Feature/119 support dogu v3

Dockerfile

@@ -54,6 +54,8 @@ RUN set -x -o errexit -o nounset -o pipefail \
 # copy resources after package installation, that we can override package defaults
 COPY ./resources /
 
+COPY dogu.json /
+
 # set permissions
 RUN mkdir -p ${SCM_HOME} \
     && chown scm:scm ${SCM_HOME} \

Makefile

@@ -1,9 +1,36 @@
-MAKEFILES_VERSION=10.6.0
+MAKEFILES_VERSION=10.10.0
 .DEFAULT_GOAL:=dogu-release
 
 include build/make/variables.mk
 include build/make/self-update.mk
 include build/make/clean.mk
 include build/make/release.mk
 include build/make/bats.mk
-include build/make/k8s-dogu.mk
+include build/make/k8s-dogu.mk
+
+SCM_V3_RELEASE      ?= scm
+SCM_V3_HELM_SOURCE  ?= k8s/helm
+
+# The chart composes the image as "<registry>/<repository>:<tag>", so the dev pull ref (IMAGE_DEV) must be split
+SCM_V3_IMAGE_REPOSITORY = $(patsubst $(CES_REGISTRY_HOST)/%,%,$(IMAGE_DEV))
+
+.PHONY: scm-v3-install
+scm-v3-install: IMAGE = $(IMAGE_DEV_VERSION)
+scm-v3-install: image-import $(BINARY_HELM) ## DoguV3 dev: build+push the image and helm upgrade/install the chart.
+	@echo "Installing DoguV3 release '$(SCM_V3_RELEASE)' into namespace '$(NAMESPACE)' (context '$(KUBE_CONTEXT_NAME)')..."
+	@echo "  image: $(CES_REGISTRY_HOST)/$(SCM_V3_IMAGE_REPOSITORY):$(VERSION)"
+	@$(BINARY_HELM) upgrade --install $(SCM_V3_RELEASE) $(SCM_V3_HELM_SOURCE) \
+		--kube-context="$(KUBE_CONTEXT_NAME)" \
+		--namespace $(NAMESPACE) \
+		--set-string fullnameOverride=$(SCM_V3_RELEASE) \
+		--set-string scm.image.registry="$(CES_REGISTRY_HOST)" \
+		--set-string scm.image.repository="$(SCM_V3_IMAGE_REPOSITORY)" \
+		--set-string scm.image.tag="$(VERSION)" \
+		--set-string scm.imagePullPolicy=Always
+	@echo "Done. Watch rollout: kubectl -n $(NAMESPACE) get pods -w"
+
+.PHONY: scm-v3-uninstall
+scm-v3-uninstall: $(BINARY_HELM) ## DoguV3 dev: uninstall the chart (keeps PVCs).
+	@$(BINARY_HELM) --kube-context="$(KUBE_CONTEXT_NAME)" uninstall $(SCM_V3_RELEASE) --namespace $(NAMESPACE) || true
+	@echo "Note: PVCs are retained. Delete them manually to reset data:"
+	@echo "  kubectl -n $(NAMESPACE) delete pvc -l app.kubernetes.io/name=scm"

build/make/coder-lib.sh

@@ -88,7 +88,7 @@ function doTrivyConvert() {
   "$containerExec" run --rm --pull=always \
     -v trivy-cache:/root/.cache \
     -v "$jsonScanToConvert:$containerJsonScanFile" \
-    aquasec/trivy -q \
+    "${TRIVY_IMAGE}" -q \
     convert $trivyFlags "$containerJsonScanFile"  > "$outputFile"
 }
 

build/make/coder.mk

@@ -35,6 +35,10 @@ GOPASS_BIN?=$(shell command -v gopass 2> /dev/null)
 
 EXCLUDED_TEMPLATE_FILES?=rich-parameters.yaml variables.yaml
 
+TRIVY_VERSION ?= latest
+TRIVY_IMAGE = aquasec/trivy:$(TRIVY_VERSION)
+
+export TRIVY_IMAGE
 
 ##@ Coder template development
 
@@ -107,7 +111,7 @@ ${CONTAINER_IMAGE_TRIVY_SCAN_JSON}: ${CONTAINER_IMAGE_TAR}
 	${CONTAINER_BIN} run --rm --pull=always \
 		-v "trivy-cache:/root/.cache" \
 		-v "${CONTAINER_IMAGE_TAR}:/tmp/image.tar" \
-		aquasec/trivy -q \
+		$(TRIVY_IMAGE) -q \
 		image --scanners vuln --input /tmp/image.tar -f json --timeout 15m \
 		> ${CONTAINER_IMAGE_TRIVY_SCAN_JSON}
 

build/make/k8s-component.mk

@@ -1,26 +1,37 @@
+COMPONENT_ARTIFACT_ID?=$(ARTIFACT_ID)
 COMPONENT_BUILD_VERSION := $(shell date +%s)
 COMPONENT_DEV_VERSION?=${VERSION}-dev.${COMPONENT_BUILD_VERSION}
 
-include ${BUILD_DIR}/make/k8s.mk
+ifeq (${K8S_MK_INCLUDE_MARKER}, )
+	include ${BUILD_DIR}/make/k8s.mk
+endif
 
 ifeq (${RUNTIME_ENV}, local)
 	BINARY_HELM_ADDITIONAL_PUSH_ARGS?=--plain-http
 endif
+ifeq (${RUNTIME_ENV}, k3d)
+	BINARY_HELM_ADDITIONAL_PUSH_ARGS?=--plain-http
+endif
 BINARY_HELM_ADDITIONAL_PACK_ARGS?=
 BINARY_HELM_ADDITIONAL_UNINST_ARGS?=
 BINARY_HELM_ADDITIONAL_UPGR_ARGS?=
 
 HELM_TARGET_DIR ?= $(K8S_RESOURCE_TEMP_FOLDER)/helm
 HELM_SOURCE_DIR ?= k8s/helm
-HELM_RELEASE_TGZ=${HELM_TARGET_DIR}/${ARTIFACT_ID}-${VERSION}.tgz
-HELM_DEV_RELEASE_TGZ=${HELM_TARGET_DIR}/${ARTIFACT_ID}-${COMPONENT_DEV_VERSION}.tgz
+HELM_RELEASE_TGZ=${HELM_TARGET_DIR}/${COMPONENT_ARTIFACT_ID}-${VERSION}.tgz
+HELM_DEV_RELEASE_TGZ=${HELM_TARGET_DIR}/${COMPONENT_ARTIFACT_ID}-${COMPONENT_DEV_VERSION}.tgz
 HELM_ARTIFACT_NAMESPACE?=k8s
+HELM_PUSH_REGISTRY_HOST?=${CES_REGISTRY_HOST}
 ifeq (${RUNTIME_ENV}, remote)
 	HELM_ARTIFACT_NAMESPACE=testing/k8s
 endif
+ifeq (${RUNTIME_ENV}, k3d)
+	HELM_PUSH_REGISTRY_HOST=$(IMAGE_PUSH_REGISTRY_HOST)
+endif
 $(info HELM_ARTIFACT_NAMESPACE=$(HELM_ARTIFACT_NAMESPACE))
+$(info HELM_PUSH_REGISTRY_HOST=$(HELM_PUSH_REGISTRY_HOST))
 
-K8S_RESOURCE_COMPONENT ?= "${K8S_RESOURCE_TEMP_FOLDER}/component-${ARTIFACT_ID}-${VERSION}.yaml"
+K8S_RESOURCE_COMPONENT ?= "${K8S_RESOURCE_TEMP_FOLDER}/component-${COMPONENT_ARTIFACT_ID}-${VERSION}.yaml"
 K8S_RESOURCE_COMPONENT_CR_TEMPLATE_YAML ?= $(BUILD_DIR)/make/k8s-component.tpl
 # HELM_PRE_GENERATE_TARGETS allows to execute targets that affect Helm source files AND Helm target files.
 HELM_PRE_GENERATE_TARGETS ?=
@@ -38,8 +49,8 @@ IMAGE_IMPORT_TARGET?=
 helm-init-chart: ${BINARY_HELM} ## Creates a Chart.yaml-template with zero values
 	@echo "Initialize ${HELM_SOURCE_DIR}/Chart.yaml..."
 	@mkdir -p ${HELM_SOURCE_DIR}/tmp/
-	@${BINARY_HELM} create ${HELM_SOURCE_DIR}/tmp/${ARTIFACT_ID}
-	@cp ${HELM_SOURCE_DIR}/tmp/${ARTIFACT_ID}/Chart.yaml ${HELM_SOURCE_DIR}/
+	@${BINARY_HELM} create ${HELM_SOURCE_DIR}/tmp/${COMPONENT_ARTIFACT_ID}
+	@cp ${HELM_SOURCE_DIR}/tmp/${COMPONENT_ARTIFACT_ID}/Chart.yaml ${HELM_SOURCE_DIR}/
 	@rm -dr ${HELM_SOURCE_DIR}/tmp
 	@sed -i 's/appVersion: ".*"/appVersion: "0.0.0-replaceme"/' ${HELM_SOURCE_DIR}/Chart.yaml
 	@sed -i 's/version: .*/version: 0.0.0-replaceme/' ${HELM_SOURCE_DIR}/Chart.yaml
@@ -82,24 +93,24 @@ helm-update-dependencies: ${BINARY_HELM} ## Update Helm chart dependencies
 .PHONY: helm-apply
 helm-apply: ${BINARY_HELM} check-k8s-namespace-env-var ${IMAGE_IMPORT_TARGET} helm-generate ${HELM_PRE_APPLY_TARGETS} ## Generates and installs the Helm chart.
 	@echo "Apply generated helm chart"
-	@${BINARY_HELM} --kube-context="${KUBE_CONTEXT_NAME}" upgrade -i ${ARTIFACT_ID} ${HELM_TARGET_DIR} ${BINARY_HELM_ADDITIONAL_UPGR_ARGS} --namespace ${NAMESPACE}
+	@${BINARY_HELM} --kube-context="${KUBE_CONTEXT_NAME}" upgrade -i ${COMPONENT_ARTIFACT_ID} ${HELM_TARGET_DIR} ${BINARY_HELM_ADDITIONAL_UPGR_ARGS} --namespace ${NAMESPACE}
 
 .PHONY: helm-delete
 helm-delete: ${BINARY_HELM} check-k8s-namespace-env-var ## Uninstalls the current Helm chart.
 	@echo "Uninstall helm chart"
-	@${BINARY_HELM} --kube-context="${KUBE_CONTEXT_NAME}" uninstall ${ARTIFACT_ID} --namespace=${NAMESPACE} ${BINARY_HELM_ADDITIONAL_UNINST_ARGS} || true
+	@${BINARY_HELM} --kube-context="${KUBE_CONTEXT_NAME}" uninstall ${COMPONENT_ARTIFACT_ID} --namespace=${NAMESPACE} ${BINARY_HELM_ADDITIONAL_UNINST_ARGS} || true
 
 .PHONY: helm-reinstall
 helm-reinstall: helm-delete helm-apply ## Uninstalls the current helm chart and reinstalls it.
 
 .PHONY: helm-chart-import
 helm-chart-import: ${CHECK_VAR_TARGETS} helm-generate helm-package ${IMAGE_IMPORT_TARGET} ## Imports the currently available chart into the cluster-local registry.
 	@if [[ ${STAGE} == "development" ]]; then \
-		echo "Import ${HELM_DEV_RELEASE_TGZ} into K8s cluster ${CES_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE}..."; \
-		${BINARY_HELM} push ${HELM_DEV_RELEASE_TGZ} oci://${CES_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE} ${BINARY_HELM_ADDITIONAL_PUSH_ARGS}; \
+		echo "Import ${HELM_DEV_RELEASE_TGZ} into K8s cluster ${HELM_PUSH_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE}..."; \
+		${BINARY_HELM} push ${HELM_DEV_RELEASE_TGZ} oci://${HELM_PUSH_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE} ${BINARY_HELM_ADDITIONAL_PUSH_ARGS}; \
 	else \
-	  	echo "Import ${HELM_RELEASE_TGZ} into K8s cluster ${CES_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE}..."; \
-        ${BINARY_HELM} push ${HELM_RELEASE_TGZ} oci://${CES_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE} ${BINARY_HELM_ADDITIONAL_PUSH_ARGS}; \
+	  	echo "Import ${HELM_RELEASE_TGZ} into K8s cluster ${HELM_PUSH_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE}..."; \
+        ${BINARY_HELM} push ${HELM_RELEASE_TGZ} oci://${HELM_PUSH_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE} ${BINARY_HELM_ADDITIONAL_PUSH_ARGS}; \
     fi
 	@echo "Done."
 
@@ -122,7 +133,7 @@ ${HELM_RELEASE_TGZ}: ${BINARY_HELM} ${HELM_TARGET_DIR}/Chart.yaml ${HELM_POST_GE
 .PHONY: helm-delete-existing-tgz
 helm-delete-existing-tgz: ## Remove an existing Helm package from the target directory.
 	@echo "Delete ${HELM_RELEASE_TGZ}*"
-	@rm -f ${HELM_TARGET_DIR}/${ARTIFACT_ID}-*.tgz
+	@rm -f ${HELM_TARGET_DIR}/${COMPONENT_ARTIFACT_ID}-*.tgz
 
 ##@ K8s - Helm lint targets
 
@@ -138,9 +149,9 @@ component-generate: ${K8S_RESOURCE_COMPONENT_CR_TEMPLATE_YAML} ${COMPONENT_POST_
 ${K8S_RESOURCE_COMPONENT_CR_TEMPLATE_YAML}: ${K8S_RESOURCE_TEMP_FOLDER}
 	@echo "Generating temporary K8s component resource: ${K8S_RESOURCE_COMPONENT}"
 	@if [[ ${STAGE} == "development" ]]; then \
-		sed "s|NAMESPACE|$(HELM_ARTIFACT_NAMESPACE)|g" "${K8S_RESOURCE_COMPONENT_CR_TEMPLATE_YAML}" | sed "s|NAME|$(ARTIFACT_ID)|g"  | sed "s|VERSION|$(COMPONENT_DEV_VERSION)|g" > "${K8S_RESOURCE_COMPONENT}"; \
+		sed "s|NAMESPACE|$(HELM_ARTIFACT_NAMESPACE)|g" "${K8S_RESOURCE_COMPONENT_CR_TEMPLATE_YAML}" | sed "s|NAME|$(COMPONENT_ARTIFACT_ID)|g"  | sed "s|VERSION|$(COMPONENT_DEV_VERSION)|g" > "${K8S_RESOURCE_COMPONENT}"; \
 	else \
-		sed "s|NAMESPACE|$(HELM_ARTIFACT_NAMESPACE)|g" "${K8S_RESOURCE_COMPONENT_CR_TEMPLATE_YAML}" | sed "s|NAME|$(ARTIFACT_ID)|g"  | sed "s|VERSION|$(VERSION)|g" > "${K8S_RESOURCE_COMPONENT}"; \
+		sed "s|NAMESPACE|$(HELM_ARTIFACT_NAMESPACE)|g" "${K8S_RESOURCE_COMPONENT_CR_TEMPLATE_YAML}" | sed "s|NAME|$(COMPONENT_ARTIFACT_ID)|g"  | sed "s|VERSION|$(VERSION)|g" > "${K8S_RESOURCE_COMPONENT}"; \
 	fi
 
 .PHONY: component-apply

build/make/k8s-crd.mk

@@ -90,11 +90,11 @@ ${HELM_CRD_RELEASE_TGZ}: ${BINARY_HELM} crd-helm-generate ## Generates and packa
 .PHONY: crd-helm-chart-import
 crd-helm-chart-import: ${CHECK_VAR_TARGETS} check-k8s-artifact-id crd-helm-generate crd-helm-package ## Imports the currently available Helm CRD chart into the cluster-local registry.
 	@if [[ ${STAGE} == "development" ]]; then \
-		echo "Import ${HELM_CRD_DEV_RELEASE_TGZ} into K8s cluster ${CES_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE}..."; \
-		${BINARY_HELM} push ${HELM_CRD_DEV_RELEASE_TGZ} oci://${CES_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE} ${BINARY_HELM_ADDITIONAL_PUSH_ARGS}; \
+		echo "Import ${HELM_CRD_DEV_RELEASE_TGZ} into K8s cluster ${IMAGE_PUSH_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE}..."; \
+		${BINARY_HELM} push ${HELM_CRD_DEV_RELEASE_TGZ} oci://${IMAGE_PUSH_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE} ${BINARY_HELM_ADDITIONAL_PUSH_ARGS}; \
 	else \
-	  	echo "Import ${HELM_CRD_RELEASE_TGZ} into K8s cluster ${CES_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE}..."; \
-        ${BINARY_HELM} push ${HELM_CRD_RELEASE_TGZ} oci://${CES_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE} ${BINARY_HELM_ADDITIONAL_PUSH_ARGS}; \
+	  	echo "Import ${HELM_CRD_RELEASE_TGZ} into K8s cluster ${IMAGE_PUSH_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE}..."; \
+        ${BINARY_HELM} push ${HELM_CRD_RELEASE_TGZ} oci://${IMAGE_PUSH_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE} ${BINARY_HELM_ADDITIONAL_PUSH_ARGS}; \
     fi
 	@echo "Done."
 

build/make/k8s-dogu.mk

@@ -11,12 +11,16 @@ VERSION=$(shell $(BINARY_YQ) -oy -e ".Version" $(DOGU_JSON_FILE))
 # Image of the dogu is extracted from the dogu.json
 IMAGE=$(shell $(BINARY_YQ) -oy -e ".Image" $(DOGU_JSON_FILE)):$(VERSION)
 
-include $(BUILD_DIR)/make/k8s.mk
+PRE_BUILD_TARGETS ?=
+
+ifeq (${K8S_MK_INCLUDE_MARKER}, )
+	include ${BUILD_DIR}/make/k8s.mk
+endif
 
 ##@ K8s - EcoSystem
 
 .PHONY: build
-build: image-import install-dogu-descriptor create-dogu-resource apply-dogu-resource ## Builds a new version of the dogu and deploys it into the K8s-EcoSystem.
+build: ${PRE_BUILD_TARGETS} image-import install-dogu-descriptor create-dogu-resource apply-dogu-resource ## Builds a new version of the dogu and deploys it into the K8s-EcoSystem.
 
 ##@ K8s - Dogu - Resource
 

build/make/k8s.mk

@@ -6,56 +6,105 @@ endif
 
 ## Variables
 
+K8S_MK_INCLUDE_MARKER="k8s.mk"
+
 BINARY_YQ = $(UTILITY_BIN_PATH)/yq
 BINARY_YQ_4_VERSION?=v4.40.3
+
 BINARY_HELM = $(UTILITY_BIN_PATH)/helm
-BINARY_HELM_VERSION?=v3.13.0
+BINARY_HELM_VERSION?=v3.20.2
+BINARY_HELM_URL?=https://get.helm.sh/helm-${BINARY_HELM_VERSION}-linux-amd64.tar.gz
+BINARY_HELM_SUM?=258e830a9e613c8a7a302d6059b4bb3b9758f2f3e1bb8ea0d707ce10a9a72fea
+BINARY_HELM_ARCHIVE_PATH?=linux-amd64/helm
+BINARY_HELM_ARCHIVE_STRIP?=1
+
 CONTROLLER_GEN = $(UTILITY_BIN_PATH)/controller-gen
 CONTROLLER_GEN_VERSION?=v0.19.0
 
+BINARY_CRANE_VERSION=v0.21.4
+BINARY_CRANE=$(UTILITY_BIN_PATH)/crane
+BINARY_CRANE_URL?=https://github.com/google/go-containerregistry/releases/download/${BINARY_CRANE_VERSION}/go-containerregistry_Linux_x86_64.tar.gz
+BINARY_CRANE_SUM?=3b6032bcf412e14cf3baf964a4065f2966af906ec947ab22478df5f74705c892
+BINARY_CRANE_ARCHIVE_PATH?=crane
+BINARY_CRANE_ARCHIVE_STRIP?=0
+
 # Setting SHELL to bash allows bash commands to be executed by recipes.
 # Options are set to exit when a recipe line exits non-zero or a piped command fails.
 SHELL = /usr/bin/env bash -o pipefail
 .SHELLFLAGS = -ec
 
+ifneq (${KUBECONFIG},)
+	# Values from the repo-local .env become plain make variables first. Export KUBECONFIG so
+	# recipe shells and nested kubectl/helm calls use the same kubeconfig file as the make logic.
+	export KUBECONFIG
+endif
+
 # The productive tag of the image
 IMAGE ?=
 
 # Set production as default stage. Use "development" as stage in your .env file to generate artifacts
 # with development images pointing to CES_REGISTRY_URL_PREFIX.
 STAGE?=production
 
-# Set the "local" as runtime-environment, to push images to the container-registry of the local cluster and to apply resources to the local cluster.
-# Use "remote" as runtime-environment in your .env file to push images to the container-registry at "registry.cloudogu.com/testing" and to apply resources to the configured kubernetes-context in KUBE_CONTEXT_NAME.
+# Set "local" as runtime-environment to use the legacy in-cluster registry of the local cluster.
+# Set "k3d" as runtime-environment for local k3d development with local registry push/pull:
+# - push from host to ${K3D_PUSH_REGISTRY_HOST}${K3D_PUSH_REGISTRY_NAMESPACE}
+# - pull in-cluster via ${K3D_PULL_REGISTRY_HOST}${K3D_PULL_REGISTRY_NAMESPACE}
+# Use "remote" as runtime-environment in your .env file to push images to the container-registry at
+# "registry.cloudogu.com/testing" and to apply resources to the configured kubernetes-context in KUBE_CONTEXT_NAME.
 RUNTIME_ENV?=local
 $(info RUNTIME_ENV=$(RUNTIME_ENV))
 
 # The host and port of the local cluster
-K3S_CLUSTER_FQDN?=k3ces.local
+K3S_CLUSTER_FQDN?=k3ces.localdomain
 K3S_LOCAL_REGISTRY_PORT?=30099
-
-# The URL of the container-registry to use. Defaults to the registry of the local-cluster.
-# If RUNTIME_ENV is "remote" it is "registry.cloudogu.com/testing", if ENVIRONMENT is "ci" it is "registry.cloudogu.com/ci"
-# if run on ci (jenkins) the images must be pushed to a separate namespace in order to free space every night after the build.
+K3D_PULL_REGISTRY_HOST?=k3d-registry-proxy.localhost:5000
+K3D_PULL_REGISTRY_NAMESPACE?=/local-dev
+K3D_PUSH_REGISTRY_HOST?=localhost:5001
+K3D_PUSH_REGISTRY_NAMESPACE?=$(K3D_PULL_REGISTRY_NAMESPACE)
+
+# The URL or image-prefix host to use for development images.
+# If RUNTIME_ENV is "remote" it is "registry.cloudogu.com/testing", if ENVIRONMENT is "ci" it is "registry.cloudogu.com/ci".
+# If run on ci (jenkins) the images must be pushed to a separate namespace in order to free space every night after the build.
 CES_REGISTRY_HOST?=${K3S_CLUSTER_FQDN}:${K3S_LOCAL_REGISTRY_PORT}
 CES_REGISTRY_NAMESPACE ?=
+IMAGE_PUSH_REGISTRY_HOST ?= $(CES_REGISTRY_HOST)
+IMAGE_PUSH_REGISTRY_NAMESPACE ?= $(CES_REGISTRY_NAMESPACE)
 ifeq (${RUNTIME_ENV}, remote)
 	CES_REGISTRY_HOST=registry.cloudogu.com
 	CES_REGISTRY_NAMESPACE=/testing
+	IMAGE_PUSH_REGISTRY_HOST=$(CES_REGISTRY_HOST)
+	IMAGE_PUSH_REGISTRY_NAMESPACE=$(CES_REGISTRY_NAMESPACE)
 	ifeq ($(ENVIRONMENT), ci)
 		CES_REGISTRY_NAMESPACE=/ci
+		IMAGE_PUSH_REGISTRY_NAMESPACE=$(CES_REGISTRY_NAMESPACE)
 	endif
 endif
+ifeq (${RUNTIME_ENV}, k3d)
+	CES_REGISTRY_HOST=$(K3D_PULL_REGISTRY_HOST)
+	CES_REGISTRY_NAMESPACE=$(K3D_PULL_REGISTRY_NAMESPACE)
+	IMAGE_PUSH_REGISTRY_HOST=$(K3D_PUSH_REGISTRY_HOST)
+	IMAGE_PUSH_REGISTRY_NAMESPACE=$(K3D_PUSH_REGISTRY_NAMESPACE)
+endif
 $(info CES_REGISTRY_HOST=$(CES_REGISTRY_HOST))
 
 # The name of the kube-context to use for applying resources.
+# If KUBECONFIG is set and KUBE_CONTEXT_NAME is empty, the current context from this kubeconfig is used.
 # If KUBE_CONTEXT_NAME is empty and RUNTIME_ENV is "remote" the currently configured kube-context is used.
-# If KUBE_CONTEXT_NAME is empty and RUNTIME_ENV is not "remote" the "k3ces.local" is used as kube-context.
+# If KUBE_CONTEXT_NAME is empty and RUNTIME_ENV is "k3d" the currently configured kube-context is used.
+# Set KUBE_CONTEXT_NAME explicitly if the current kube-context does not point to the desired local k3d cluster.
+# If KUBE_CONTEXT_NAME is empty and RUNTIME_ENV is neither "remote" nor "k3d" the "k3ces.localdomain" is used as kube-context.
 ifeq (${KUBE_CONTEXT_NAME}, )
-	ifeq (${RUNTIME_ENV}, remote)
+	ifneq (${KUBECONFIG}, )
+		# Resolve the current context from the explicitly configured kubeconfig instead of the
+		# user's default ~/.kube/config. This keeps repo-local .env settings self-contained.
+		KUBE_CONTEXT_NAME = $(shell KUBECONFIG="${KUBECONFIG}" kubectl config current-context)
+	else ifeq (${RUNTIME_ENV}, remote)
+		KUBE_CONTEXT_NAME = $(shell kubectl config current-context)
+	else ifeq (${RUNTIME_ENV}, k3d)
 		KUBE_CONTEXT_NAME = $(shell kubectl config current-context)
 	else
-		KUBE_CONTEXT_NAME = k3ces.local
+		KUBE_CONTEXT_NAME = k3ces.localdomain
 	endif
 endif
 $(info KUBE_CONTEXT_NAME=$(KUBE_CONTEXT_NAME))
@@ -68,6 +117,8 @@ GIT_HASH := $(shell git rev-parse --short HEAD)
 ## Image URL to use all building/pushing image targets
 IMAGE_DEV?=$(CES_REGISTRY_HOST)$(CES_REGISTRY_NAMESPACE)/$(ARTIFACT_ID)/$(GIT_BRANCH)
 IMAGE_DEV_VERSION=$(IMAGE_DEV):$(VERSION)
+IMAGE_DEV_PUSH?=$(IMAGE_PUSH_REGISTRY_HOST)$(IMAGE_PUSH_REGISTRY_NAMESPACE)/$(ARTIFACT_ID)/$(GIT_BRANCH)
+IMAGE_DEV_PUSH_VERSION=$(IMAGE_DEV_PUSH):$(VERSION)
 
 # Variables for the temporary yaml files. These are used as template to generate a development resource containing
 # the current namespace and the dev image.
@@ -159,9 +210,17 @@ ifeq (${IMAGE_DEV},)
 endif
 
 .PHONY: image-import
-image-import: check-all-vars check-k8s-artifact-id docker-dev-tag ## Imports the currently available image into the configured ces-registry.
-	@echo "Import $(IMAGE_DEV_VERSION) into K8s cluster ${KUBE_CONTEXT_NAME}..."
-	@docker push $(IMAGE_DEV_VERSION)
+image-import: check-all-vars check-k8s-artifact-id docker-dev-tag ## Imports the currently available image into the configured runtime target.
+	@if [[ "${RUNTIME_ENV}" == "k3d" ]]; then \
+		echo "Push $(IMAGE_DEV_VERSION) for k3d registry workflow..."; \
+		echo "Push target: $(IMAGE_DEV_PUSH_VERSION)"; \
+		echo "Pull target: $(IMAGE_DEV_VERSION)"; \
+		DOCKER_BUILDKIT=1 docker tag $(IMAGE_DEV_VERSION) $(IMAGE_DEV_PUSH_VERSION); \
+		docker push $(IMAGE_DEV_PUSH_VERSION); \
+	else \
+		echo "Import $(IMAGE_DEV_VERSION) into K8s cluster ${KUBE_CONTEXT_NAME}..."; \
+		docker push $(IMAGE_DEV_VERSION); \
+	fi
 	@echo "Done."
 
 ## Functions
@@ -193,7 +252,13 @@ ${BINARY_YQ}: $(UTILITY_BIN_PATH)
 install-helm: ${BINARY_HELM}
 
 ${BINARY_HELM}: $(UTILITY_BIN_PATH)
-	$(call go-get-tool,$(BINARY_HELM),helm.sh/helm/v3/cmd/helm@${BINARY_HELM_VERSION})
+	$(call curl-get-tool-from-tar,$(BINARY_HELM),$(BINARY_HELM_URL),$(BINARY_HELM_SUM),$(BINARY_HELM_ARCHIVE_PATH),$(BINARY_HELM_ARCHIVE_STRIP))
+
+.PHONY: install-crane ## Installs crane.
+install-crane: ${BINARY_CRANE}
+
+${BINARY_CRANE}: $(UTILITY_BIN_PATH)
+	$(call curl-get-tool-from-tar,$(BINARY_CRANE),$(BINARY_CRANE_URL),$(BINARY_CRANE_SUM),$(BINARY_CRANE_ARCHIVE_PATH),$(BINARY_CRANE_ARCHIVE_STRIP))
 
 .PHONY: controller-gen
 controller-gen: ${CONTROLLER_GEN} ## Download controller-gen locally if necessary.
@@ -216,5 +281,3 @@ isProduction:
 	else \
 		echo "Command executed in development stage. Continuing."; \
 	fi
-
-