From dd11853855693c5a818fc576fac3e2bc9c5f6b4c Mon Sep 17 00:00:00 2001 From: Brian McMahon Date: Thu, 30 Jul 2026 16:10:00 -0700 Subject: [PATCH] cloud: let the environment override the cloud image and registry MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The VARIANT=cloud block pinned BUILD_IMAGE, IMAGE_REGISTRY and PUSH_IMAGE_PREFIXES with `:=`, which overrides the environment. That is right for a cloud release, but it left no way to build the cloud variant into another registry: a Calico Enterprise hashrelease passes the hashrelease registry and image via the environment and had them silently replaced with gcr.io/tigera-tesla/operator-cloud. Move the block above the enterprise defaults and use `?=` so an environment override wins, the cloud values apply when there is none, and enterprise builds are unchanged. ARCHES stays `:=` — the cloud variant is amd64 only by construction. Co-Authored-By: Claude Opus 5 (1M context) --- Makefile | 41 +++++++++++++++++++++-------------------- hack/release/README.md | 6 ++++++ 2 files changed, 27 insertions(+), 20 deletions(-) diff --git a/Makefile b/Makefile index ca0bc6f3fc..a2d5345c1f 100644 --- a/Makefile +++ b/Makefile @@ -155,13 +155,33 @@ CONTAINERIZED= mkdir -p .go-pkg-cache $(GOMOD_CACHE) && \ DOCKER_RUN := $(CONTAINERIZED) $(CALICO_BUILD) +# Calico Cloud build variant. `make VARIANT=cloud` builds and pushes the operator-cloud +# image to GCR (gcr.io/tigera-tesla/operator-cloud), amd64 only. +# These sit before the enterprise defaults and use `?=` so the environment still wins: hashreleases +# push the cloud image to the hashrelease registry instead (see hack/release/README.md). +CLOUD_LDFLAGS= +ifeq ($(VARIANT),cloud) +BUILD_IMAGE?=tigera-tesla/operator-cloud +BINARY_NAME?=operator-cloud +IMAGE_REGISTRY?=gcr.io +PUSH_IMAGE_PREFIXES?=gcr.io/ +EXCLUDE_MANIFEST_REGISTRIES?=gcr.io/ +# amd64 only. Constrain ARCHES (not just VALIDARCHES) so push-all, which iterates ARCHES, does not +# try to push arches that were never built. +ARCHES:=amd64 +# Bake cloud mode into the operator binary so it cannot be disabled at runtime (see isCloudBuild in +# cmd/cloud.go). buildVariant lives in package main, which the linker addresses as "main" (not by its +# import path), so this -X target is "main.buildVariant" rather than a $(PACKAGE_NAME)-prefixed path. +CLOUD_LDFLAGS=-X main.buildVariant=cloud +endif + BUILD_IMAGE?=tigera/operator BUILD_DIR?=build/_output BINDIR?=$(BUILD_DIR)/bin # Name of the built operator binary. The Calico Cloud variant suffixes it with -cloud -# (see VARIANT=cloud below) so the cloud artifact is easy to tell apart from the enterprise one. +# (see VARIANT=cloud above) so the cloud artifact is easy to tell apart from the enterprise one. BINARY_NAME?=operator $(BUILD_DIR): @@ -180,25 +200,6 @@ EXCLUDE_MANIFEST_REGISTRIES?="" PUSH_MANIFEST_IMAGE_PREFIXES=$(PUSH_IMAGE_PREFIXES:$(EXCLUDE_MANIFEST_REGISTRIES)%=) PUSH_NONMANIFEST_IMAGE_PREFIXES=$(filter-out $(PUSH_MANIFEST_IMAGE_PREFIXES),$(PUSH_IMAGE_PREFIXES)) -# Calico Cloud build variant. `make VARIANT=cloud` builds and pushes the operator-cloud -# image to GCR (gcr.io/tigera-tesla/operator-cloud), amd64 only. -CLOUD_LDFLAGS= -ifeq ($(VARIANT),cloud) -BUILD_IMAGE:=tigera-tesla/operator-cloud -BINARY_NAME:=operator-cloud -IMAGE_REGISTRY:=gcr.io -PUSH_IMAGE_PREFIXES:=gcr.io/ -EXCLUDE_MANIFEST_REGISTRIES:=gcr.io/ -# amd64 only. Constrain ARCHES (not just VALIDARCHES) so push-all, which iterates ARCHES, does not -# try to push arches that were never built. -ARCHES:=amd64 -# Bake cloud mode into the operator binary so it cannot be disabled at runtime (see isCloudBuild in -# cmd/cloud.go). buildVariant lives in package main, which the linker addresses as "main" (not by its -# import path), so this -X target is "main.buildVariant" rather than a $(PACKAGE_NAME)-prefixed path. -CLOUD_LDFLAGS=-X main.buildVariant=cloud -endif - - imagetag: ifndef IMAGETAG $(error IMAGETAG is undefined - run using make IMAGETAG=X.Y.Z) diff --git a/hack/release/README.md b/hack/release/README.md index 48a54db238..a87a1dc7da 100644 --- a/hack/release/README.md +++ b/hack/release/README.md @@ -95,6 +95,12 @@ binary and the same targets — only a few defaults change (publish to `gcr.io/t a `-cloud`-suffixed version, no GitHub release). Those variant-dependent defaults are resolved at startup in `internal/setup`; see that package's doc comment for how and why. +The cloud defaults for the published image (`BUILD_IMAGE`, `IMAGE_REGISTRY`, `PUSH_IMAGE_PREFIXES`) +are set with `?=` in the Makefile, so the environment still wins. Calico Enterprise hashreleases use +that: calico-private's release tool builds the cloud variant with `IMAGE_NAME=tigera/operator-cloud` +and the hashrelease registry, so hashrelease images land next to the enterprise operator instead of +in `gcr.io/tigera-tesla`. + Here `RELEASE_TAG` is the operator version, which for cloud carries the `-cloud` suffix — not a separate git tag. CI never pushes a `-cloud` git tag: pushing a plain `vA.B.C` git tag builds both the enterprise image and, from the same commit with `VARIANT=cloud`, the `vA.B.C-cloud` image as