main.go

/*

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package main

import (
	"cmp"
	"context"
	"crypto/tls"
	"errors"
	"flag"
	"fmt"
	"os"
	"path/filepath"
	"regexp"
	"runtime"
	"strconv"
	"strings"
	"time"

	metal3api "github.com/metal3-io/baremetal-operator/apis/metal3.io/v1alpha1"
	metal3iocontroller "github.com/metal3-io/baremetal-operator/internal/controller/metal3.io"
	webhooks "github.com/metal3-io/baremetal-operator/internal/webhooks/metal3.io/v1alpha1"
	ppicontroller "github.com/metal3-io/baremetal-operator/pkg/controllers"
	"github.com/metal3-io/baremetal-operator/pkg/features"
	"github.com/metal3-io/baremetal-operator/pkg/hostclaim"
	"github.com/metal3-io/baremetal-operator/pkg/imageprovider"
	"github.com/metal3-io/baremetal-operator/pkg/provisioner"
	"github.com/metal3-io/baremetal-operator/pkg/provisioner/fixture"
	"github.com/metal3-io/baremetal-operator/pkg/secretutils"
	"github.com/metal3-io/baremetal-operator/pkg/version"
	"go.uber.org/zap/zapcore"
	k8sruntime "k8s.io/apimachinery/pkg/runtime"
	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
	cliflag "k8s.io/component-base/cli/flag"
	ctrl "sigs.k8s.io/controller-runtime"
	"sigs.k8s.io/controller-runtime/pkg/cache"
	"sigs.k8s.io/controller-runtime/pkg/healthz"
	"sigs.k8s.io/controller-runtime/pkg/log/zap"
	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
	"sigs.k8s.io/controller-runtime/pkg/webhook"
)

// Constants for TLS versions.
const (
	TLSVersion12 = "TLS12"
	TLSVersion13 = "TLS13"
)

type TLSOptions struct {
	TLSMaxVersion       string
	TLSMinVersion       string
	TLSCipherSuites     string
	TLSCurvePreferences string
}

// Supported TLS Curves mapping for go1.26, make sure to update it
// when go version is updated.
var supportedTLSCurvesPreferences = map[string]tls.CurveID{
	"X25519":             tls.X25519,
	"CurveP256":          tls.CurveP256,
	"CurveP384":          tls.CurveP384,
	"CurveP521":          tls.CurveP521,
	"X25519MLKEM768":     tls.X25519MLKEM768,
	"SecP256r1MLKEM768":  tls.SecP256r1MLKEM768,
	"SecP384r1MLKEM1024": tls.SecP384r1MLKEM1024,
}

var (
	scheme               = k8sruntime.NewScheme()
	setupLog             = ctrl.Log.WithName("setup")
	healthAddr           string
	tlsOptions           = TLSOptions{}
	tlsSupportedVersions = []string{TLSVersion12, TLSVersion13}
)

const leaderElectionID = "baremetal-operator"

const (
	defaultProvisionerName      = "ironic"
	defaultProvisionerPluginDir = "/plugins"
	provisionerPluginSuffix     = "-provisioner.so"
	// provisionerNameFixture is compiled in, so selecting it skips plugin loading.
	provisionerNameFixture = "fixture"
)

// provisionerNameRE rejects flag values that would let filepath.Join escape
// the plugin directory.
var provisionerNameRE = regexp.MustCompile(`^[a-z0-9][a-z0-9-]*$`)

func init() {
	_ = clientgoscheme.AddToScheme(scheme)

	_ = metal3api.AddToScheme(scheme)
}

func printVersion() {
	setupLog.Info("Go Version: " + runtime.Version())
	setupLog.Info("Go OS/Arch", "goos", runtime.GOOS, "goarch", runtime.GOARCH)
	setupLog.Info("Git commit: " + version.Commit)
	setupLog.Info("Build time: " + version.BuildTime)
	setupLog.Info("Component: " + version.String)
}

func setupChecks(mgr ctrl.Manager) {
	if err := mgr.AddReadyzCheck("ping", healthz.Ping); err != nil {
		setupLog.Error(err, "unable to create ready check")
		os.Exit(1)
	}

	if err := mgr.AddHealthzCheck("ping", healthz.Ping); err != nil {
		setupLog.Error(err, "unable to create health check")
		os.Exit(1)
	}
}

// setupWebhookReadinessCheck adds a readiness check that blocks the pod from
// entering "Ready" state (and thus from being added to the Service's endpoints)
// until the webhook server is actually listening. This prevents a race where
// the Kubernetes API server tries to route admission webhook calls to this pod
// before the webhook TLS server is up, which would cause "no endpoints
// available" errors for BareMetalHost operations.
func setupWebhookReadinessCheck(mgr ctrl.Manager) {
	if err := mgr.AddReadyzCheck("webhook", mgr.GetWebhookServer().StartedChecker()); err != nil {
		setupLog.Error(err, "unable to create ready check for webhook server")
		os.Exit(1)
	}
}

func setupWebhooks(ctx context.Context, mgr ctrl.Manager) {
	if err := (&webhooks.BareMetalHost{}).SetupWebhookWithManager(mgr); err != nil {
		setupLog.Error(err, "unable to create webhook", "webhook", "BareMetalHost")
		os.Exit(1)
	}

	if err := (&webhooks.BMCEventSubscription{}).SetupWebhookWithManager(mgr); err != nil {
		setupLog.Error(err, "unable to create webhook", "webhook", "BareMetalHost")
		os.Exit(1)
	}

	if err := (&webhooks.HostClaimWebhook{}).SetupWebhookWithManager(mgr); err != nil {
		setupLog.Error(err, "unable to create webhook", "webhook", "HostClaim")
		os.Exit(1)
	}

	if err := (&webhooks.HostNetworkAttachment{}).SetupWebhookWithManager(ctx, mgr); err != nil {
		setupLog.Error(err, "unable to create webhook", "webhook", "HostNetworkAttachment")
		os.Exit(1)
	}

	if err := (&webhooks.DataImage{}).SetupWebhookWithManager(mgr); err != nil {
		setupLog.Error(err, "unable to create webhook", "webhook", "DataImage")
		os.Exit(1)
	}

	if err := (&webhooks.HostFirmwareComponents{}).SetupWebhookWithManager(mgr); err != nil {
		setupLog.Error(err, "unable to create webhook", "webhook", "HostFirmwareComponents")
		os.Exit(1)
	}
}

func main() {
	var watchNamespace string
	var metricsBindAddr string
	var enableLeaderElection bool
	var preprovImgEnable bool
	var hostClaimsEnable bool
	var devLogging bool
	var provisionerName string
	var webhookPort int
	var restConfigQPS float64
	var restConfigBurst int
	var controllerConcurrency int
	var maxProvisioningRetries int
	var leaseDurationSeconds string
	var renewDeadlineSeconds string
	var retryPeriodSeconds string
	var featureGates map[string]bool
	var supportedTLSCurvesNames = make([]string, 0, len(supportedTLSCurvesPreferences))
	for name := range supportedTLSCurvesPreferences {
		supportedTLSCurvesNames = append(supportedTLSCurvesNames, name)
	}

	// From CAPI point of view, BMO should be able to watch all namespaces
	// in case of a deployment that is not multi-tenant. If the deployment
	// is for multi-tenancy, then the BMO should watch only the provided
	// namespace.
	flag.StringVar(&watchNamespace, "namespace", os.Getenv("WATCH_NAMESPACE"),
		"Namespace that the controller watches to reconcile host resources.")
	flag.StringVar(&metricsBindAddr, "metrics-addr", ":8443",
		"The address the metric endpoint binds to.")
	flag.BoolVar(&enableLeaderElection, "enable-leader-election", false,
		"Enable leader election for controller manager. "+
			"Enabling this will ensure there is only one active controller manager.")
	flag.BoolVar(&preprovImgEnable, "build-preprov-image", false, "enable integration with the PreprovisioningImage API")
	flag.BoolVar(&hostClaimsEnable, "hostclaims", false, "enable HostClaims controller")
	flag.BoolVar(&devLogging, "dev", false, "enable developer logging")
	flag.StringVar(&provisionerName, "provisioner", defaultProvisionerName,
		"Name of the provisioner plugin to load. Resolves to "+
			"$PROVISIONER_PLUGIN_DIR/<name>"+provisionerPluginSuffix+
			" (default dir "+defaultProvisionerPluginDir+"). "+
			"Use "+provisionerNameFixture+" for the compiled-in fixture provisioner.")
	flag.StringVar(&healthAddr, "health-addr", ":9440",
		"The address the health endpoint binds to.")
	flag.IntVar(&webhookPort, "webhook-port", 9443, //nolint:mnd
		"Webhook Server port (set to 0 to disable)")
	flag.Float64Var(&restConfigQPS, "kube-api-qps", 20, //nolint:mnd
		"Maximum queries per second from the controller client to the Kubernetes API server. Default 20")
	flag.IntVar(&restConfigBurst, "kube-api-burst", 30, //nolint:mnd
		"Maximum number of queries that should be allowed in one burst from the controller client to the Kubernetes API server. Default 30")
	flag.StringVar(&tlsOptions.TLSMinVersion, "tls-min-version", TLSVersion12,
		"The minimum TLS version in use by the webhook server.\n"+
			fmt.Sprintf("Possible values are %s.", strings.Join(tlsSupportedVersions, ", ")),
	)
	flag.StringVar(&tlsOptions.TLSMaxVersion, "tls-max-version", TLSVersion13,
		"The maximum TLS version in use by the webhook server.\n"+
			fmt.Sprintf("Possible values are %s.", strings.Join(tlsSupportedVersions, ", ")),
	)

	tlsCipherPreferredValues := cliflag.PreferredTLSCipherNames()
	tlsCipherInsecureValues := cliflag.InsecureTLSCipherNames()
	flag.StringVar(&tlsOptions.TLSCipherSuites, "tls-cipher-suites", "",
		"Comma-separated list of cipher suites for the webhook server. "+
			"If omitted, the default Go cipher suites will be used. \n"+
			"Preferred values: "+strings.Join(tlsCipherPreferredValues, ", ")+". \n"+
			"Insecure values: "+strings.Join(tlsCipherInsecureValues, ", ")+".")
	flag.StringVar(&tlsOptions.TLSCurvePreferences, "tls-curve-preferences", "",
		"Comma-separated list of curve/group preferences for the webhook and metrics servers. "+
			"If omitted, the default Go curve preferences will be used. "+
			"Possible values: "+strings.Join(supportedTLSCurvesNames, ", ")+".")
	flag.IntVar(&controllerConcurrency, "controller-concurrency", 0,
		"Number of CRs of each type to process simultaneously")
	flag.IntVar(&maxProvisioningRetries, "max-provisioning-retries", 5, //nolint:mnd
		"Maximum number of provisioning retries before giving up. Set to 0 to disable the limit (infinite retries).")

	flag.StringVar(&leaseDurationSeconds, "lease-duration-seconds", os.Getenv("LEASE_DURATION_SECONDS"), "Leader election duration in seconds.")
	flag.StringVar(&renewDeadlineSeconds, "renew-deadline-seconds", os.Getenv("RENEW_DEADLINE_SECONDS"), "Leader election renew deadline duration in seconds.")
	flag.StringVar(&retryPeriodSeconds, "retry-period-seconds", os.Getenv("RETRY_PERIOD_SECONDS"), "Leader election retry period in seconds.")

	featureGatesFlag := cliflag.NewMapStringBool(&featureGates)
	if defaultFeatureGates := os.Getenv("FEATURE_GATES"); defaultFeatureGates != "" {
		if err := featureGatesFlag.Set(defaultFeatureGates); err != nil {
			fmt.Fprintf(os.Stderr, "unable to parse FEATURE_GATES environment variable: %v\n", err)
			os.Exit(1)
		}
	}
	flag.Var(featureGatesFlag, "feature-gates", "A set of key=value pairs that describe feature gates:\n"+
		strings.Join(features.CurrentFeatureGate.KnownFeatures(), "\n"))

	flag.Parse()

	logOpts := zap.Options{}
	if devLogging {
		logOpts.Development = true
		logOpts.TimeEncoder = zapcore.ISO8601TimeEncoder
	} else {
		logOpts.TimeEncoder = zapcore.EpochTimeEncoder
	}
	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&logOpts)))

	if err := features.CurrentFeatureGate.SetFromMap(featureGates); err != nil {
		setupLog.Error(err, "unable to set feature gates")
		os.Exit(1)
	}

	printVersion()
	setupLog.Info("feature gates", "gates", features.CurrentFeatureGate.String())

	var hostFeatures []provisioner.HostFeature
	if preprovImgEnable {
		hostFeatures = append(hostFeatures, provisioner.FeaturePreprovisioningImage)
	}

	// Default namespace for the provisioner, overridable by the plugin.
	provisionerNamespace := cmp.Or(os.Getenv("POD_NAMESPACE"), watchNamespace)

	// Open the plugin before any K8s I/O so a bad path fails fast.
	var provisionerPlugin *provisioner.Plugin
	var pluginRequirements provisioner.HostRequirements
	if provisionerName != provisionerNameFixture {
		if !provisionerNameRE.MatchString(provisionerName) {
			setupLog.Error(fmt.Errorf("invalid provisioner name %q", provisionerName),
				"provisioner name must match "+provisionerNameRE.String())
			os.Exit(1)
		}
		pluginDir := cmp.Or(os.Getenv("PROVISIONER_PLUGIN_DIR"), defaultProvisionerPluginDir)
		pluginPath := filepath.Join(pluginDir, provisionerName+provisionerPluginSuffix)
		p, err := provisioner.Open(pluginPath, provisionerName)
		if err != nil {
			setupLog.Error(err, "cannot load provisioner plugin",
				"name", provisionerName, "dir", pluginDir, "path", pluginPath)
			os.Exit(1)
		}
		provisionerPlugin = p
		setupLog.Info("loaded provisioner plugin",
			"name", provisionerPlugin.Name(), "path", provisionerPlugin.Path())

		pluginRequirements, err = provisionerPlugin.HostConfigure(provisioner.HostConfigureInput{
			Logger:               setupLog,
			Features:             hostFeatures,
			ProvisionerNamespace: provisionerNamespace,
		})
		if err != nil {
			setupLog.Error(err, "plugin HostConfigure failed",
				"name", provisionerPlugin.Name(), "path", provisionerPlugin.Path())
			os.Exit(1)
		}
		if pluginRequirements.AddToScheme != nil {
			if err := pluginRequirements.AddToScheme(scheme); err != nil {
				setupLog.Error(err, "plugin AddToScheme failed",
					"name", provisionerPlugin.Name())
				os.Exit(1)
			}
		}
	}

	enableWebhook := webhookPort != 0

	leaderElectionNamespace := os.Getenv("POD_NAMESPACE")
	if leaderElectionNamespace == "" {
		leaderElectionNamespace = watchNamespace
	}
	tlsOptionOverrides, err := GetTLSOptionOverrideFuncs(tlsOptions)
	if err != nil {
		setupLog.Error(err, "unable to add TLS settings to the webhook server")
		os.Exit(1)
	}
	restConfig := ctrl.GetConfigOrDie()
	restConfig.QPS = float32(restConfigQPS)
	restConfig.Burst = restConfigBurst

	watchNamespaces := make(map[string]cache.Config)

	if strings.Contains(watchNamespace, ",") {
		setupLog.Info("Manager set up with multiple namespaces to watch", "namespaces", watchNamespace)
		namespaces := strings.Split(watchNamespace, ",")
		for _, namespace := range namespaces {
			watchNamespaces[namespace] = cache.Config{}
		}
	} else if watchNamespace != "" {
		setupLog.Info("Manager set up to watch a single namespace", "namespace", watchNamespace)
		watchNamespaces[watchNamespace] = cache.Config{}
	} else {
		setupLog.Info("Manager set up with cluster scope")
	}

	ctrlOpts := ctrl.Options{
		Scheme: scheme,
		Metrics: metricsserver.Options{
			BindAddress:    metricsBindAddr,
			SecureServing:  true,
			FilterProvider: filters.WithAuthenticationAndAuthorization,
			TLSOpts:        tlsOptionOverrides,
		},
		WebhookServer: webhook.NewServer(webhook.Options{
			Port:    webhookPort,
			TLSOpts: tlsOptionOverrides,
		}),
		LeaderElection:                enableLeaderElection,
		LeaderElectionID:              leaderElectionID,
		LeaderElectionNamespace:       leaderElectionNamespace,
		LeaderElectionReleaseOnCancel: true,
		HealthProbeBindAddress:        healthAddr,
		Cache: cache.Options{
			ByObject:          secretutils.AddSecretSelector(pluginRequirements.CacheByObject),
			DefaultNamespaces: watchNamespaces,
		},
	}

	if leaseDurationSeconds != "" {
		var seconds int64
		seconds, err = strconv.ParseInt(leaseDurationSeconds, 10, 16)
		if err != nil {
			setupLog.Error(err, "failed to parse duration")
			os.Exit(1)
		}

		duration := time.Second * time.Duration(seconds)
		ctrlOpts.LeaseDuration = &duration
	}

	if renewDeadlineSeconds != "" {
		var seconds int64
		seconds, err = strconv.ParseInt(renewDeadlineSeconds, 10, 16)
		if err != nil {
			setupLog.Error(err, "failed to parse renew deadline")
			os.Exit(1)
		}

		duration := time.Second * time.Duration(seconds)
		ctrlOpts.RenewDeadline = &duration
	}

	if retryPeriodSeconds != "" {
		var seconds int64
		seconds, err = strconv.ParseInt(retryPeriodSeconds, 10, 16)
		if err != nil {
			setupLog.Error(err, "failed to parse retry period")
			os.Exit(1)
		}
		duration := time.Second * time.Duration(seconds)
		ctrlOpts.RetryPeriod = &duration
	}

	mgr, err := ctrl.NewManager(restConfig, ctrlOpts)
	if err != nil {
		setupLog.Error(err, "unable to start manager")
		os.Exit(1)
	}

	var provisionerFactory provisioner.Factory
	if provisionerName == provisionerNameFixture {
		ctrl.Log.Info("using fixture provisioner")
		provisionerFactory = &fixture.Fixture{}
	} else {
		provLog := zap.New(zap.UseFlagOptions(&logOpts)).WithName("provisioner")
		provisionerFactory, err = provisionerPlugin.NewFactory(provisioner.PluginConfig{
			Logger:               provLog,
			Features:             hostFeatures,
			K8sClient:            mgr.GetClient(),
			APIReader:            mgr.GetAPIReader(),
			ProvisionerNamespace: provisionerNamespace,
		})
		if err != nil {
			setupLog.Error(err, "cannot initialize provisioner plugin", "path", provisionerPlugin.Path())
			os.Exit(1)
		}
	}

	maxConcurrency, err := getMaxConcurrentReconciles(controllerConcurrency)
	if err != nil {
		setupLog.Error(err, "unable to create controllers")
		os.Exit(1)
	}

	if maxProvisioningRetries < 0 {
		setupLog.Error(fmt.Errorf("invalid value %d", maxProvisioningRetries),
			"--max-provisioning-retries must be 0 (unlimited) or a positive integer")
		os.Exit(1)
	}

	if err = (&metal3iocontroller.BareMetalHostReconciler{
		Client:                 mgr.GetClient(),
		Log:                    ctrl.Log.WithName("controllers").WithName("BareMetalHost"),
		ProvisionerFactory:     provisionerFactory,
		APIReader:              mgr.GetAPIReader(),
		MaxProvisioningRetries: maxProvisioningRetries,
	}).SetupWithManager(mgr, preprovImgEnable, maxConcurrency); err != nil {
		setupLog.Error(err, "unable to create controller", "controller", "BareMetalHost")
		os.Exit(1)
	}

	if preprovImgEnable {
		imgReconciler := ppicontroller.PreprovisioningImageReconciler{
			Client:        mgr.GetClient(),
			Log:           ctrl.Log.WithName("controllers").WithName("PreprovisioningImage"),
			APIReader:     mgr.GetAPIReader(),
			Scheme:        mgr.GetScheme(),
			ImageProvider: imageprovider.NewDefaultImageProvider(),
		}
		if imgReconciler.CanStart() {
			if err = (&imgReconciler).SetupWithManager(mgr, maxConcurrency); err != nil {
				setupLog.Error(err, "unable to create controller", "controller", "PreprovisioningImage")
				os.Exit(1)
			}
		}
	}

	if hostClaimsEnable {
		if err = (&metal3iocontroller.HostClaimReconciler{
			Client:              mgr.GetClient(),
			Log:                 ctrl.Log.WithName("controllers").WithName("HostClaim"),
			Scheme:              mgr.GetScheme(),
			APIReader:           mgr.GetAPIReader(),
			NewHostClaimManager: hostclaim.NewManager,
		}).SetupWithManager(mgr); err != nil {
			setupLog.Error(err, "unable to create controller", "controller", "HostClaim")
			os.Exit(1)
		}
	}

	// +kubebuilder:scaffold:builder

	if err = (&metal3iocontroller.HostFirmwareSettingsReconciler{
		Client:             mgr.GetClient(),
		Log:                ctrl.Log.WithName("controllers").WithName("HostFirmwareSettings"),
		ProvisionerFactory: provisionerFactory,
	}).SetupWithManager(mgr, maxConcurrency); err != nil {
		setupLog.Error(err, "unable to create controller", "controller", "HostFirmwareSettings")
		os.Exit(1)
	}

	if err = (&metal3iocontroller.BMCEventSubscriptionReconciler{
		Client:             mgr.GetClient(),
		Log:                ctrl.Log.WithName("controllers").WithName("BMCEventSubscription"),
		ProvisionerFactory: provisionerFactory,
	}).SetupWithManager(mgr, maxConcurrency); err != nil {
		setupLog.Error(err, "unable to create controller", "controller", "BMCEventSubscription")
		os.Exit(1)
	}

	if err = (&metal3iocontroller.HostFirmwareComponentsReconciler{
		Client:             mgr.GetClient(),
		Log:                ctrl.Log.WithName("controllers").WithName("HostFirmwareComponents"),
		ProvisionerFactory: provisionerFactory,
	}).SetupWithManager(mgr, maxConcurrency); err != nil {
		setupLog.Error(err, "unable to create controller", "controller", "HostFirmwareComponents")
		os.Exit(1)
	}

	if err = (&metal3iocontroller.DataImageReconciler{
		Client:             mgr.GetClient(),
		Log:                ctrl.Log.WithName("controllers").WithName("DataImage"),
		ProvisionerFactory: provisionerFactory,
	}).SetupWithManager(mgr, maxConcurrency); err != nil {
		setupLog.Error(err, "unable to create controller", "controller", "DataImage")
		os.Exit(1)
	}

	networkingEnabledValue := os.Getenv("IRONIC_NETWORKING_ENABLED")
	networkingEnabled, err := strconv.ParseBool(networkingEnabledValue)
	if err != nil && networkingEnabledValue != "" {
		setupLog.Error(err, "invalid environment variable value", "name", "IRONIC_NETWORKING_ENABLED", "value", networkingEnabledValue)
		os.Exit(1)
	}
	if networkingEnabled {
		switchConfigsSecretName := os.Getenv("IRONIC_SWITCH_CONFIGS_SECRET")
		if switchConfigsSecretName == "" {
			setupLog.Error(errors.New("IRONIC_SWITCH_CONFIGS_SECRET must be set when IRONIC_NETWORKING_ENABLED=true"), "missing required environment variable")
			os.Exit(1)
		}

		switchCredentialSecretName := os.Getenv("IRONIC_SWITCH_CREDENTIALS_SECRET")
		if switchCredentialSecretName == "" {
			setupLog.Error(errors.New("IRONIC_SWITCH_CREDENTIALS_SECRET must be set when IRONIC_NETWORKING_ENABLED=true"), "missing required environment variable")
			os.Exit(1)
		}

		switchCredentialPath := os.Getenv("IRONIC_SWITCH_CREDENTIALS_PATH")
		if switchCredentialPath == "" {
			setupLog.Error(errors.New("IRONIC_SWITCH_CREDENTIALS_PATH must be set when IRONIC_NETWORKING_ENABLED=true"), "missing required environment variable")
			os.Exit(1)
		}

		if err = (&metal3iocontroller.BareMetalSwitchReconciler{
			Client:                     mgr.GetClient(),
			Log:                        ctrl.Log.WithName("controllers").WithName("BareMetalSwitch"),
			APIReader:                  mgr.GetAPIReader(),
			SwitchConfigsSecretName:    switchConfigsSecretName,
			SwitchCredentialSecretName: switchCredentialSecretName,
			SwitchCredentialPath:       switchCredentialPath,
		}).SetupWithManager(mgr, maxConcurrency); err != nil {
			setupLog.Error(err, "unable to create controller", "controller", "BareMetalSwitch")
			os.Exit(1)
		}
	}

	setupChecks(mgr)

	ctx := ctrl.SetupSignalHandler()

	if enableWebhook {
		setupWebhookReadinessCheck(mgr)
		setupWebhooks(ctx, mgr)
	}

	setupLog.Info("starting manager")
	if err := mgr.Start(ctx); err != nil {
		setupLog.Error(err, "problem running manager")
		os.Exit(1)
	}
}

// GetTLSOptionOverrideFuncs returns a list of TLS configuration overrides to be used
// by the webhook server.
func GetTLSOptionOverrideFuncs(options TLSOptions) ([]func(*tls.Config), error) {
	var tlsOptions []func(config *tls.Config)

	// To make a static analyzer happy, this block ensures there is no code
	// path that sets a TLS version outside the acceptable values, even in
	// case of unexpected user input.
	var tlsMinVersion, tlsMaxVersion uint16
	for version, option := range map[*uint16]string{&tlsMinVersion: options.TLSMinVersion, &tlsMaxVersion: options.TLSMaxVersion} {
		switch option {
		case TLSVersion12:
			*version = tls.VersionTLS12
		case TLSVersion13:
			*version = tls.VersionTLS13
		default:
			return nil, fmt.Errorf("unexpected TLS version %q (must be one of: %s)", option, strings.Join(tlsSupportedVersions, ", "))
		}
	}

	if tlsMaxVersion != 0 && tlsMinVersion > tlsMaxVersion {
		return nil, fmt.Errorf("TLS version flag min version (%s) is greater than max version (%s)",
			options.TLSMinVersion, options.TLSMaxVersion)
	}

	tlsOptions = append(tlsOptions, func(cfg *tls.Config) {
		cfg.MinVersion = tlsMinVersion
	})

	tlsOptions = append(tlsOptions, func(cfg *tls.Config) {
		cfg.MaxVersion = tlsMaxVersion
	})
	// Cipher suites should not be set if empty.
	if tlsMinVersion >= tls.VersionTLS13 &&
		options.TLSCipherSuites != "" {
		setupLog.Info("warning: Cipher suites should not be set for TLS version 1.3. Ignoring ciphers")
		options.TLSCipherSuites = ""
	}

	if options.TLSCipherSuites != "" {
		tlsCipherSuites := strings.Split(options.TLSCipherSuites, ",")
		suites, err := cliflag.TLSCipherSuites(tlsCipherSuites)
		if err != nil {
			return nil, err
		}

		insecureCipherValues := cliflag.InsecureTLSCipherNames()
		for _, cipher := range tlsCipherSuites {
			for _, insecureCipherName := range insecureCipherValues {
				if insecureCipherName == cipher {
					setupLog.Info("warning: use of insecure cipher detected", "cipher", cipher)
				}
			}
		}
		tlsOptions = append(tlsOptions, func(cfg *tls.Config) {
			cfg.CipherSuites = suites
		})
	}

	if options.TLSCurvePreferences != "" {
		curveNames := strings.Split(options.TLSCurvePreferences, ",")
		curves := make([]tls.CurveID, 0, len(curveNames))
		for _, name := range curveNames {
			name = strings.TrimSpace(name)
			curveID, exists := supportedTLSCurvesPreferences[name]
			if !exists {
				return nil, fmt.Errorf("unrecognized TLS curve preference %q", name)
			}
			curves = append(curves, curveID)
		}
		tlsOptions = append(tlsOptions, func(cfg *tls.Config) {
			cfg.CurvePreferences = curves
		})
	}

	return tlsOptions, nil
}

func getMaxConcurrentReconciles(controllerConcurrency int) (int, error) {
	if controllerConcurrency > 0 {
		ctrl.Log.Info("controller concurrency set from command line flag", "concurrency", controllerConcurrency)
		return controllerConcurrency, nil
	} else if controllerConcurrency < 0 {
		return 0, fmt.Errorf("controller concurrency value: %d is invalid", controllerConcurrency)
	}

	// controller-concurrency value is 0 i.e. no values passed via the flag
	// maxConcurrentReconcile value would be set based on env var or number of CPUs.
	maxConcurrentReconciles := min(runtime.NumCPU(), 8) //nolint:mnd
	if maxConcurrentReconciles < 2 {                    //nolint:mnd
		maxConcurrentReconciles = 2
	}
	if mcrEnv, ok := os.LookupEnv("BMO_CONCURRENCY"); ok {
		mcr, err := strconv.Atoi(mcrEnv)
		if err != nil {
			return 0, fmt.Errorf("BMO_CONCURRENCY value: %s is invalid: %w", mcrEnv, err)
		}
		if mcr > 0 {
			ctrl.Log.Info("controller concurrency set from environment variable", "concurrency", mcr)
			maxConcurrentReconciles = mcr
		} else {
			ctrl.Log.Info("invalid BMO_CONCURRENCY value, using default", "default", maxConcurrentReconciles)
		}
	} else {
		ctrl.Log.Info("using default controller concurrency", "concurrency", maxConcurrentReconciles)
	}
	return maxConcurrentReconciles, nil
}