# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: Namespace
metadata:
  name: kf
  labels:
    app.kubernetes.io/name: kf
    app.kubernetes.io/version: v2.0.0

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kf-admin
aggregationRule:
  clusterRoleSelectors:
    - matchLabels:
        kf.dev/controller: "true"
rules: [] # Rules are automatically filled in by the controller manager.
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kf-core
  labels:
    kf.dev/controller: "true"
rules:
  - apiGroups: [""]
    resources: ["pods", "namespaces", "secrets", "configmaps", "endpoints", "services", "events", "serviceaccounts"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: [""]
    resources: ["endpoints/restricted"] # Permission for RestrictedEndpointsAdmission
    verbs: ["create"]
  - apiGroups: ["apps"]
    resources: ["deployments", "deployments/finalizers"] # finalizers are needed for the owner reference of the webhook
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: ["autoscaling"]
    resources: ["horizontalpodautoscalers"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: ["kf.dev", "spaces.kf.dev"]
    resources: ["*", "*/status", "*/finalizers"]
    verbs: ["get", "list", "create", "update", "delete", "deletecollection", "patch", "watch"]
  - apiGroups: ["tekton.dev"]
    resources: ["taskruns", "clustertasks", "tasks"]
    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["networking.istio.io"]
    resources: ["virtualservices"]
    verbs: ["get", "list", "create", "update", "delete", "deletecollection", "patch", "watch"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["networkpolicies"]
    verbs: ["get", "list", "create", "update", "delete", "deletecollection", "patch", "watch"]
  - apiGroups: ["batch"]
    resources: ["cronjobs", "jobs"]
    verbs: ["get", "list", "create", "update", "delete", "deletecollection", "patch", "watch"]
  - apiGroups: ["anthos.gke.io"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: controller
  namespace: kf
  labels:
    serving.knative.dev/release: devel

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kf-controller-admin
subjects:
  - kind: ServiceAccount
    name: controller
    namespace: kf
roleRef:
  kind: ClusterRole
  name: kf-admin
  apiGroup: rbac.authorization.k8s.io

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the License);
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an AS IS BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: external-gateway
  namespace: kf
spec:
  selector:
    # Attach to the istio-ingress service in the gke-system namespace.
    istio: ingressgateway
  servers:
    - hosts:
        - '*'
      port:
        name: http
        number: 80
        protocol: HTTP

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the License);
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an AS IS BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: internal-gateway
  namespace: kf
spec:
  selector:
    # Attach to the cluster-local-gateway service in the gke-system namespace.
    istio: cluster-local-gateway
  servers:
    - hosts:
        - '*'
      port:
        name: http
        number: 80
        protocol: HTTP

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the License);
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an AS IS BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: apps.kf.dev
spec:
  group: kf.dev
  version: v1alpha1
  names:
    kind: App
    plural: apps
    singular: app
    categories:
      - all
      - kf
  scope: Namespaced
  subresources:
    scale:
      specReplicasPath: .spec.instances.replicas
      statusReplicasPath: .status.instances.replicas
      labelSelectorPath: .status.instances.labelSelector
    status: {}
  additionalPrinterColumns:
    - name: Instances
      type: string
      JSONPath: .status.instances.representation
    - name: Memory
      type: string
      JSONPath: .spec.template.spec.containers[?(@.name=="user-container")].resources.requests.memory
    - name: Disk
      type: string
      JSONPath: .spec.template.spec.containers[?(@.name=="user-container")].resources.requests.ephemeral-storage
    - name: CPU
      type: string
      JSONPath: .spec.template.spec.containers[?(@.name=="user-container")].resources.requests.cpu
    - name: URLs
      type: string
      JSONPath: ".status.urls"
    - name: Cluster URL
      type: string
      JSONPath: .status.address.url
    - name: Ready
      type: string
      JSONPath: ".status.conditions[?(@.type=='Ready')].status"
    - name: Reason
      type: string
      JSONPath: ".status.conditions[?(@.type=='Ready')].reason"

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the License);
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an AS IS BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: builds.kf.dev
spec:
  group: kf.dev
  version: v1alpha1
  names:
    kind: Build
    plural: builds
    singular: build
    categories:
      - all
      - kf
  scope: Namespaced
  subresources:
    status: {}
  additionalPrinterColumns:
    - name: Age
      type: date
      JSONPath: .metadata.creationTimestamp
    - name: Task
      type: string
      JSONPath: .spec.name
    - name: Duration
      type: string
      JSONPath: .status.duration
    - name: Succeeded
      type: string
      JSONPath: .status.conditions[?(@.type=="Succeeded")].status
    - name: Reason
      type: string
      JSONPath: ".status.conditions[?(@.type=='Succeeded')].reason"
    - name: Image
      type: string
      JSONPath: .status.image

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: clusterservicebrokers.kf.dev
spec:
  group: kf.dev
  version: v1alpha1
  names:
    kind: ClusterServiceBroker
    plural: clusterservicebrokers
    singular: clusterservicebroker
    categories:
      - all
      - kf
  scope: Cluster
  subresources:
    status: {}
  additionalPrinterColumns:
    - name: Age
      type: date
      JSONPath: .metadata.creationTimestamp
    - name: Ready
      type: string
      JSONPath: ".status.conditions[?(@.type=='Ready')].status"
    - name: Reason
      type: string
      JSONPath: ".status.conditions[?(@.type=='Ready')].reason"

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: routes.kf.dev
spec:
  group: kf.dev
  version: v1alpha1
  names:
    kind: Route
    plural: routes
    singular: route
    categories:
      - all
      - kf
  scope: Namespaced
  subresources:
    status: {}
  additionalPrinterColumns:
    - name: Host
      type: string
      JSONPath: .spec.hostname
    - name: Domain
      type: string
      JSONPath: .spec.domain
    - name: Path
      type: string
      JSONPath: .spec.path
    - name: Apps
      type: string
      JSONPath: .status.appBindingDisplayNames
    - name: RouteService
      type: string
      JSONPath: .status.routeService.name
    - name: Age
      type: date
      JSONPath: .metadata.creationTimestamp
    - name: Ready
      type: string
      JSONPath: ".status.conditions[?(@.type=='Ready')].status"
    - name: Reason
      type: string
      JSONPath: ".status.conditions[?(@.type=='Ready')].reason"

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: servicebrokers.kf.dev
spec:
  group: kf.dev
  version: v1alpha1
  names:
    kind: ServiceBroker
    plural: servicebrokers
    singular: servicebroker
    categories:
      - all
      - kf
  scope: Namespaced
  subresources:
    status: {}
  additionalPrinterColumns:
    - name: Age
      type: date
      JSONPath: .metadata.creationTimestamp
    - name: Ready
      type: string
      JSONPath: ".status.conditions[?(@.type=='Ready')].status"
    - name: Reason
      type: string
      JSONPath: ".status.conditions[?(@.type=='Ready')].reason"

---
# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the License);
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an AS IS BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: serviceinstances.kf.dev
spec:
  group: kf.dev
  version: v1alpha1
  names:
    kind: ServiceInstance
    plural: serviceinstances
    singular: serviceinstance
    categories:
      - all
      - kf
  scope: Namespaced
  subresources:
    status: {}
  additionalPrinterColumns:
    - name: Type
      type: string
      JSONPath: .status.serviceTypeDescription
    - name: ClassName
      type: string
      JSONPath: .status.className
    - name: PlanName
      type: string
      JSONPath: .status.planName
    - name: Age
      type: date
      JSONPath: .metadata.creationTimestamp
    - name: Ready
      type: string
      JSONPath: ".status.conditions[?(@.type=='Ready')].status"
    - name: Reason
      type: string
      JSONPath: ".status.conditions[?(@.type=='Ready')].reason"

---
# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the License);
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an AS IS BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: serviceinstancebindings.kf.dev
spec:
  group: kf.dev
  version: v1alpha1
  names:
    kind: ServiceInstanceBinding
    plural: serviceinstancebindings
    singular: serviceinstancebinding
    categories:
      - all
      - kf
  scope: Namespaced
  subresources:
    status: {}
  additionalPrinterColumns:
    - name: App
      type: string
      JSONPath: .spec.app.name
    - name: Service
      type: string
      JSONPath: .spec.instanceRef.name
    - name: Age
      type: date
      JSONPath: .metadata.creationTimestamp
    - name: Ready
      type: string
      JSONPath: .status.conditions[?(@.type=="Ready")].status

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: spaces.kf.dev
spec:
  group: kf.dev
  version: v1alpha1
  names:
    kind: Space
    plural: spaces
    singular: space
    categories:
      - all
      - kf
  scope: Cluster
  subresources:
    status: {}
  additionalPrinterColumns:
    - name: Age
      type: date
      JSONPath: .metadata.creationTimestamp
    - name: Ready
      type: string
      JSONPath: ".status.conditions[?(@.type=='Ready')].status"
    - name: Reason
      type: string
      JSONPath: ".status.conditions[?(@.type=='Ready')].reason"

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: Service
metadata:
  labels:
    app: controller
  name: controller
  namespace: kf
spec:
  ports:
    # Open a port for any metrics generated by the reconciliation controllers,
    # this is a feature of Knative's core controllers and kf can report on a
    # variety of things.
    - name: metrics
      port: 9090
      protocol: TCP
      targetPort: 9090
  selector:
    app: controller

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: Service
metadata:
  labels:
    role: webhook
  name: webhook
  namespace: kf
spec:
  ports:
    - port: 443
      targetPort: 8443
  selector:
    role: webhook

---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: webhook.kf.dev
  labels:
    kf.dev/release: devel
webhooks:
  - admissionReviewVersions:
      - v1beta1
    clientConfig:
      service:
        name: webhook
        namespace: kf
    failurePolicy: Fail
    name: webhook.kf.dev
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: validation.webhook.kf.dev
  labels:
    kf.dev/release: devel
webhooks:
  - admissionReviewVersions:
      - v1beta1
    clientConfig:
      service:
        name: webhook
        namespace: kf
    failurePolicy: Fail
    name: validation.webhook.kf.dev
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: config.webhook.kf.dev
  labels:
    kf.dev/release: devel
webhooks:
  - admissionReviewVersions:
      - v1beta1
    clientConfig:
      service:
        name: webhook
        namespace: kf
    failurePolicy: Fail
    name: config.webhook.kf.dev
    namespaceSelector:
      matchExpressions:
        - key: kf.dev/release
          operator: Exists
---
apiVersion: v1
kind: Secret
metadata:
  name: webhook-certs
  namespace: kf
  labels:
    kf.dev/release: devel
# The data is populated at install time.

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: ConfigMap
metadata:
  name: config-defaults
  namespace: kf
data:
  _example: |
    ################################
    #                              #
    #    EXAMPLE CONFIGURATION     #
    #                              #
    ################################

    # This block is not actually functional configuration,
    # but serves to illustrate the available configuration
    # options and document them in a way that is accessible
    # to users that `kubectl edit` this config map.
    #
    # These sample configuration options may be copied out of
    # this example block and unindented to be in the data block
    # to actually change the configuration.

    # spaceContainerRegistry is the default container registry to assign to
    # spaces.
    spaceContainerRegistry: gcr.io/my-project

    # spaceClusterDomains contains an ordered list of default domains to be
    # injected into spaces. The value must be a valid JSON or YAML array.
    #
    # Each entry in the list must be an object with a `domain` property.
    # This property contains a string representation of the domain.
    #
    # It MAY contain the following two varaible substitutions:
    # - $(SPACE_NAME) - The name of the space
    # - $(CLUSTER_INGRESS_IP) - The ingress IP of the cluster
    #
    # It's recommended (but not required) that all domains contain the $(SPACE_NAME)
    # substitution to prevent apps in different spaces from conflicting.
    #
    # An optional second property 'gatewayName' can set which Istio Gateway
    # corresponding routes will assign to themselves. The 'gatewayName' field
    # is a string of the form 'kf/some-gateway', where `some-gateway' is a
    # Gateway resource in the 'kf' Namespace.
    #
    # If 'gatewayName' is not set, the default 'kf/external-gateway' is used.
    spaceClusterDomains: |
      - domain: $(SPACE_NAME).prod.example.com
      - domain: $(SPACE_NAME).kf.us-east1.prod.example.com
      - domain: $(SPACE_NAME).$(CLUSTER_INGRESS_IP).nip.io

    # buildpacksV2LifecycleBuilder is the path that will be used in the V2
    # builds. To use a specific version, do use the following syntax:
    # code.cloudfoundry.org/buildpackapplifecycle/builder@12345.
    buildpacksV2LifecycleBuilder: "code.cloudfoundry.org/buildpackapplifecycle/builder"

    # buildpacksV2LifecycleLauncher is the path that will be used in the V2
    # builds. To use a specific version, do use the following syntax:
    # code.cloudfoundry.org/buildpackapplifecycle/launcher@12345.
    buildpacksV2LifecycleLauncher: "code.cloudfoundry.org/buildpackapplifecycle/launcher"

    # spaceBuildpacksV2 contains an ordered list of default buildpacks to be
    # used for CF compatible builds. The value must be a valid JSON or YAML
    # string.
    #
    # Each entry in the list must be an object with `name` and `url` propreties
    # indicating the human readable name of the buildpack and the URL to
    # fetch it from at runtime. An additional `disabled` property can be used
    # to disable a single buildpack.
    spaceBuildpacksV2: |
      - name: name-of-buildpack
        url:  https://github.com/cloudfoundry/name-of-buildpack
        disabled: false

    # spaceStacksV2 contains list of default stacks to be used for CF compatible
    # builds. The value must be a valid JSON or YAML string.
    #
    # Each entry in the list must be an object with `name` and `image`
    # propreties indicating the human readable name of the stack and the docker
    # image that will be used by the apps/buildpacks that run on it.
    #
    # Use images tagged with SHAs to improve build caching.
    spaceStacksV2: |
      - name:  cflinuxfs3
        image: cloudfoundry/cflinuxfs3

    # spaceStacksV3 contains list of default stacks to be used for cloud native
    # buildpack builds. The value must be a valid JSON or YAML string.
    #
    # Additional stacks can be discovered using `pack suggest-stacks`
    #
    # Each entry in the list must be an object with the following properties:
    # - `name` - the name of the stack to be specified in the app manifest
    # - `description` - a description of the stack
    # - `buildImage` - the buildpack builder image
    # - `runImage` - the base image of the produced application
    spaceStacksV3: |
      - name: heroku-18
        description: The official Heroku stack based on Ubuntu 18.04
        buildImage: heroku/pack:18-build
        runImage: heroku/pack:18

    # spaceDefaultToV3Stack will make spaces use v3 stacks by default if set to
    # true. This will only affect apps without a stack specified in the manifest.
    spaceDefaultToV3Stack: "true"

    # routeServiceProxyImage is the container image used in the PodSpec of the K8s Deployment
    # created by Kf for every Route Service instance. This deployment acts as a proxy for the route
    # service. It adds the `X-Cf-Forwarded-URL` header to each request before forwarding to the route service.
    routeServiceProxyImage: "ko://github.com/google/kf/route-service-proxy-src"

    # featureFlags allow certain features to be toggled on or off.
    # Feature flag names that are not supported by Kf will be ignored.
    # disable_custom_builds - Prevents builds with a kind other than "built-in" from being submitted.
    featureFlags: |
      disable_custom_builds: false
      enable_some_feature: true

    # The following images are used to execute builds. They SHOULD NOT be
    # modified except in rare circumstances.
    buildHelpersImage: "ko://github.com/google/kf/cmd/build-helpers"
    buildKanikoExecutorImage: "gcr.io/kaniko-project/executor:latest"
    buildGolangImage: "golang:latest"
    buildInfoImage: "kf-release-repository/build-info:kf-version"
    buildTokenDownloadImage: "google/cloud-sdk:slim"
  spaceClusterDomains: |
    - domain: $(SPACE_NAME).$(CLUSTER_INGRESS_IP).nip.io
  buildpacksV2LifecycleBuilder: "code.cloudfoundry.org/buildpackapplifecycle/builder"
  buildpacksV2LifecycleLauncher: "code.cloudfoundry.org/buildpackapplifecycle/launcher"
  spaceBuildpacksV2: |
    - name: staticfile_buildpack
      url: https://github.com/cloudfoundry/staticfile-buildpack
    - name: java_buildpack
      url: https://github.com/cloudfoundry/java-buildpack
    - name: ruby_buildpack
      url: https://github.com/cloudfoundry/ruby-buildpack
    - name: dotnet_core_buildpack
      url: https://github.com/cloudfoundry/dotnet-core-buildpack
    - name: nodejs_buildpack
      url: https://github.com/cloudfoundry/nodejs-buildpack
    - name: go_buildpack
      url: https://github.com/cloudfoundry/go-buildpack
    - name: python_buildpack
      url: https://github.com/cloudfoundry/python-buildpack
    - name: php_buildpack
      url: https://github.com/cloudfoundry/php-buildpack
    - name: binary_buildpack
      url: https://github.com/cloudfoundry/binary-buildpack
    - name: nginx_buildpack
      url: https://github.com/cloudfoundry/nginx-buildpack
  spaceStacksV2: |
    - name: cflinuxfs3
      image: cloudfoundry/cflinuxfs3@sha256:d148a5580340c7adfff28c5c2319c2e166f76eab0a2ad9c015a76c1dcc400c58
  spaceStacksV3: |
    - name: org.cloudfoundry.stacks.cflinuxfs3
      description: A large Cloud Foundry stack based on Ubuntu 18.04
      buildImage: cloudfoundry/cnb:cflinuxfs3@sha256:524783dddb5f8a3ea2b307a961a0c315ddb1d5db7d0754ad43139bf22ebee9be
      runImage: cloudfoundry/run:full-cnb@sha256:47221e89efd97eb4984b81aff19827ea0af92546c426e5052d716786a136662e
  spaceDefaultToV3Stack: "false"
  routeServiceProxyImage: "gcr.io/kf-releases/route-service-proxy-d260bd09321e365a358fc747f4607316@sha256:58b90ee42f0cda8f47c1dba1f8861b9185e402e79c32a9332492b1b197f5a119"
  buildKanikoExecutorImage: "gcr.io/kaniko-project/executor:v1.0.0"
  buildGolangImage: "golang:1.12@sha256:d0e79a9c39cdb3d71cc45fec929d1308d50420b79201467ec602b1b80cc314a8"
  buildInfoImage: "gcr.io/kf-releases/setup-buildpack-build-0d969b3bd84e6d8c79f8f2c5d016cd8b@sha256:db81e286b245b37a594f9a27e979772b7e488488becdf95134f98e47da31fb1f"
  buildTokenDownloadImage: google/cloud-sdk:slim
  buildHelpersImage: "gcr.io/kf-releases/build-helpers-58e723758a11c5e698f0be6f53cdecbc@sha256:f5aadb905e0bd2e9934aedb1bfe425b99adafbc63f5d188a164962ac9eef299c"
  featureFlags: |
    disable_custom_builds: false
    enable_route_services: false

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: ConfigMap
metadata:
  name: config-logging
  namespace: kf
data:
  _example: |
    ################################
    #                              #
    #    EXAMPLE CONFIGURATION     #
    #                              #
    ################################

    # This block is not actually functional configuration,
    # but serves to illustrate the available configuration
    # options and document them in a way that is accessible
    # to users that `kubectl edit` this config map.
    #
    # These sample configuration options may be copied out of
    # this example block and unindented to be in the data block
    # to actually change the configuration.

    # Common configuration for all Knative codebase
    zap-logger-config: |
      {
        "level": "info",
        "development": false,
        "outputPaths": ["stdout"],
        "errorOutputPaths": ["stderr"],
        "encoding": "json",
        "encoderConfig": {
          "timeKey": "ts",
          "levelKey": "level",
          "nameKey": "logger",
          "callerKey": "caller",
          "messageKey": "msg",
          "stacktraceKey": "stacktrace",
          "lineEnding": "",
          "levelEncoder": "",
          "timeEncoder": "iso8601",
          "durationEncoder": "",
          "callerEncoder": ""
        }
      }

    # Log level overrides
    # For all components except the autoscaler and queue proxy,
    # changes are be picked up immediately.
    # For autoscaler and queue proxy, changes require recreation of the pods.
    loglevel.controller: "info"
    loglevel.autoscaler: "info"
    loglevel.queueproxy: "info"
    loglevel.webhook: "info"
    loglevel.activator: "info"

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: ConfigMap
metadata:
  name: config-observability
  namespace: kf
data:
  # Send metrics for Kf controller operations.
  metrics.backend-destination: stackdriver
  metrics.request-metrics-backend-destination: stackdriver
  metrics.allow-stackdriver-custom-metrics: "true"
  _example: |
    ################################
    #                              #
    #    EXAMPLE CONFIGURATION     #
    #                              #
    ################################

    # This block is not actually functional configuration,
    # but serves to illustrate the available configuration
    # options and document them in a way that is accessible
    # to users that `kubectl edit` this config map.
    #
    # These sample configuration options may be copied out of
    # this example block and unindented to be in the data block
    # to actually change the configuration.

    # logging.enable-var-log-collection defaults to false.
    # The fluentd daemon set will be set up to collect /var/log if
    # this flag is true.
    logging.enable-var-log-collection: false

    # logging.revision-url-template provides a template to use for producing the
    # logging URL that is injected into the status of each Revision.
    # This value is what you might use the the Knative monitoring bundle, and provides
    # access to Kibana after setting up kubectl proxy.
    logging.revision-url-template: |
      http://localhost:8001/api/v1/namespaces/knative-monitoring/services/kibana-logging/proxy/app/kibana#/discover?_a=(query:(match:(kubernetes.labels.knative-dev%2FrevisionUID:(query:'${REVISION_UID}',type:phrase))))

    # If non-empty, this enables queue proxy writing request logs to stdout.
    # The value determines the shape of the request logs and it must be a valid go text/template.
    # It is important to keep this as a single line. Multiple lines are parsed as separate entities
    # by most collection agents and will split the request logs into multiple records.
    #
    # The following fields and functions are available to the template:
    #
    # Request: An http.Request (see https://golang.org/pkg/net/http/#Request)
    # representing an HTTP request received by the server.
    #
    # Response:
    # struct {
    #   Code    int       // HTTP status code (see https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml)
    #   Size    int       // An int representing the size of the response.
    #   Latency float64   // A float64 representing the latency of the response in seconds.
    # }
    #
    # Revision:
    # struct {
    #   Name          string  // Knative revision name
    #   Namespace     string  // Knative revision namespace
    #   Service       string  // Knative service name
    #   Configuration string  // Knative configuration name
    #   PodName       string  // Name of the pod hosting the revision
    #   PodIP         string  // IP of the pod hosting the revision
    # }
    #
    logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{index .Request.Header "X-B3-Traceid"}}"}'

    # metrics.backend-destination field specifies the system metrics destination.
    # It supports either prometheus (the default) or stackdriver.
    # Note: Using stackdriver will incur additional charges
    metrics.backend-destination: prometheus

    # metrics.request-metrics-backend-destination specifies the request metrics
    # destination. If non-empty, it enables queue proxy to send request metrics.
    # Currently supported values: prometheus, stackdriver.
    metrics.request-metrics-backend-destination: prometheus

    # metrics.stackdriver-project-id field specifies the stackdriver project ID. This
    # field is optional. When running on GCE, application default credentials will be
    # used if this field is not provided.
    metrics.stackdriver-project-id: "<your stackdriver project id>"

    # metrics.allow-stackdriver-custom-metrics indicates whether it is allowed to send metrics to
    # Stackdriver using "global" resource type and custom metric type if the
    # metrics are not supported by "knative_revision" resource type. Setting this
    # flag to "true" could cause extra Stackdriver charge.
    # If metrics.backend-destination is not Stackdriver, this is ignored.
    metrics.allow-stackdriver-custom-metrics: "false"

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: ConfigMap
metadata:
  ##########################
  #                        #
  #   EXAMPLE CONFIG MAP   #
  #                        #
  ##########################
  # This ConfigMap serves only as an example. It is named with the "-example"
  # suffix so that we don't accidently stomp on ourselves with something like
  # `ko apply`.
  #
  # Enable Workload Identity (WI) by setting googleServiceAccount to a Google
  # Service Account. If left empty, then WI is disabled and a
  # 'build.imagePushSecrets' is required. More information about WI can be
  # found here:
  # https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
  #
  # If you are using GKE and want to manually setup a secret do the following:
  # kubectl -nkf create secret docker-registry knative-build-key \
  #   --docker-username=_json_key \
  #   --docker-server https://gcr.io \
  #   --docker-password="$(cat /path/to/key.json)"
  name: config-secrets-example
  namespace: kf
data:
  wi.googleServiceAccount: "some-gsa"
  wi.googleProjectID: "" # Empty implies that the metadata server should be used
  build.imagePushSecrets: "knative-build-key"

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: controller
  namespace: kf
spec:
  replicas: 1
  selector:
    matchLabels:
      app: controller
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
      labels:
        app: controller
    spec:
      serviceAccountName: controller
      containers:
        - name: controller
          # This is the Go import path for the binary that is containerized
          # and substituted here.
          image: gcr.io/kf-releases/controller-06158aaecf078112dcc4c4a0f4786e1e@sha256:0bc781cd194e4c6f0beff445063d8ab0e924d6a82c8b6cbea2f9b6546905dc69
          resources:
            requests:
              cpu: 256m
              memory: 256Mi
            limits:
              cpu: 1000m
              memory: 1000Mi
          # We use a livenessProbe instead of a readinessProbe because if the
          # health check fails, then it will restart the pod (instead of not
          # signaling it at all). This is necessary for Workload Identity.
          # Without the pod restarting, if WI wasn't working at the beginning of
          # the pod starting, it would never work.
          livenessProbe:
            httpGet:
              path: /
              port: 10000
            initialDelaySeconds: 3
            periodSeconds: 3
          ports:
            - name: metrics
              containerPort: 9090
          volumeMounts:
            - name: config-logging
              mountPath: /etc/config-logging
          env:
            - name: SYSTEM_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: CONFIG_LOGGING_NAME
              value: config-logging
            - name: CONFIG_OBSERVABILITY_NAME
              value: config-observability
            - name: METRICS_DOMAIN
              value: kf.dev
      volumes:
        - name: config-logging
          configMap:
            name: config-logging

---
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: webhook
  namespace: kf
spec:
  replicas: 1
  selector:
    matchLabels:
      app: webhook
      role: webhook
  template:
    metadata:
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
        sidecar.istio.io/inject: "false"
      labels:
        app: webhook
        role: webhook
        kf.dev/release: devel
    spec:
      serviceAccountName: controller
      containers:
        - name: webhook
          # This is the Go import path for the binary that is containerized
          # and substituted here.
          image: gcr.io/kf-releases/webhook-9b77a2b66016ff88e056d2fed2f5582e@sha256:c603e8f874bb4db962819d816b751fe563131c26274b8cc3ee87b86d43d385eb
          resources:
            # Request 2x what we saw running e2e
            requests:
              cpu: 20m
              memory: 20Mi
            # Limit to 10x the request (20x the observed peak during e2e)
            limits:
              cpu: 200m
              memory: 256Mi
          volumeMounts:
            - name: config-logging
              mountPath: /etc/config-logging
          env:
            - name: SYSTEM_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: CONFIG_LOGGING_NAME
              value: config-logging
            - name: METRICS_DOMAIN
              value: kf.dev
          securityContext:
            allowPrivilegeEscalation: false
      volumes:
        - name: config-logging
          configMap:
            name: config-logging

---
