..."
	@FAILED=$$(kubectl get pods -n boundary --context kind-acceptance \
		-l app.kubernetes.io/component=test \
		--field-selector=status.phase=Failed \
		-o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null \
		| grep -v "controller-connection" || true); \
	if [ -n "$$FAILED" ]; then \
		echo "❌ Helm tests failed:"; \
		echo "$$FAILED"; \
		exit 1; \
	fi
	@echo "✅ Helm tests passed (controller-connection test excluded)"
	@echo ""
	@echo "Note: Test pod logs are not displayed as pods are deleted after completion."
	@echo "To view logs during test execution, run: kubectl logs -n boundary -l app.kubernetes.io/component=test --follow"

acceptance-test:
	@bash tests/acceptance/cluster-smoke-test.sh
	@bash tests/acceptance/tcp-target-conn-test.sh
	@bash tests/acceptance/cleanup-worker.sh
	@echo "✅ All acceptance tests passed!"
	@echo ""

# ================================
# OpenShift Acceptance Testing Targets
# ================================

openshift-smoke-test:
	@echo "================================"
	@echo "OpenShift Worker Chart Smoke Test"
	@echo "================================"
	@echo ""
	@command -v oc >/dev/null 2>&1 || (echo "❌ oc CLI not found. Run: oc login <cluster-url>"; exit 1)
	@if [ ! -f worker.hcl ]; then \
		echo "❌ worker.hcl not found. Run 'make worker-config' first"; \
		exit 1; \
	fi
	@bash tests/acceptance/openshift-smoke-test.sh

openshift-helm:
	@echo "============================================"
	@echo "Installing Helm Chart on OpenShift"
	@echo "============================================"
	@echo ""
	@command -v helm >/dev/null 2>&1 || (echo "❌ Helm not found"; exit 1)
	@[ -f worker.hcl ] || { echo "❌ worker.hcl not found. Run 'make worker-config' first"; exit 1; }
	@echo "Installing boundary-worker chart with tests/acceptance/values.openshift.yaml..."
	@EXTRA_ARGS=""; \
	if [ -n "$${OCP_STORAGE_CLASS:-}" ]; then \
		EXTRA_ARGS="$$EXTRA_ARGS --set worker.persistence.recording.storageClass=$${OCP_STORAGE_CLASS} --set worker.persistence.authStorage.storageClass=$${OCP_STORAGE_CLASS}"; \
	fi; \
	if [ -n "$${OCP_MEM_REQUEST:-}" ]; then \
		EXTRA_ARGS="$$EXTRA_ARGS --set worker.resources.requests.memory=$${OCP_MEM_REQUEST}"; \
	fi; \
	if [ -n "$${OCP_CPU_REQUEST:-}" ]; then \
		EXTRA_ARGS="$$EXTRA_ARGS --set worker.resources.requests.cpu=$${OCP_CPU_REQUEST}"; \
	fi; \
	if [ -n "$${OCP_MEM_LIMIT:-}" ]; then \
		EXTRA_ARGS="$$EXTRA_ARGS --set worker.resources.limits.memory=$${OCP_MEM_LIMIT}"; \
	fi; \
	if [ -n "$${OCP_CPU_LIMIT:-}" ]; then \
		EXTRA_ARGS="$$EXTRA_ARGS --set worker.resources.limits.cpu=$${OCP_CPU_LIMIT}"; \
	fi; \
	helm upgrade --install boundary-worker . \
		--namespace boundary \
		--create-namespace \
		-f tests/acceptance/values.openshift.yaml \
		--set-file worker.config=worker.hcl \
		--wait \
		--timeout 5m \
		$$EXTRA_ARGS
	@echo "✅ Helm chart installed on OpenShift"
	@echo ""
	@oc get all -n boundary

openshift-acceptance-test:
	@echo "================================"
	@echo "OpenShift Acceptance Test Suite"
	@echo "================================"
	@echo ""
	@command -v oc >/dev/null 2>&1 || (echo "❌ oc CLI not found. Run: oc login <cluster-url>"; exit 1)
	@SKIP_HELM_INSTALL=true bash tests/acceptance/openshift-smoke-test.sh
	@bash tests/acceptance/openshift-tcp-target-conn-test.sh
	@bash tests/acceptance/cleanup-worker.sh
	@echo "✅ All OpenShift acceptance tests passed!"
	@echo ""

openshift-acceptance-full:
	@echo "================================"
	@echo "Running Full OpenShift Acceptance Workflow"
	@echo "================================"
	@echo ""
	@$(MAKE) worker-config
	@$(MAKE) openshift-helm
	@$(MAKE) openshift-acceptance-test
	@echo ""
	@echo "To cleanup, run: make openshift-acceptance-cleanup"
	@echo ""

openshift-acceptance-cleanup:
	@echo "================================"
	@echo "Cleaning up OpenShift Acceptance"
	@echo "================================"
	@echo "Cleaning up worker from Boundary cluster..."
	@bash tests/acceptance/cleanup-worker.sh || true
	@echo ""
	@echo "Uninstalling Helm release..."
	@helm uninstall boundary-worker --namespace boundary 2>/dev/null && echo "✅ Helm release uninstalled" || echo "⚠️  Helm release not found"
	@rm -f worker.hcl
	@rm -f /tmp/boundary-worker-id.txt
	@echo "✅ OpenShift acceptance cleanup complete"

# ================================
# OpenShift Local (CRC) Targets
# ================================
# Run acceptance tests against a local OpenShift cluster using CRC (OpenShift Local).
# Requires CRC installed and running on your machine: https://developers.redhat.com/products/openshift-local
#
# Usage:
#   make crc-full      – full workflow (setup → worker-config → install → test)
#   make crc-setup     – start CRC and configure oc context
#   make crc-helm      – install the Helm chart on CRC
#   make crc-test      – run the OpenShift acceptance suite against CRC
#   make crc-cleanup   – uninstall and stop CRC
# ================================

crc-setup:
	@echo "================================"
	@echo "Setting up CRC (OpenShift Local)"
	@echo "================================"
	@echo ""
	@command -v crc >/dev/null 2>&1 || (echo "❌ crc not installed. Download from: https://developers.redhat.com/products/openshift-local"; exit 1)
	@command -v oc >/dev/null 2>&1 || (echo "❌ oc CLI not found. Run: eval $$(crc oc-env)"; exit 1)
	@echo "✅ crc and oc are installed"
	@echo ""
	@echo "Starting CRC cluster (this may take several minutes)..."
	@crc start
	@echo ""
	@echo "Configuring oc context..."
	@eval $$(crc oc-env) && \
		KUBEADMIN_PASS=$$(crc console --credentials 2>/dev/null | grep 'kubeadmin' | sed 's/.*-p \([^ ]*\) .*/\1/') && \
		oc login -u kubeadmin -p "$$KUBEADMIN_PASS" \
			--insecure-skip-tls-verify=true \
			https://api.crc.testing:6443
	@oc cluster-info
	@echo "✅ CRC cluster is ready"
	@echo ""
	@echo "Next steps:"
	@echo "  - Generate worker config: make worker-config"
	@echo "  - Install Helm chart:     make crc-helm"
	@echo "  - Run tests:              make crc-test"
	@echo "  - Full workflow:          make crc-full"

crc-helm:
	@echo "============================================"
	@echo "Installing Helm Chart on CRC"
	@echo "============================================"
	@echo ""
	@command -v helm >/dev/null 2>&1 || (echo "❌ Helm not found"; exit 1)
	@if [ ! -f worker.hcl ]; then \
		echo "❌ worker.hcl not found. Run 'make worker-config' first"; \
		exit 1; \
	fi
	@echo "Installing boundary-worker chart with tests/acceptance/values.openshift.yaml..."
	@helm upgrade --install boundary-worker . \
		--namespace boundary \
		--create-namespace \
		-f tests/acceptance/values.openshift.yaml \
		--set worker.persistence.recording.storageClass=crc-csi-hostpath-provisioner \
		--set worker.persistence.authStorage.storageClass=crc-csi-hostpath-provisioner \
		--set worker.resources.requests.memory=128Mi \
		--set worker.resources.requests.cpu=50m \
		--set worker.resources.limits.memory=512Mi \
		--set worker.resources.limits.cpu=200m \
		--set-file worker.config=worker.hcl \
		--wait \
		--timeout 5m
	@echo "✅ Helm chart installed successfully"
	@echo ""
	@echo "Deployed resources:"
	@oc get all -n boundary
	@echo ""
	@echo "Waiting for deployment to be ready..."
	@oc wait --for=condition=available --timeout=5m \
		deployment/boundary-worker-deployment \
		-n boundary
	@echo "✅ Deployment is ready"

crc-test:
	@echo "================================"
	@echo "CRC OpenShift Acceptance Tests"
	@echo "================================"
	@echo ""
	@command -v oc >/dev/null 2>&1 || (echo "❌ oc CLI not found. Run: eval $$(crc oc-env)"; exit 1)
	@SKIP_HELM_INSTALL=true bash tests/acceptance/openshift-smoke-test.sh
	@bash tests/acceptance/openshift-tcp-target-conn-test.sh
	@bash tests/acceptance/cleanup-worker.sh
	@echo "✅ All CRC acceptance tests passed!"
	@echo ""

crc-full:
	@echo "================================"
	@echo "Running Full CRC Workflow"
	@echo "================================"
	@echo ""
	@$(MAKE) crc-setup
	@$(MAKE) worker-config
	@$(MAKE) crc-helm
	@$(MAKE) crc-test
	@echo ""
	@echo "To cleanup, run: make crc-cleanup"
	@echo ""

crc-cleanup:
	@echo "================================"
	@echo "Cleaning up CRC"
	@echo "================================"
	@echo "Cleaning up worker from Boundary cluster..."
	@bash tests/acceptance/cleanup-worker.sh || true
	@echo ""
	@echo "Uninstalling Helm release..."
	@helm uninstall boundary-worker --namespace boundary 2>/dev/null && echo "✅ Helm release uninstalled" || echo "⚠️  Helm release not found"
	@rm -f worker.hcl
	@rm -f /tmp/boundary-worker-id.txt
	@echo ""
	@echo "Stopping CRC cluster..."
	@crc stop && echo "✅ CRC cluster stopped" || echo "⚠️  CRC stop failed"
	@echo "✅ CRC cleanup complete"

# ================================
# OpenShift MicroShift (CI) Targets
# ================================
# Runs a throwaway MicroShift AIO cluster inside Docker — the same
# pattern KIND uses for Kubernetes acceptance tests.
# No external OCP cluster, CRC, or OCP_SERVER/OCP_TOKEN secrets are needed.

microshift-setup:
	@echo "================================"
	@echo "Setting up MicroShift (OpenShift CI)"
	@echo "================================"
	@echo ""
	@echo "Checking dependencies..."
	@command -v docker >/dev/null 2>&1 || (echo "❌ docker is not installed"; exit 1)
	@echo "✅ docker is installed"
	@command -v helm >/dev/null 2>&1 || (echo "❌ Helm not found. Run 'make setup-helm' first"; exit 1)
	@echo "✅ helm is installed"
	@if ! command -v oc >/dev/null 2>&1; then \
		echo "Installing oc CLI..."; \
		curl -Lo /tmp/oc.tar.gz https://mirror.openshift.com/pub/openshift-v4/clients/ocp/stable/openshift-client-linux.tar.gz; \
		sudo tar -xzf /tmp/oc.tar.gz -C /usr/local/bin oc; \
		rm -f /tmp/oc.tar.gz; \
	fi
	@echo "✅ oc CLI is installed ($$(oc version --client 2>/dev/null | head -n1))"
	@echo ""
	@echo "Creating storage loop device and LVM volume group for MicroShift (4 GB)..."
	@sudo truncate -s 4G /tmp/microshift-disk.img
	@LOOP=$$(sudo losetup --find --show /tmp/microshift-disk.img) && \
		echo "$$LOOP" > /tmp/microshift-loop-device && \
		echo "✅ Loop device: $$LOOP"
	@sudo apt-get install -y --quiet lvm2 2>/dev/null || true
	@LOOP_DEV=$$(cat /tmp/microshift-loop-device) && \
		sudo pvcreate "$$LOOP_DEV" && \
		sudo vgcreate rhel "$$LOOP_DEV" && \
		echo "✅ LVM volume group 'rhel' created on $$LOOP_DEV"
	@echo "Configuring iptables-legacy (required for MicroShift networking on Ubuntu)..."
	@sudo apt-get install -y --quiet iptables 2>/dev/null || true
	@sudo update-alternatives --set iptables /usr/sbin/iptables-legacy 2>/dev/null || true
	@sudo update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy 2>/dev/null || true
	@echo "✅ iptables-legacy configured"
	@echo ""
	@echo "Configuring CRI-O storage driver (vfs required for overlay-on-overlay CI environments)..."
	@printf '[storage]\ndriver = "vfs"\ngraphroot = "/var/lib/containers/storage"\nrunroot = "/run/containers/storage"\n' > /tmp/microshift-storage.conf
	@echo "✅ CRI-O storage config created (vfs)"
	@echo ""
	@# Pinned to MicroShift AIO latest as of 2025-07 — update digest when upgrading
	@echo "Starting MicroShift AIO cluster (this may take 3-5 minutes)..."
	@HOST_DNS=$$(awk '/^nameserver[[:space:]]/{print $$2; exit}' /run/systemd/resolve/resolv.conf /etc/resolv.conf 2>/dev/null); \
		if [ -z "$$HOST_DNS" ] || printf '%s' "$$HOST_DNS" | grep -Eq '^(127\\.|::1$$)'; then HOST_DNS="8.8.8.8"; fi; \
		echo "Using MicroShift upstream DNS: $$HOST_DNS"; \
		docker run -d \
		--name microshift \
		--privileged \
		--cgroupns=host \
		--network host \
		--dns "$$HOST_DNS" \
		--tmpfs /run \
		--tmpfs /tmp \
		-v /sys/fs/cgroup:/sys/fs/cgroup:rw \
		-v /lib/modules:/lib/modules:ro \
		-v /tmp/microshift-storage.conf:/etc/containers/storage.conf:ro \
		-v microshift-data:/var/lib/microshift \
		quay.io/microshift/microshift-aio@sha256:e5c53f97b43a042e4bdceeccf980bcdf8630ece81cb75f8fd11d7d8564edc832
	@echo "Waiting for MicroShift node to be Ready (up to 10 minutes)..."
	@i=0; while [ $$i -lt 120 ]; do \
		if docker exec microshift kubectl \
			--kubeconfig /var/lib/microshift/resources/kubeadmin/kubeconfig \
			get nodes --no-headers 2>/dev/null | grep -q ' Ready'; then \
			echo "✅ MicroShift node is Ready"; break; \
		fi; \
		if [ $$(( $$i % 6 )) -eq 0 ]; then \
			echo "  Container status: $$(docker inspect microshift --format '{{.State.Status}}' 2>/dev/null)"; \
			echo "  Service status: microshift=$$(docker exec microshift systemctl is-active microshift 2>/dev/null) crio=$$(docker exec microshift systemctl is-active crio 2>/dev/null)"; \
			docker exec microshift journalctl -u microshift --no-pager --lines=3 2>/dev/null || true; \
		fi; \
		echo "  waiting... ($$(( $$i * 5 ))s)"; \
		sleep 5; i=$$(( $$i + 1 )); \
		if [ $$i -eq 120 ]; then \
			echo "❌ MicroShift node never became Ready after 10 minutes."; \
			echo "--- systemctl status ---"; \
			docker exec microshift systemctl status microshift crio --no-pager 2>/dev/null || true; \
			echo "--- MicroShift journal ---"; \
			docker exec microshift journalctl -u microshift --no-pager --lines=50 2>/dev/null || true; \
			echo "--- CRI-O journal ---"; \
			docker exec microshift journalctl -u crio --no-pager --lines=30 2>/dev/null || true; \
			exit 1; \
		fi; \
	done
	@echo ""
	@echo "Configuring kubeconfig..."
	@mkdir -p ~/.kube
	@docker cp microshift:/var/lib/microshift/resources/kubeadmin/kubeconfig ~/.kube/config
	@echo "✅ Kubeconfig configured"
	@echo "Waiting for CNI config file in /etc/cni/net.d/..."
	@timeout 300 bash -c \
		'until docker exec microshift ls /etc/cni/net.d/ 2>/dev/null | grep -qE "\.conf|\.conflist"; do sleep 5; done' \
		|| echo "⚠️  CNI config not found; pod networking may not work"
	@echo "✅ CNI config file present"
	@docker exec microshift ls -la /etc/cni/net.d/ 2>/dev/null || true
	@echo "Ensuring pod egress NAT → internet..."
	@sudo sysctl -w net.ipv4.ip_forward=1 2>/dev/null || true
	@# On Ubuntu 22.04, Docker uses iptables-nft (nftables backend) which runs BEFORE
	@# iptables-legacy in the kernel. Docker's FORWARD=DROP lives in nftables, so rules
	@# added only to iptables-legacy are silently bypassed. Apply to BOTH backends.
	POD_CIDRS=$$(kubectl get nodes -o jsonpath='{range .items[*]}{.spec.podCIDR}{"\n"}{end}' 2>/dev/null | sort -u | tr '\n' ' '); \
	[ -n "$$POD_CIDRS" ] || POD_CIDRS="10.42.0.0/16"; \
	echo "  Pod CIDRs: $$POD_CIDRS"; \
	for ipt in iptables iptables-nft; do \
		for cidr in $$POD_CIDRS; do \
			sudo $$ipt -t nat -C POSTROUTING -s $$cidr ! -d $$cidr -j MASQUERADE 2>/dev/null \
				|| sudo $$ipt -t nat -I POSTROUTING 1 -s $$cidr ! -d $$cidr -j MASQUERADE 2>/dev/null \
				|| true; \
			sudo $$ipt -I FORWARD 1 -s $$cidr -j ACCEPT 2>/dev/null || true; \
			sudo $$ipt -I FORWARD 1 -d $$cidr -j ACCEPT 2>/dev/null || true; \
		done; \
	done
	@echo "✅ Pod egress NAT + FORWARD rules applied to both iptables-legacy and iptables-nft"
	@echo "Waiting for CoreDNS pods to be Running..."
	@timeout 180 bash -c \
		'until docker exec microshift kubectl --kubeconfig /var/lib/microshift/resources/kubeadmin/kubeconfig \
		get pods -n openshift-dns --no-headers 2>/dev/null | grep "dns-default" | grep -q " Running "; do sleep 5; done' \
		|| echo "⚠️  DNS pods not yet Running; continuing"
	@echo "✅ DNS pods ready"
	@echo "Checking DNS resolution from the MicroShift node..."
	@docker exec microshift getent hosts google.com >/dev/null 2>&1 \
		&& echo "✅ MicroShift node DNS is working" \
		|| echo "⚠️ MicroShift node DNS lookup failed; pod DNS may not resolve external names"
	@echo "Waiting for StorageClass topolvm-provisioner..."
	@timeout 120 bash -c \
		'until kubectl get storageclass topolvm-provisioner >/dev/null 2>&1; do sleep 3; done' \
		|| echo "⚠️  topolvm-provisioner not yet available; continuing"
	@kubectl cluster-info || true
	@echo "✅ MicroShift cluster is ready"
	@echo ""
	@echo "Next steps:"
	@echo "  - Generate worker config: make worker-config"
	@echo "  - Install Helm chart:     make microshift-helm"
	@echo "  - Run tests:              make microshift-test"
	@echo "  - Full workflow:          make microshift-full"

microshift-helm:
	@echo "============================================"
	@echo "Installing Helm Chart on MicroShift"
	@echo "============================================"
	@echo ""
	@command -v helm >/dev/null 2>&1 || (echo "❌ Helm not found"; exit 1)
	@[ -f worker.hcl ] || { echo "❌ worker.hcl not found. Run 'make worker-config' first"; exit 1; }
	@echo "Injecting Red Hat registry credentials into MicroShift CRI-O..."
	@if [ -n "$${RH_REGISTRY_USER:-}" ] && [ -n "$${RH_REGISTRY_TOKEN:-}" ]; then \
		AUTH_B64=$$(printf '%s:%s' "$${RH_REGISTRY_USER}" "$${RH_REGISTRY_TOKEN}" | base64 -w0); \
		printf '{"auths":{"registry.connect.redhat.com":{"auth":"%s"}}}\n' "$${AUTH_B64}" > /tmp/rh-auth.json; \
		docker exec microshift mkdir -p /etc/containers; \
		docker cp /tmp/rh-auth.json microshift:/etc/containers/auth.json; \
		rm -f /tmp/rh-auth.json; \
		echo "✅ CRI-O auth configured for registry.connect.redhat.com"; \
		echo "Pre-pulling boundary-enterprise image into CRI-O cache (up to 3 attempts)..."; \
		CHART_APP_VERSION=$$(grep '^appVersion:' Chart.yaml | sed 's/appVersion: *//;s/"//g'); \
		PULL_IMAGE="registry.connect.redhat.com/hashicorp/boundary-enterprise:$${CHART_APP_VERSION}-ubi"; \
		PULL_OK=0; \
		for attempt in 1 2 3; do \
			echo "  attempt $$attempt/3..."; \
			if docker exec microshift \
				crictl pull \
				--creds "$${RH_REGISTRY_USER}:$${RH_REGISTRY_TOKEN}" \
				"$$PULL_IMAGE"; then \
				PULL_OK=1; break; \
			fi; \
			echo "  pull attempt $$attempt failed, retrying in 10s..."; \
			sleep 10; \
		done; \
		[ "$$PULL_OK" = "1" ] \
			&& echo "✅ Image pre-pulled into CRI-O: $$PULL_IMAGE" \
			|| { echo "❌ crictl pull failed after 3 attempts — check RH_REGISTRY_USER/RH_REGISTRY_TOKEN"; exit 1; }; \
	else \
		echo "⚠️  RH_REGISTRY_USER/TOKEN not set — image pull may fail"; \
	fi
	@echo "Installing boundary-worker chart with tests/acceptance/values.openshift.yaml..."
	@helm upgrade --install boundary-worker . \
		--namespace boundary \
		--create-namespace \
		-f tests/acceptance/values.openshift.yaml \
		--set worker.persistence.recording.storageClass=topolvm-provisioner \
		--set worker.persistence.authStorage.storageClass=topolvm-provisioner \
		--set worker.resources.requests.memory=128Mi \
		--set worker.resources.requests.cpu=50m \
		--set worker.resources.limits.memory=512Mi \
		--set worker.resources.limits.cpu=200m \
		--set 'openshift.route.proxy.enabled=true' \
		--set 'openshift.podSecurityContext.runAsUser=1001' \
		--set 'openshift.containerSecurityContext.runAsUser=1001' \
		--set-file worker.config=worker.hcl \
		--wait \
		--timeout 8m \
		|| { \
			echo "❌ Helm install timed out or failed. Diagnostics:"; \
			echo "--- Pod list ---"; \
			kubectl get pods -n boundary -o wide 2>/dev/null || true; \
			echo "--- Pod events ---"; \
			kubectl get events -n boundary --sort-by='.lastTimestamp' 2>/dev/null | tail -20 || true; \
			echo "--- Pod describe ---"; \
			kubectl describe pods -n boundary 2>/dev/null | tail -40 || true; \
			echo "--- CRI-O journal (last 30 lines) ---"; \
			docker exec microshift journalctl -u crio --no-pager --lines=30 2>/dev/null || true; \
			exit 1; \
		}
	@echo "✅ Helm chart installed on MicroShift"
	@echo ""
	@oc get all -n boundary

microshift-test:
	@echo "================================"
	@echo "MicroShift OpenShift Acceptance Tests"
	@echo "================================"
	@echo ""
	@command -v oc >/dev/null 2>&1 || (echo "❌ oc CLI not found"; exit 1)
	@SKIP_HELM_INSTALL=true bash tests/acceptance/openshift-smoke-test.sh
	@bash tests/acceptance/openshift-tcp-target-conn-test.sh
	@bash tests/acceptance/cleanup-worker.sh
	@echo "✅ All MicroShift acceptance tests passed!"
	@echo ""

microshift-full:
	@echo "================================"
	@echo "Running Full MicroShift Acceptance Workflow"
	@echo "================================"
	@echo ""
	@if docker inspect microshift >/dev/null 2>&1; then \
		echo "⚠️  MicroShift container already exists — skipping microshift-setup"; \
	else \
		$(MAKE) microshift-setup; \
	fi
	@$(MAKE) worker-config
	@$(MAKE) microshift-helm
	@$(MAKE) microshift-test
	@echo ""
	@echo "To cleanup, run: make microshift-cleanup"
	@echo ""

microshift-cleanup:
	@echo "================================"
	@echo "Cleaning up MicroShift"
	@echo "================================"
	@echo "Cleaning up worker from Boundary cluster..."
	@bash tests/acceptance/cleanup-worker.sh || true
	@echo ""
	@echo "Uninstalling Helm release..."
	@helm uninstall boundary-worker --namespace boundary 2>/dev/null && echo "✅ Helm release uninstalled" || echo "⚠️  Helm release not found"
	@rm -f worker.hcl
	@rm -f /tmp/boundary-worker-id.txt
	@echo ""
	@echo "Stopping and removing MicroShift container..."
	@docker stop microshift 2>/dev/null && docker rm microshift 2>/dev/null \
		&& echo "✅ MicroShift container removed" || echo "⚠️  MicroShift container not found"
	@docker volume rm microshift-data 2>/dev/null || true
	@echo "Removing loop device, LVM and disk image..."
	@if [ -f /tmp/microshift-loop-device ]; then \
		LOOP_DEV=$$(cat /tmp/microshift-loop-device); \
		sudo vgremove -f rhel 2>/dev/null || true; \
		sudo pvremove -f "$$LOOP_DEV" 2>/dev/null || true; \
		sudo losetup -d "$$LOOP_DEV" 2>/dev/null || true; \
		rm -f /tmp/microshift-loop-device; \
	fi
	@sudo rm -f /tmp/microshift-disk.img
	@echo "✅ MicroShift cleanup complete"


# Note: acceptance-full does NOT run the Kubernetes version matrix test.
# The matrix manages its own cluster lifecycle (it deletes/recreates the
# 'acceptance' cluster per version), so it is kept separate. Run it on its own:
#   make k8s-matrix-test K8S_MATRIX_VERSIONS="v1.36.1 v1.35.5"
acceptance-full:
	@echo "================================"
	@echo "Running Full Acceptance Workflow"
	@echo "================================"
	@echo ""
	@if kind get clusters | grep -q "^acceptance$$"; then \
		echo "⚠️  KIND cluster 'acceptance' already exists — skipping acceptance-setup"; \
	else \
		$(MAKE) acceptance-setup; \
	fi
	@$(MAKE) worker-config
	@$(MAKE) acceptance-helm
	@$(MAKE) acceptance-test
	@echo ""
	@echo "To cleanup, run: make acceptance-cleanup"
	@echo ""

acceptance-all:
	@echo "=================================================="
	@echo "Running Full Acceptance Suite (Kubernetes + OpenShift)"
	@echo "=================================================="
	@echo ""
	@echo "--- Phase 1: Kubernetes (KIND) Acceptance Tests ---"
	@$(MAKE) acceptance-full
	@echo ""
	@echo "--- Phase 2: OpenShift (MicroShift) Acceptance Tests ---"
	@$(MAKE) microshift-full
	@echo ""
	@echo "✅ All acceptance tests passed (Kubernetes + OpenShift)!"
	@echo ""

# ================================
# Kubernetes Version Matrix Testing
# ================================

k8s-matrix-test:
	@echo "================================"
	@echo "Kubernetes Version Matrix Test"
	@echo "================================"
	@if [ -z "$(K8S_MATRIX_VERSIONS)" ] && [ -z "$(K8S_VERSIONS)" ]; then \
		echo "❌ Set K8S_MATRIX_VERSIONS (ordered kindest/node tags) or K8S_VERSIONS (one-off override)."; \
		echo "   Example: make k8s-matrix-test K8S_MATRIX_VERSIONS=\"v1.31.0 v1.30.0\""; \
		echo "   Available tags: https://hub.docker.com/r/kindest/node"; \
		exit 1; \
	fi
	@chmod +x tests/acceptance/k8s-version-matrix-test.sh
	@K8S_MATRIX_VERSIONS="$(K8S_MATRIX_VERSIONS)" K8S_VERSIONS="$(K8S_VERSIONS)" bash tests/acceptance/k8s-version-matrix-test.sh

k8s-matrix-cleanup:
	@echo "================================"
	@echo "K8s Matrix Cleanup"
	@echo "================================"
	@if kind get clusters 2>/dev/null | grep -q "^acceptance$$"; then \
		echo "Deleting acceptance cluster..."; \
		kind delete cluster --name acceptance; \
	else \
		echo "⚠️  Acceptance cluster does not exist"; \
	fi
	@rm -f worker.hcl
	@rm -f /tmp/boundary-worker-id.txt
	@echo "✅ K8s matrix cleanup complete"

acceptance-cleanup:
	@echo "================================"
	@echo "Cleaning up Acceptance Cluster"
	@echo "================================"
	@echo "Cleaning up worker from Boundary cluster..."
	@bash tests/acceptance/cleanup-worker.sh || true
	@echo ""
	@if kind get clusters | grep -q "^acceptance$$"; then \
		echo "Deleting KIND cluster 'acceptance'..."; \
		kind delete cluster --name acceptance; \
		echo "✅ Acceptance cluster deleted"; \
	else \
		echo "⚠️  Acceptance cluster does not exist"; \
	fi
	@find "$${TMPDIR:-/tmp}" -maxdepth 1 -name 'kind-v[0-9]*' 2>/dev/null | while read -r BIN; do \
		rm -f "$$BIN"; \
		echo "✅ Removed cached $$(basename $$BIN) binary"; \
	done
	@rm -f worker.hcl
	@echo "✅ Removed worker.hcl"
	@rm -f /tmp/boundary-worker-id.txt
	@echo "✅ Removed worker ID file"

# ================================
# AWS EKS Acceptance Testing Targets
# ================================

eks-setup:
	@$(MAKE) tf-setup

eks-helm:
	@echo "Installing Helm Chart on EKS..."
	@echo ""
	@for v in AWS_REGION EKS_CLUSTER_NAME; do \
		if [ -z "$${!v:-}" ]; then \
			echo "❌ $$v is not set."; exit 1; \
		fi; \
	done
	@[ -f worker.hcl ] || { echo "❌ worker.hcl not found. Run 'make worker-config' first"; exit 1; }
	@AWS_ACCOUNT_ID=$$(aws sts get-caller-identity --query Account --output text 2>/dev/null) || \
		{ echo "❌ AWS credentials not configured"; exit 1; }; \
	EKS_CONTEXT="arn:aws:eks:$${AWS_REGION}:$${AWS_ACCOUNT_ID}:cluster/$${EKS_CLUSTER_NAME}"; \
	echo "Updating kubeconfig for cluster $${EKS_CLUSTER_NAME}..."; \
	aws eks update-kubeconfig --name "$${EKS_CLUSTER_NAME}" --region "$${AWS_REGION}"; \
	if helm status boundary-worker -n boundary --kube-context "$${EKS_CONTEXT}" >/dev/null 2>&1; then \
		echo "⚠️  Release 'boundary-worker' already installed — skipping. Run 'make eks-cleanup' first to reinstall."; \
	else \
		echo "Installing boundary-worker chart with EKS values..."; \
		helm install boundary-worker . \
			--namespace boundary \
			--create-namespace \
			--kube-context "$${EKS_CONTEXT}" \
			--set worker.service.proxy.type=LoadBalancer \
			--set worker.persistence.recording.storageClass=gp3 \
			--set worker.persistence.authStorage.storageClass=gp3 \
			--set tls.ops.disabled=true \
			--set-file worker.config=worker.hcl \
			--timeout 10m \
			--rollback-on-failure; \
	fi; \
	echo ""; \
	echo "Deployed resources:"; \
	kubectl get all -n boundary --context "$${EKS_CONTEXT}"
	@echo ""
	@echo "✅ Helm chart installed on EKS"
	@echo ""

eks-test:
	@echo "Running EKS Acceptance Tests..."
	@echo ""
	@for v in AWS_REGION EKS_CLUSTER_NAME BOUNDARY_ADDR BOUNDARY_AUTH_METHOD_ID BOUNDARY_LOGIN_NAME BOUNDARY_PASSWORD; do \
		if [ -z "$${!v:-}" ]; then \
			echo "❌ $$v is not set. Check your .env or export it."; \
			exit 1; \
		fi; \
	done
	@bash tests/integration/eks-integration-test.sh
	@echo ""

eks-full:
	@echo "================================"
	@echo "Full EKS Integration Workflow"
	@echo "================================"
	@echo ""
	@$(MAKE) tf-setup
	@$(MAKE) worker-config
	@$(MAKE) eks-helm
	@$(MAKE) eks-test
	@echo ""
	@echo "✅ End-to-end EKS workflow has been completed successfully"
	@echo ""
	@echo "To cleanup: make eks-cleanup or DESTROY_CLUSTER=true make eks-cleanup (to also destroy the cluster)"

eks-cleanup:
	@echo "================================"
	@echo "Cleaning Up EKS Resources"
	@echo "================================"
	@echo ""
	@for v in AWS_REGION EKS_CLUSTER_NAME; do \
		if [ -z "$${!v:-}" ]; then \
			echo "❌ $$v is not set."; exit 1; \
		fi; \
	done
	@AWS_ACCOUNT_ID=$$(aws sts get-caller-identity --query Account --output text 2>/dev/null) || \
		{ echo "❌ AWS credentials not configured"; exit 1; }; \
	EKS_CONTEXT="arn:aws:eks:$${AWS_REGION}:$${AWS_ACCOUNT_ID}:cluster/$${EKS_CLUSTER_NAME}"; \
	aws eks update-kubeconfig --name "$${EKS_CLUSTER_NAME}" --region "$${AWS_REGION}" 2>/dev/null || true; \
	if helm status boundary-worker -n boundary --kube-context "$${EKS_CONTEXT}" >/dev/null 2>&1; then \
		echo "Uninstalling Helm release boundary-worker..."; \
		helm uninstall boundary-worker --namespace boundary --kube-context "$${EKS_CONTEXT}" --wait --timeout 5m; \
		echo "✅ Helm release uninstalled"; \
	else \
		echo "⚠️  Helm release not found"; \
	fi; \
	kubectl delete namespace boundary --context "$${EKS_CONTEXT}" --ignore-not-found 2>/dev/null || true
	@rm -f worker.hcl
	@echo "✅ Removed worker.hcl"
	@if [ "$${DESTROY_CLUSTER:-false}" = "true" ]; then \
		echo ""; \
		echo "Destroying Terraform EKS stack (DESTROY_CLUSTER=true)..."; \
		$(MAKE) tf-destroy; \
	else \
		echo ""; \
		echo "ℹ  EKS cluster retained. To destroy: DESTROY_CLUSTER=true make eks-cleanup"; \
	fi

# ================================
# Terraform EKS Targets (Recommended)
# ================================

tf-plan:
	@echo "================================"
	@echo "Terraform Plan (EKS)"
	@echo "================================"
	@command -v terraform >/dev/null 2>&1 || { echo "❌ terraform not found. Install: brew install terraform"; exit 1; }
	@cd tests/integration/terraform/aws && \
		terraform init -upgrade && \
		terraform plan \
			-var="aws_region=$${AWS_REGION}" \
			-var="cluster_name=$${EKS_CLUSTER_NAME:-boundary-k8s-cluster-1}" \
			-var="k8s_version=$${K8S_VERSION:-1.31}" \
			-var="node_type=$${TF_NODE_TYPE:-t3.medium}" \
			-var="node_desired=$${TF_NODE_DESIRED:-2}" \
			-var="node_min=$${TF_NODE_MIN:-1}" \
			-var="node_max=$${TF_NODE_MAX:-3}" \
			-var="lbc_chart_version=$${TF_LBC_CHART_VERSION:-1.8.1}" \
			-var="allowed_public_access_cidrs=[$${TF_ALLOWED_PUBLIC_ACCESS_CIDRS:-\"0.0.0.0/0\"}]"

tf-setup:
	@echo "================================"
	@echo "Provisioning EKS with Terraform"
	@echo "================================"
	@command -v terraform >/dev/null 2>&1 || { echo "❌ terraform not found. Install: brew install terraform"; exit 1; }
	@cd tests/integration/terraform/aws && \
		terraform init -upgrade && \
		terraform apply -auto-approve \
			-var="aws_region=$${AWS_REGION}" \
			-var="cluster_name=$${EKS_CLUSTER_NAME:-boundary-k8s-cluster-1}" \
			-var="k8s_version=$${K8S_VERSION:-1.31}" \
			-var="node_type=$${TF_NODE_TYPE:-t3.medium}" \
			-var="node_desired=$${TF_NODE_DESIRED:-2}" \
			-var="node_min=$${TF_NODE_MIN:-1}" \
			-var="node_max=$${TF_NODE_MAX:-3}" \
			-var="lbc_chart_version=$${TF_LBC_CHART_VERSION:-1.8.1}" \
			-var="allowed_public_access_cidrs=[$${TF_ALLOWED_PUBLIC_ACCESS_CIDRS:-\"0.0.0.0/0\"}]" \
			-target=module.vpc \
			-target=module.eks \
			-target=module.ebs_csi_irsa_role \
			-target=module.lbc_irsa_role
	@echo "   Importing existing gp3 StorageClass into Terraform state (if present)..."
	@cd tests/integration/terraform/aws && \
		terraform import \
			-var="aws_region=$${AWS_REGION}" \
			-var="cluster_name=$${EKS_CLUSTER_NAME:-boundary-k8s-cluster-1}" \
			kubernetes_storage_class_v1.gp3 gp3 2>/dev/null || true
	@echo "   Removing stale outputs from Terraform state (if any)..."
	@cd tests/integration/terraform/aws && \
		terraform state rm output.next_steps 2>/dev/null || true
	@cd tests/integration/terraform/aws && \
		terraform apply -auto-approve \
			-var="aws_region=$${AWS_REGION}" \
			-var="cluster_name=$${EKS_CLUSTER_NAME:-boundary-k8s-cluster-1}" \
			-var="k8s_version=$${K8S_VERSION:-1.31}" \
			-var="node_type=$${TF_NODE_TYPE:-t3.medium}" \
			-var="node_desired=$${TF_NODE_DESIRED:-2}" \
			-var="node_min=$${TF_NODE_MIN:-1}" \
			-var="node_max=$${TF_NODE_MAX:-3}" \
			-var="lbc_chart_version=$${TF_LBC_CHART_VERSION:-1.8.1}" \
			-var="allowed_public_access_cidrs=[$${TF_ALLOWED_PUBLIC_ACCESS_CIDRS:-\"0.0.0.0/0\"}]"
	@echo ""
	@KUBECONFIG_CMD=$$(cd tests/integration/terraform/aws && terraform output -raw kubeconfig_command 2>/dev/null); \
	if [ -n "$$KUBECONFIG_CMD" ]; then \
		echo "Updating kubeconfig..."; \
		eval "$$KUBECONFIG_CMD"; \
	fi
	@echo ""
	@echo "✅ EKS cluster and all prerequisites are ready"
	@echo ""

tf-output:
	@echo "================================"
	@echo "Terraform Outputs"
	@echo "================================"
	@command -v terraform >/dev/null 2>&1 || { echo "❌ terraform not found"; exit 1; }
	@cd tests/integration/terraform/aws && terraform output

# ================================
# Azure AKS Integration Testing Targets
# ================================

aks-setup:
	@$(MAKE) tf-setup-aks

aks-helm:
	@echo "Installing Helm Chart on AKS..."
	@echo ""
	@for v in AZURE_RESOURCE_GROUP AKS_CLUSTER_NAME; do \
		if [ -z "$${!v:-}" ]; then \
			echo "❌ $$v is not set."; exit 1; \
		fi; \
	done
	@[ -f worker.hcl ] || { echo "❌ worker.hcl not found. Run 'make worker-config' first"; exit 1; }
	@echo "Updating kubeconfig for cluster $${AKS_CLUSTER_NAME}..."; \
	az aks get-credentials \
		--resource-group "$${AZURE_RESOURCE_GROUP}" \
		--name "$${AKS_CLUSTER_NAME}" \
		--overwrite-existing; \
	AKS_CONTEXT="$${AKS_CLUSTER_NAME}"; \
	STORAGE_CLASS="$${TF_STORAGE_CLASS_NAME:-managed-csi-premium}"; \
	if helm status boundary-worker -n boundary --kube-context "$${AKS_CONTEXT}" >/dev/null 2>&1; then \
		echo "⚠️  Release 'boundary-worker' already installed — skipping. Run 'make aks-cleanup' first to reinstall."; \
	else \
		echo "Installing boundary-worker chart with AKS values..."; \
		helm install boundary-worker . \
			--namespace boundary \
			--create-namespace \
			--kube-context "$${AKS_CONTEXT}" \
			--set worker.service.proxy.type=LoadBalancer \
			--set worker.persistence.recording.storageClass=$${STORAGE_CLASS} \
			--set worker.persistence.authStorage.storageClass=$${STORAGE_CLASS} \
			--set tls.ops.disabled=true \
			--set-file worker.config=worker.hcl \
			--timeout 10m \
			--rollback-on-failure; \
	fi; \
	echo ""; \
	echo "Deployed resources:"; \
	kubectl get all -n boundary --context "$${AKS_CONTEXT}"
	@echo ""
	@echo "✅ Helm chart installed on AKS"
	@echo ""

aks-test:
	@echo "Running AKS Integration Tests..."
	@echo ""
	@for v in AZURE_TENANT_ID AZURE_SUBSCRIPTION_ID AZURE_LOCATION AZURE_RESOURCE_GROUP AKS_CLUSTER_NAME BOUNDARY_ADDR BOUNDARY_AUTH_METHOD_ID BOUNDARY_LOGIN_NAME BOUNDARY_PASSWORD; do \
		if [ -z "$${!v:-}" ]; then \
			echo "❌ $$v is not set. Check your .env or export it."; \
			exit 1; \
		fi; \
	done
	@echo "Setting Azure subscription $${AZURE_SUBSCRIPTION_ID}..."; \
	CURRENT_TENANT=$$(az account show --query tenantId -o tsv 2>/dev/null || true); \
	if [ "$$CURRENT_TENANT" != "$${AZURE_TENANT_ID}" ]; then \
		echo "Not logged in to tenant $${AZURE_TENANT_ID}, running az login..."; \
		az login --tenant "$${AZURE_TENANT_ID}"; \
	fi; \
	az account set --subscription "$${AZURE_SUBSCRIPTION_ID}"
	@bash tests/integration/aks-integration-test.sh
	@echo ""

aks-full:
	@echo "================================"
	@echo "Full AKS Integration Workflow"
	@echo "================================"
	@echo ""
	@$(MAKE) tf-setup-aks
	@$(MAKE) worker-config
	@$(MAKE) aks-helm
	@$(MAKE) aks-test
	@echo ""
	@echo "✅ End-to-end AKS workflow has been completed successfully"
	@echo ""
	@echo "To cleanup: make aks-cleanup or DESTROY_CLUSTER=true make aks-cleanup (to also destroy the cluster)"

aks-cleanup:
	@echo "================================"
	@echo "Cleaning Up AKS Resources"
	@echo "================================"
	@echo ""
	@for v in AZURE_RESOURCE_GROUP AKS_CLUSTER_NAME; do \
		if [ -z "$${!v:-}" ]; then \
			echo "❌ $$v is not set."; exit 1; \
		fi; \
	done
	@az aks get-credentials \
		--resource-group "$${AZURE_RESOURCE_GROUP}" \
		--name "$${AKS_CLUSTER_NAME}" \
		--overwrite-existing 2>/dev/null || true; \
	AKS_CONTEXT="$${AKS_CLUSTER_NAME}"; \
	if helm status boundary-worker -n boundary --kube-context "$${AKS_CONTEXT}" >/dev/null 2>&1; then \
		echo "Uninstalling Helm release boundary-worker..."; \
		helm uninstall boundary-worker --namespace boundary --kube-context "$${AKS_CONTEXT}" --wait --timeout 5m; \
		echo "✅ Helm release uninstalled"; \
	else \
		echo "⚠️  Helm release not found"; \
	fi; \
	kubectl delete namespace boundary --context "$${AKS_CONTEXT}" --ignore-not-found 2>/dev/null || true
	@rm -f worker.hcl
	@echo "✅ Removed worker.hcl"
	@if [ "$${DESTROY_CLUSTER:-false}" = "true" ]; then \
		echo ""; \
		echo "Destroying Terraform AKS stack (DESTROY_CLUSTER=true)..."; \
		$(MAKE) tf-destroy-aks; \
	else \
		echo ""; \
		echo "ℹ  AKS cluster retained. To destroy: DESTROY_CLUSTER=true make aks-cleanup"; \
	fi

# ================================
# Terraform AKS Targets
# ================================

tf-plan-aks:
	@echo "================================"
	@echo "Terraform Plan (AKS)"
	@echo "================================"
	@command -v terraform >/dev/null 2>&1 || { echo "❌ terraform not found. Install: brew install terraform"; exit 1; }
	@cd tests/integration/terraform/azure && \
		terraform init -upgrade && \
		terraform plan \
			-var="azure_subscription_id=$${AZURE_SUBSCRIPTION_ID:-}" \
			-var="azure_location=$${AZURE_LOCATION:-eastus}" \
			-var="resource_group_name=$${AZURE_RESOURCE_GROUP:-boundary-worker-rg}" \
			-var="cluster_name=$${AKS_CLUSTER_NAME:-boundary-aks-cluster}" \
			-var="k8s_version=$${K8S_VERSION:-1.31}" \
			-var="node_vm_size=$${TF_NODE_VM_SIZE:-Standard_D2s_v3}" \
			-var="node_count=$${TF_NODE_COUNT:-2}" \
			-var="node_min_count=$${TF_NODE_MIN:-1}" \
			-var="node_max_count=$${TF_NODE_MAX:-3}" \
			-var="storage_class_name=$${TF_STORAGE_CLASS_NAME:-managed-csi-premium}"

tf-setup-aks:
	@echo "================================"
	@echo "Provisioning AKS with Terraform"
	@echo "================================"
	@command -v terraform >/dev/null 2>&1 || { echo "❌ terraform not found. Install: brew install terraform"; exit 1; }
	@command -v az >/dev/null 2>&1 || { echo "❌ Azure CLI not found. Install: brew install azure-cli"; exit 1; }
	@echo "Ensuring required Azure resource providers are registered..."
	@SUB_FLAG=""; \
	if [ -n "$${AZURE_SUBSCRIPTION_ID:-}" ]; then \
		SUB_FLAG="--subscription $${AZURE_SUBSCRIPTION_ID}"; \
	fi; \
	for ns in Microsoft.ContainerService Microsoft.Network Microsoft.Compute Microsoft.Storage; do \
		STATE=$$(az provider show --namespace "$$ns" $$SUB_FLAG --query "registrationState" -o tsv 2>/dev/null || echo "Unknown"); \
		if [ "$$STATE" != "Registered" ]; then \
			echo "  Registering $$ns (current state: $$STATE)..."; \
			az provider register --namespace "$$ns" $$SUB_FLAG --wait; \
			echo "  ✅ $$ns registered"; \
		else \
			echo "  ✅ $$ns already registered"; \
		fi; \
	done
	@cd tests/integration/terraform/azure && \
		terraform init -upgrade && \
		terraform apply -auto-approve \
			-target=azurerm_resource_group.aks \
			-target=azurerm_virtual_network.aks \
			-target=azurerm_subnet.aks_nodes \
			-target=azurerm_kubernetes_cluster.aks \
			-var="azure_subscription_id=$${AZURE_SUBSCRIPTION_ID:-}" \
			-var="azure_location=$${AZURE_LOCATION:-eastus}" \
			-var="resource_group_name=$${AZURE_RESOURCE_GROUP:-boundary-worker-rg}" \
			-var="cluster_name=$${AKS_CLUSTER_NAME:-boundary-aks-cluster}" \
			-var="k8s_version=$${K8S_VERSION:-1.31}" \
			-var="node_vm_size=$${TF_NODE_VM_SIZE:-Standard_D2s_v3}" \
			-var="node_count=$${TF_NODE_COUNT:-2}" \
			-var="node_min_count=$${TF_NODE_MIN:-1}" \
			-var="node_max_count=$${TF_NODE_MAX:-3}" \
			-var="storage_class_name=$${TF_STORAGE_CLASS_NAME:-managed-csi-premium}" && \
		terraform import kubernetes_storage_class_v1.managed_csi_premium "$${TF_STORAGE_CLASS_NAME:-managed-csi-premium}" 2>/dev/null || true && \
		terraform apply -auto-approve \
			-var="azure_subscription_id=$${AZURE_SUBSCRIPTION_ID:-}" \
			-var="azure_location=$${AZURE_LOCATION:-eastus}" \
			-var="resource_group_name=$${AZURE_RESOURCE_GROUP:-boundary-worker-rg}" \
			-var="cluster_name=$${AKS_CLUSTER_NAME:-boundary-aks-cluster}" \
			-var="k8s_version=$${K8S_VERSION:-1.31}" \
			-var="node_vm_size=$${TF_NODE_VM_SIZE:-Standard_D2s_v3}" \
			-var="node_count=$${TF_NODE_COUNT:-2}" \
			-var="node_min_count=$${TF_NODE_MIN:-1}" \
			-var="node_max_count=$${TF_NODE_MAX:-3}" \
			-var="storage_class_name=$${TF_STORAGE_CLASS_NAME:-managed-csi-premium}"
	@echo ""
	@KUBECONFIG_CMD=$$(cd tests/integration/terraform/azure && terraform output -raw kubeconfig_command 2>/dev/null); \
	if [ -n "$$KUBECONFIG_CMD" ]; then \
		echo "Updating kubeconfig..."; \
		eval "$$KUBECONFIG_CMD"; \
	fi
	@echo ""
	@echo "✅ AKS cluster and all prerequisites are ready"
	@echo ""

tf-destroy-aks:
	@echo "================================"
	@echo "Destroying AKS Terraform Stack"
	@echo "================================"
	@command -v terraform >/dev/null 2>&1 || { echo "❌ terraform not found"; exit 1; }
	@cd tests/integration/terraform/azure && \
		terraform init -upgrade && \
		terraform destroy -auto-approve \
			-var="azure_subscription_id=$${AZURE_SUBSCRIPTION_ID:-}" \
			-var="azure_location=$${AZURE_LOCATION:-eastus}" \
			-var="resource_group_name=$${AZURE_RESOURCE_GROUP:-boundary-worker-rg}" \
			-var="cluster_name=$${AKS_CLUSTER_NAME:-boundary-aks-cluster}" \
			-var="k8s_version=$${K8S_VERSION:-1.31}" \
			-var="node_vm_size=$${TF_NODE_VM_SIZE:-Standard_D2s_v3}" \
			-var="node_count=$${TF_NODE_COUNT:-2}" \
			-var="node_min_count=$${TF_NODE_MIN:-1}" \
			-var="node_max_count=$${TF_NODE_MAX:-3}" \
			-var="storage_class_name=$${TF_STORAGE_CLASS_NAME:-managed-csi-premium}"
	@echo ""
	@echo "✅ AKS cluster and all Azure resources destroyed"
	@echo ""

tf-output-aks:
	@echo "================================"
	@echo "Terraform Outputs (AKS)"
	@echo "================================"
	@command -v terraform >/dev/null 2>&1 || { echo "❌ terraform not found"; exit 1; }
	@cd tests/integration/terraform/azure && terraform output

# ================================
# GCP GKE Integration Testing Targets
# ================================

gke-setup:
	@$(MAKE) tf-setup-gke

gke-helm:
	@echo "Installing Helm Chart on GKE..."
	@echo ""
	@for v in GCP_PROJECT_ID GCP_REGION GKE_ZONE GKE_CLUSTER_NAME; do \
		if [ -z "$${!v:-}" ]; then \
			echo "❌ $$v is not set."; exit 1; \
		fi; \
	done
	@[ -f worker.hcl ] || { echo "❌ worker.hcl not found. Run 'make worker-config' first"; exit 1; }
	@echo "Updating kubeconfig for cluster $${GKE_CLUSTER_NAME}..."; \
	gcloud container clusters get-credentials "$${GKE_CLUSTER_NAME}" \
		--zone "$${GKE_ZONE}" \
		--project "$${GCP_PROJECT_ID}"; \
	GKE_CONTEXT="gke_$${GCP_PROJECT_ID}_$${GKE_ZONE}_$${GKE_CLUSTER_NAME}"; \
	STORAGE_CLASS="$${TF_STORAGE_CLASS_NAME:-standard-rwo}"; \
	if helm status boundary-worker -n boundary --kube-context "$${GKE_CONTEXT}" >/dev/null 2>&1; then \
		echo "⚠️  Release 'boundary-worker' already installed — skipping. Run 'make gke-cleanup' first to reinstall."; \
	else \
		echo "Installing boundary-worker chart with GKE values..."; \
		helm install boundary-worker . \
			--namespace boundary \
			--create-namespace \
			--kube-context "$${GKE_CONTEXT}" \
			--set worker.service.proxy.type=LoadBalancer \
			--set worker.persistence.recording.storageClass=$${STORAGE_CLASS} \
			--set worker.persistence.authStorage.storageClass=$${STORAGE_CLASS} \
			--set tls.ops.disabled=true \
			--set-file worker.config=worker.hcl \
			--timeout 10m \
			--rollback-on-failure; \
	fi; \
	echo ""; \
	echo "Deployed resources:"; \
	kubectl get all -n boundary --context "$${GKE_CONTEXT}"
	@echo ""
	@echo "✅ Helm chart installed on GKE"
	@echo ""

gke-test:
	@echo "Running GKE Integration Tests..."
	@echo ""
	@for v in GCP_PROJECT_ID GCP_REGION GKE_ZONE GKE_CLUSTER_NAME BOUNDARY_ADDR BOUNDARY_AUTH_METHOD_ID BOUNDARY_LOGIN_NAME BOUNDARY_PASSWORD; do \
		if [ -z "$${!v:-}" ]; then \
			echo "❌ $$v is not set. Check your .env or export it."; \
			exit 1; \
		fi; \
	done
	@bash tests/integration/gke-integration-test.sh
	@echo ""

gke-full:
	@echo "================================"
	@echo "Full GKE Integration Workflow"
	@echo "================================"
	@echo ""
	@$(MAKE) tf-setup-gke
	@$(MAKE) worker-config
	@$(MAKE) gke-helm
	@$(MAKE) gke-test
	@echo ""
	@echo "✅ End-to-end GKE workflow has been completed successfully"
	@echo ""
	@echo "To cleanup: make gke-cleanup or DESTROY_CLUSTER=true make gke-cleanup (to also destroy the cluster)"

gke-cleanup:
	@echo "================================"
	@echo "Cleaning Up GKE Resources"
	@echo "================================"
	@echo ""
	@for v in GCP_PROJECT_ID GCP_REGION GKE_ZONE GKE_CLUSTER_NAME; do \
		if [ -z "$${!v:-}" ]; then \
			echo "❌ $$v is not set."; exit 1; \
		fi; \
	done
	@gcloud container clusters get-credentials "$${GKE_CLUSTER_NAME}" \
		--zone "$${GKE_ZONE}" \
		--project "$${GCP_PROJECT_ID}" >/dev/null 2>&1 || true; \
	GKE_CONTEXT="gke_$${GCP_PROJECT_ID}_$${GKE_ZONE}_$${GKE_CLUSTER_NAME}"; \
	if helm status boundary-worker -n boundary --kube-context "$${GKE_CONTEXT}" >/dev/null 2>&1; then \
		echo "Uninstalling Helm release boundary-worker..."; \
		helm uninstall boundary-worker --namespace boundary --kube-context "$${GKE_CONTEXT}" --wait --timeout 5m; \
		echo "✅ Helm release uninstalled"; \
	else \
		echo "⚠️  Helm release not found"; \
	fi; \
	kubectl delete namespace boundary --context "$${GKE_CONTEXT}" --ignore-not-found 2>/dev/null || true
	@rm -f worker.hcl
	@echo "✅ Removed worker.hcl"
	@if [ "$${DESTROY_CLUSTER:-false}" = "true" ]; then \
		echo ""; \
		echo "Destroying Terraform GKE stack (DESTROY_CLUSTER=true)..."; \
		$(MAKE) tf-destroy-gke; \
	else \
		echo ""; \
		echo "ℹ  GKE cluster retained. To destroy: DESTROY_CLUSTER=true make gke-cleanup"; \
	fi

# ================================
# Terraform GKE Targets
# ================================

tf-plan-gke:
	@echo "================================"
	@echo "Terraform Plan (GKE)"
	@echo "================================"
	@command -v terraform >/dev/null 2>&1 || { echo "❌ terraform not found. Install: brew install terraform"; exit 1; }
	@command -v gcloud >/dev/null 2>&1 || { echo "❌ gcloud not found. Install Google Cloud SDK first."; exit 1; }
	@if ! gcloud auth application-default print-access-token >/dev/null 2>&1; then \
		echo "❌ Google ADC is missing or expired (reauth required)."; \
		echo "   Run: gcloud auth application-default login"; \
		echo "   If your org enforces reauth, also run: gcloud auth login"; \
		exit 1; \
	fi
	@cd tests/integration/terraform/gcp && \
		terraform init -upgrade && \
		terraform plan \
			-var="project_id=$${GCP_PROJECT_ID:-}" \
			-var="region=$${GCP_REGION:-us-central1}" \
			-var="zone=$${GKE_ZONE:-us-central1-a}" \
			-var="cluster_name=$${GKE_CLUSTER_NAME:-boundary-gke-cluster}" \
			-var="node_count=$${TF_NODE_COUNT:-2}"

tf-setup-gke:
	@echo "================================"
	@echo "Provisioning GKE with Terraform"
	@echo "================================"
	@command -v terraform >/dev/null 2>&1 || { echo "❌ terraform not found. Install: brew install terraform"; exit 1; }
	@command -v gcloud >/dev/null 2>&1 || { echo "❌ gcloud not found. Install Google Cloud SDK first."; exit 1; }
	@if ! gcloud auth application-default print-access-token >/dev/null 2>&1; then \
		echo "❌ Google ADC is missing or expired (reauth required)."; \
		echo "   Run: gcloud auth application-default login"; \
		echo "   If your org enforces reauth, also run: gcloud auth login"; \
		exit 1; \
	fi
	@cd tests/integration/terraform/gcp && \
		terraform init -upgrade && \
		terraform apply -auto-approve \
			-var="project_id=$${GCP_PROJECT_ID:-}" \
			-var="region=$${GCP_REGION:-us-central1}" \
			-var="zone=$${GKE_ZONE:-us-central1-a}" \
			-var="cluster_name=$${GKE_CLUSTER_NAME:-boundary-gke-cluster}" \
			-var="node_count=$${TF_NODE_COUNT:-2}"
	@echo ""
	@echo "Updating kubeconfig..."
	@gcloud container clusters get-credentials "$${GKE_CLUSTER_NAME:-boundary-gke-cluster}" \
		--zone "$${GKE_ZONE:-us-central1-a}" \
		--region "$${GCP_REGION:-us-central1}" \
		--project "$${GCP_PROJECT_ID:-}"
	@echo ""
	@echo "✅ GKE cluster and all prerequisites are ready"
	@echo ""

tf-destroy-gke:
	@echo "================================"
	@echo "Destroying GKE Terraform Stack"
	@echo "================================"
	@command -v terraform >/dev/null 2>&1 || { echo "❌ terraform not found"; exit 1; }
	@command -v gcloud >/dev/null 2>&1 || { echo "❌ gcloud not found. Install Google Cloud SDK first."; exit 1; }
	@if ! gcloud auth application-default print-access-token >/dev/null 2>&1; then \
		echo "❌ Google ADC is missing or expired (reauth required)."; \
		echo "   Run: gcloud auth application-default login"; \
		echo "   If your org enforces reauth, also run: gcloud auth login"; \
		exit 1; \
	fi
	@cd tests/integration/terraform/gcp && \
		terraform init -upgrade && \
		terraform destroy -auto-approve \
			-var="project_id=$${GCP_PROJECT_ID:-}" \
			-var="region=$${GCP_REGION:-us-central1}" \
			-var="zone=$${GKE_ZONE:-us-central1-a}" \
			-var="cluster_name=$${GKE_CLUSTER_NAME:-boundary-gke-cluster}" \
			-var="node_count=$${TF_NODE_COUNT:-2}"
	@echo ""
	@echo "✅ GKE cluster and all GCP resources destroyed"
	@echo ""

tf-output-gke:
	@echo "================================"
	@echo "Terraform Outputs (GKE)"
	@echo "================================"
	@command -v terraform >/dev/null 2>&1 || { echo "❌ terraform not found"; exit 1; }
	@cd tests/integration/terraform/gcp && terraform output

tf-destroy:
	@echo "================================"
	@echo "Destroying EKS Terraform Stack"
	@echo "================================"
	@echo "⚠️  This will delete the EKS cluster, VPC, node groups, IAM roles, and all associated resources."
	@echo ""
	@command -v terraform >/dev/null 2>&1 || { echo "❌ terraform not found"; exit 1; }
	@cd tests/integration/terraform/aws && \
		terraform destroy -auto-approve \
			-var="aws_region=$${AWS_REGION}" \
			-var="cluster_name=$${EKS_CLUSTER_NAME:-boundary-k8s-cluster-1}" \
			-var="k8s_version=$${K8S_VERSION:-1.31}" \
			-var="node_type=$${TF_NODE_TYPE:-t3.medium}" \
			-var="node_desired=$${TF_NODE_DESIRED:-2}" \
			-var="node_min=$${TF_NODE_MIN:-1}" \
			-var="node_max=$${TF_NODE_MAX:-3}" \
			-var="lbc_chart_version=$${TF_LBC_CHART_VERSION:-1.8.1}" \
			-var="allowed_public_access_cidrs=[$${TF_ALLOWED_PUBLIC_ACCESS_CIDRS:-\"0.0.0.0/0\"}]"
	@echo ""
	@echo "✅ All EKS resources have been destroyed"