local-build-and-test.sh

#!/bin/bash
set -euo pipefail

# Local Build and Test Script for JWT-SVID Authentication
# This script builds all necessary images locally and loads them into Kind

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ROSSOCTL_DIR="${ROSSOCTL_DIR:-$(cd "$SCRIPT_DIR/../rossoctl" 2>/dev/null && pwd || echo "")}"
if [ -z "$ROSSOCTL_DIR" ] || [ ! -d "$ROSSOCTL_DIR" ]; then
    echo "ERROR: Set ROSSOCTL_DIR to point to your rossoctl repo clone"
    exit 1
fi
CLUSTER_NAME="${CLUSTER_NAME:-rossoctl-dev}"

# Auto-detect container runtime (Podman or Docker)
# If KIND_EXPERIMENTAL_PROVIDER is set to podman, use it regardless of what's installed
if [ "${KIND_EXPERIMENTAL_PROVIDER:-}" = "podman" ]; then
    CONTAINER_RUNTIME="${CONTAINER_RUNTIME:-podman}"
elif ! command -v docker &> /dev/null && command -v podman &> /dev/null; then
    # Docker not available but Podman is
    CONTAINER_RUNTIME="${CONTAINER_RUNTIME:-podman}"
else
    CONTAINER_RUNTIME="${CONTAINER_RUNTIME:-docker}"
fi

echo "Using container runtime: ${CONTAINER_RUNTIME}"

# Function to load image into Kind (handles Podman vs Docker)
load_image_to_kind() {
    local image_name="$1"
    if [ "${CONTAINER_RUNTIME}" = "podman" ]; then
        # Podman: save to tar and load
        # Replace colons and slashes to make valid filename
        local tar_file="/tmp/$(echo "${image_name}" | sed 's|[:/]|-|g').tar"
        ${CONTAINER_RUNTIME} save "${image_name}" -o "${tar_file}"
        kind load image-archive "${tar_file}" --name "${CLUSTER_NAME}"
        rm -f "${tar_file}"
    else
        # Docker: direct load
        kind load docker-image "${image_name}" --name "${CLUSTER_NAME}"
    fi
}

echo "=========================================="
echo "Building Local Images for JWT-SVID Testing"
echo "Cluster: ${CLUSTER_NAME}"
echo "=========================================="

# Check if cluster exists
if ! kind get clusters | grep -q "^${CLUSTER_NAME}$"; then
    echo "❌ Kind cluster '${CLUSTER_NAME}' not found"
    echo "Please create it first or set CLUSTER_NAME environment variable"
    exit 1
fi

echo "✅ Found Kind cluster: ${CLUSTER_NAME}"
echo ""

# Build spiffe-idp-setup (NEW - from rossoctl repo)
echo "=========================================="
echo "Building spiffe-idp-setup"
echo "=========================================="
cd "${ROSSOCTL_DIR}/rossoctl/auth/spiffe-idp-setup"
${CONTAINER_RUNTIME} build -t ghcr.io/rossoctl/rossoctl/spiffe-idp-setup:local .
load_image_to_kind ghcr.io/rossoctl/rossoctl/spiffe-idp-setup:local
echo "✅ Built and loaded: spiffe-idp-setup:local"
echo ""

# Build authbridge (proxy-sidecar combined: authbridge-proxy + spiffe-helper)
# Default deployment shape — used when the workload's mode is proxy-sidecar.
# After cortex#411 the unified binary was split into three
# mode-specific binaries; each has its own Dockerfile under cmd/authbridge-*/.
echo "=========================================="
echo "Building authbridge (proxy-sidecar combined)"
echo "=========================================="
cd "${SCRIPT_DIR}/authbridge"
# Every plugin is opt-in, so the plugin set must be named: a build without
# GO_BUILD_TAGS registers none and rejects every config it is handed.
${CONTAINER_RUNTIME} build -f cmd/authbridge-proxy/Dockerfile \
  --build-arg GO_BUILD_TAGS="$(go -C scripts/profile-tags run . full)" \
  -t ghcr.io/rossoctl/cortex/authbridge:local .
load_image_to_kind ghcr.io/rossoctl/cortex/authbridge:local
echo "✅ Built and loaded: authbridge:local"
echo ""

# Build authbridge-envoy (envoy-sidecar combined: Envoy + ext_proc + spiffe-helper)
echo "=========================================="
echo "Building authbridge-envoy (envoy-sidecar combined)"
echo "=========================================="
cd "${SCRIPT_DIR}/authbridge"
${CONTAINER_RUNTIME} build -f cmd/authbridge-envoy/Dockerfile \
  --build-arg GO_BUILD_TAGS="$(go -C scripts/profile-tags run . envoy)" \
  -t ghcr.io/rossoctl/cortex/authbridge-envoy:local .
load_image_to_kind ghcr.io/rossoctl/cortex/authbridge-envoy:local
echo "✅ Built and loaded: authbridge-envoy:local"
echo ""

# Build authbridge-lite: the same authbridge-proxy binary/Dockerfile built with
# the `lite` profile (see authbridge/scripts/profile-tags). A build variant, not
# a separate binary.
echo "=========================================="
echo "Building authbridge-lite (proxy build variant: lite profile, see authbridge/scripts/profile-tags)"
echo "=========================================="
cd "${SCRIPT_DIR}/authbridge"
${CONTAINER_RUNTIME} build -f cmd/authbridge-proxy/Dockerfile \
  --build-arg GO_BUILD_TAGS="$(go -C scripts/profile-tags run . lite)" \
  -t ghcr.io/rossoctl/cortex/authbridge-lite:local .
load_image_to_kind ghcr.io/rossoctl/cortex/authbridge-lite:local
echo "✅ Built and loaded: authbridge-lite:local"
echo ""

# Build proxy-init (iptables init container, used by envoy-sidecar mode only)
echo "=========================================="
echo "Building proxy-init"
echo "=========================================="
cd "${SCRIPT_DIR}/authbridge/proxy-init"
${CONTAINER_RUNTIME} build -f Dockerfile.init -t ghcr.io/rossoctl/cortex/proxy-init:local .
load_image_to_kind ghcr.io/rossoctl/cortex/proxy-init:local
echo "✅ Built and loaded: proxy-init:local"
echo ""

echo "=========================================="
echo "✅ All images built and loaded successfully!"
echo "=========================================="
echo ""
echo "Images loaded into cluster '${CLUSTER_NAME}':"
echo "  - ghcr.io/rossoctl/rossoctl/spiffe-idp-setup:local"
echo "  - ghcr.io/rossoctl/cortex/authbridge:local"
echo "  - ghcr.io/rossoctl/cortex/authbridge-envoy:local"
echo "  - ghcr.io/rossoctl/cortex/authbridge-lite:local"
echo "  - ghcr.io/rossoctl/cortex/proxy-init:local"
echo ""
echo "Next steps:"
echo "  1. Update values files to use :local tag"
echo "  2. Run: cd ${ROSSOCTL_DIR} && deployments/ansible/run-install.sh --env dev"
echo "  3. Verify SPIRE and Keycloak are running"
echo "  4. Run the AuthBridge demo"
echo ""