apiVersion: v1
kind: Namespace
metadata:
  labels:
    operator.knative.dev/release: devel
    k8s-app: appdevexperience-operator
  name: appdevexperience

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  labels:
    operator.knative.dev/release: devel
    appdevexperience.operator.run.cloud.google.com/release: devel
    knative.dev/crd-install: "true"
  name: cloudruns.operator.run.cloud.google.com
spec:
  group: operator.run.cloud.google.com
  versions:
    - name: v1alpha1
      served: true
      storage: true
      subresources:
        status: {}
      schema:
        openAPIV3Schema:
          type: object
          # this is a work around so we don't need to flush out the
          # schema for each version at this time
          #
          # see issue: https://github.com/knative/serving/issues/912
          x-kubernetes-preserve-unknown-fields: true
      additionalPrinterColumns:
        - name: Ready
          type: string
          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
        - name: Reason
          type: string
          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
  names:
    kind: CloudRun
    plural: cloudruns
    singular: cloudrun
    categories:
      - all
      - knative
    shortNames:
      - run
      - runs
  scope: Cluster

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  labels:
    operator.knative.dev/release: devel
    appdevexperience.operator.run.cloud.google.com/release: devel
    knative.dev/crd-install: "true"
  name: kfsystems.kf.dev
spec:
  group: kf.dev
  versions:
    - name: v1alpha1
      served: true
      storage: true
      subresources:
        status: {}
      schema:
        openAPIV3Schema:
          type: object
          # this is a work around so we don't need to flush out the
          # schema for each version at this time
          #
          # see issue: https://github.com/knative/serving/issues/912
          x-kubernetes-preserve-unknown-fields: true
      additionalPrinterColumns:
        - name: Ready
          type: string
          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
        - name: Reason
          type: string
          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
  names:
    kind: KfSystem
    plural: kfsystems
    singular: kfsystem
    categories:
      - all
      - kf
  scope: Cluster

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  labels:
    operand.knative.dev/release: devel
    appdevexperience.operand.run.cloud.google.com/release: devel
    knative.dev/crd-install: "true"
  name: activeoperands.operand.run.cloud.google.com
spec:
  group: operand.run.cloud.google.com
  versions:
    - name: v1alpha1
      served: true
      storage: true
      subresources:
        status: {}
      schema:
        openAPIV3Schema:
          type: object
          # this is a work around so we don't need to flush out the
          # schema for each version at this time
          #
          # see issue: https://github.com/knative/serving/issues/912
          x-kubernetes-preserve-unknown-fields: true
      additionalPrinterColumns:
        - name: Ready
          type: string
          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
        - name: Reason
          type: string
          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
  names:
    kind: ActiveOperand
    plural: activeoperands
    singular: activeoperand
    categories:
      - all
      - knative
    shortNames:
      - ao
      - aos
  scope: Namespaced
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  labels:
    operand.knative.dev/release: devel
    appdevexperience.operand.run.cloud.google.com/release: devel
    knative.dev/crd-install: "true"
  name: clusteractiveoperands.operand.run.cloud.google.com
spec:
  group: operand.run.cloud.google.com
  versions:
    - name: v1alpha1
      served: true
      storage: true
      subresources:
        status: {}
      schema:
        openAPIV3Schema:
          type: object
          # this is a work around so we don't need to flush out the
          # schema for each version at this time
          #
          # see issue: https://github.com/knative/serving/issues/912
          x-kubernetes-preserve-unknown-fields: true
      additionalPrinterColumns:
        - name: Ready
          type: string
          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
        - name: Reason
          type: string
          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
  names:
    kind: ClusterActiveOperand
    plural: clusteractiveoperands
    singular: clusteractiveoperand
    categories:
      - all
      - knative
    shortNames:
      - cao
      - caos
  scope: Cluster
---


---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  labels:
    operator.knative.dev/release: devel
    appdevexperience.operator.run.cloud.google.com/release: devel
    knative.dev/crd-install: "true"
  name: operands.operand.run.cloud.google.com
spec:
  group: operand.run.cloud.google.com
  versions:
    - name: v1alpha1
      served: true
      storage: true
      subresources:
        status: {}
      schema:
        openAPIV3Schema:
          type: object
          # this is a work around so we don't need to flush out the
          # schema for each version at this time
          #
          # see issue: https://github.com/knative/serving/issues/912
          x-kubernetes-preserve-unknown-fields: true
      additionalPrinterColumns:
        - name: Ready
          type: string
          jsonPath: ".status.conditions[?(@.type=='Ready')].status"
        - name: Reason
          type: string
          jsonPath: ".status.conditions[?(@.type=='Ready')].reason"
  names:
    kind: Operand
    plural: operands
    singular: operand
    categories:
      - all
      - knative
    shortNames:
      - op
      - ops
  scope: Cluster

---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    operator.knative.dev/release: devel
    k8s-app: appdevexperience-operator
  name: appdevexperience-operator
  namespace: appdevexperience

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    operator.knative.dev/release: devel
    k8s-app: appdevexperience-operator
  name: appdevexperience-operator
  namespace: appdevexperience
rules:
  - apiGroups:
      - ""
    resources:
      - pods
      - services
      - endpoints
      - persistentvolumeclaims
      - persistentvolumes
      - events
      - configmaps
      - secrets
    verbs:
      - '*'
  - apiGroups:
      - ""
    resources:
      - namespaces
    verbs:
      - get
  - apiGroups:
      - apps
    resources:
      - deployments
      - daemonsets
      - replicasets
      - statefulsets
    verbs:
      - '*'
  - apiGroups:
      - monitoring.coreos.com
    resources:
      - servicemonitors
    verbs:
      - get
      - create
  - apiGroups:
      - apps
    resourceNames:
      - appdevexperience-operator
    resources:
      - deployments/finalizers
    verbs:
      - update
      - patch
  - apiGroups:
      - operator.knative.dev
      - operand.run.cloud.google.com
      - operator.run.cloud.google.com
    resources:
      - '*'
    verbs:
      - '*'
---
# TODO: Investigate if the above aggregated role is a superset of this.
# See https://github.com/knative-sandbox/operator/pull/21 for more info.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    operator.knative.dev/release: devel
  name: appdevexperience-operator
rules:
  - apiGroups:
      - operator.knative.dev
      - kf.dev
      - operand.run.cloud.google.com
      - operator.run.cloud.google.com
    resources:
      - '*'
    verbs:
      - '*'
  # Bootstrapping permissions.
  # # Roles that are explicitly bound buch which are specified by this Operator
  - apiGroups:
      - rbac.authorization.k8s.io
    resources:
      - clusterroles
      - roles
    verbs:
      - create
      - delete
      - update
      - patch
      # Escalate is necessary in order to create a role using cluster role aggregation,
      # and to allow the Operator to bootstrap itself into the necessary set of
      # permissions, even as those continue to evolve upstream.
      - escalate
      - get
      - list
      - update
      - patch
      - bind
  - apiGroups:
      - rbac.authorization.k8s.io
    resources:
      - clusterrolebindings
      - rolebindings
    verbs:
      - create
      - delete
      - escalate
      - list
      - get
      - update
      - patch
  # Permissions required for Knative controller
  # infra.
  - apiGroups:
      - apiregistration.k8s.io
    resources:
      - apiservices
    verbs:
      - update
      - patch
  - apiGroups:
      - ""
    resources:
      - services
      - services/status
    verbs:
      - create
      - delete
      - get
      - list
      - watch
  - apiGroups:
      - pubsub.cloud.google.com
    resources:
      - topics
      - topics/status
    verbs:
      - '*'
  - apiGroups:
      - caching.internal.knative.dev
    resources:
      - images
    verbs:
      - '*'
  - apiGroups:
      - ""
    resources:
      - namespaces
      - namespaces/finalizers
    verbs:
      - get
      - list
      - create
      - update
      - watch
      - delete
      - patch
      - watch
  - apiGroups:
      - ''
    resources:
      - events
    verbs:
      - create
      - update
      - patch
  - apiGroups:
      - ''
    resources:
      - configmaps
    verbs:
      - create
      - delete
      - get
      - list
      - watch
  - apiGroups:
      - apps
    resources:
      - deployments
      - daemonsets
      - replicasets
      - statefulsets
    verbs:
      - create
      - delete
      - get
      - list
      - watch
  - apiGroups:
      - apiregistration.k8s.io
    resources:
      - apiservices
    verbs:
      - create
      - delete
      - get
      - list
  - apiGroups:
      - autoscaling
    resources:
      - horizontalpodautoscalers
    verbs:
      - create
      - delete
      - get
      - list
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs:
      - '*'
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
      - customresourcedefinitions/status
    verbs:
      - '*'
  - apiGroups:
      - "operator.run.cloud.google.com"
    resources:
      - cloudruns
    verbs:
      - '*'
  - apiGroups:
      - "operator.run.cloud.google.com"
    resources:
      - cloudruns/status
    verbs:
      - update
      - patch
  - apiGroups:
      - ""
    resources:
      - pods
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "batch"
    resources:
      - jobs
    verbs:
      - get
      - create
      - update
      - patch
      - delete
  - apiGroups:
      - "messaging.cloud.google.com"
    resources:
      - channels
    verbs:
      - delete
  - apiGroups:
      - "pubsub.cloud.google.com"
    resources:
      - pullsubscriptions
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - patch
      - delete
  - apiGroups:
      - "pubsub.cloud.google.com"
    resources:
      - pullsubscriptions/status
    verbs:
      - get
      - update
      - patch
      - patch
  - apiGroups:
      - "events.cloud.google.com"
    resources:
      - "*"
    verbs:
      - "*"
  - apiGroups:
      - "keda.k8s.io"
    resources:
      - "*"
    verbs:
      - "*"
  - apiGroups:
      - "serving.knative.dev"
    resources:
      - services
    verbs:
      - create
      - update
      - patch
      - delete
  - apiGroups:
      - ""
    resources:
      - pods
      - namespaces
      - secrets
      - configmaps
      - endpoints
      - services
      - events
      - serviceaccounts
    verbs:
      - get
      - list
      - create
      - update
      - patch
      - delete
      - patch
      - watch
  - apiGroups:
      - admissionregistration.k8s.io
    resources:
      - mutatingwebhookconfigurations
      - validatingwebhookconfigurations
    verbs:
      - get
      - list
      - create
      - update
      - patch
      - delete
      - patch
      - watch
  - apiGroups:
      - rbac.authorization.k8s.io
    resources:
      - clusterrolebindings
      - rolebindings
    verbs:
      - create
      - delete
      - escalate
      - list
      - get
      - update
      - patch
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - escalate
      - list
      - get
      - watch
  - apiGroups:
      - "authentication.istio.io"
    resources:
      - "*"
    verbs:
      - "*"
  - apiGroups:
      - "certificates.k8s.io"
    resources:
      - "certificatesigningrequests"
    verbs:
      - "update"
      - "create"
      - "get"
      - "delete"
  - apiGroups:
      - certificates.k8s.io
    resources:
      - "certificatesigningrequests/approval"
    verbs:
      - "update"
      - "create"
      - "get"
      - "delete"
  - apiGroups:
      - certificates.k8s.io
    resources:
      - "certificatesigningrequests/status"
    verbs:
      - "update"
      - "create"
      - "get"
      - "delete"
  - apiGroups:
      - config.istio.io
    resources:
      - "*"
    verbs:
      - "*"
  - apiGroups:
      - extensions
    resources:
      - "ingresses"
    verbs:
      - "*"
  - apiGroups:
      - extensions
    resources:
      - "ingresses/status"
    verbs:
      - "*"
  - apiGroups:
      - networking.istio.io
    resources:
      - "*"
    verbs:
      - "*"
  - apiGroups:
      - rbac.istio.io
    resources:
      - "*"
    verbs:
      - "get"
      - "watch"
      - "list"
  - apiGroups:
      - security.istio.io
    resources:
      - "*"
    verbs:
      - "get"
      - "watch"
      - "list"
  - apiGroups:
      - security.istio.io
    resources:
      - "peerauthentications"
    verbs:
      - "create"
      - "update"
      - "patch"
  - apiGroups:
      - ""
    resources:
      - "replicationcontrollers"
    verbs:
      - "get"
      - "watch"
      - "list"
  - apiGroups:
      - "extensions"
    resources:
      - "replicasets"
    verbs:
      - "get"
      - "watch"
      - "list"
  - apiGroups:
      - ""
    resources:
      - "endpoints/restricted"
    verbs:
      - "create"
  - apiGroups:
      - ""
    resources:
      - "pods"
    verbs:
      - "deletecollection"
  - apiGroups:
      - ""
    resources:
      - "secrets"
    verbs:
      - "deletecollection"
  - apiGroups:
      - "apps"
    resources:
      - "deployments"
    verbs:
      - "update"
      - "patch"
  - apiGroups:
      - "apps"
    resources:
      - "deployments/finalizers"
    verbs:
      - "get"
      - "list"
      - "create"
      - "update"
      - "delete"
      - "patch"
      - "watch"
  - apiGroups:
      - "autoscaling"
    resources:
      - "horizontalpodautoscalers"
    verbs:
      - "update"
      - "patch"
      - "watch"
  - apiGroups:
      - "autoscaling.internal.knative.dev"
    resources:
      - "*"
    verbs:
      - "get"
      - "list"
      - "create"
      - "update"
      - "delete"
      - "deletecollection"
      - "patch"
      - "watch"
  - apiGroups:
      - "autoscaling.internal.knative.dev"
    resources:
      - "*/finalizers"
    verbs:
      - "get"
      - "list"
      - "create"
      - "update"
      - "delete"
      - "deletecollection"
      - "patch"
      - "watch"
  - apiGroups:
      - "autoscaling.internal.knative.dev"
    resources:
      - "*/status"
    verbs:
      - "get"
      - "list"
      - "create"
      - "update"
      - "delete"
      - "deletecollection"
      - "patch"
      - "watch"
  - apiGroups:
      - "domains.cloudrun.com"
    resources:
      - "domainmappings"
    verbs:
      - "get"
      - "list"
      - "create"
      - "update"
      - "delete"
      - "patch"
      - "watch"
  - apiGroups:
      - "domains.cloudrun.com"
    resources:
      - "domainmappings/status"
    verbs:
      - "get"
      - "list"
      - "create"
      - "update"
      - "delete"
      - "patch"
      - "watch"
  - apiGroups:
      - "networking.internal.knative.dev"
    resources:
      - "*"
    verbs:
      - "get"
      - "list"
      - "create"
      - "update"
      - "delete"
      - "deletecollection"
      - "patch"
      - "watch"
  - apiGroups:
      - "networking.internal.knative.dev"
    resources:
      - "*/finalizers"
    verbs:
      - "get"
      - "list"
      - "create"
      - "update"
      - "delete"
      - "deletecollection"
      - "patch"
      - "watch"
  - apiGroups:
      - "networking.internal.knative.dev"
    resources:
      - "*/status"
    verbs:
      - "get"
      - "list"
      - "create"
      - "update"
      - "delete"
      - "deletecollection"
      - "patch"
      - "watch"
  - apiGroups:
      - "serving.knative.dev"
    resources:
      - "*"
    verbs:
      - "get"
      - "list"
      - "create"
      - "update"
      - "delete"
      - "deletecollection"
      - "patch"
      - "watch"
  - apiGroups:
      - "serving.knative.dev"
    resources:
      - "*/finalizers"
    verbs:
      - "get"
      - "list"
      - "create"
      - "update"
      - "delete"
      - "deletecollection"
      - "patch"
      - "watch"
  - apiGroups:
      - "serving.knative.dev"
    resources:
      - "*/status"
    verbs:
      - "get"
      - "list"
      - "create"
      - "update"
      - "delete"
      - "deletecollection"
      - "patch"
      - "watch"
  - apiGroups:
      - "tls.cloudrun.com"
    resources:
      - "orders"
    verbs:
      - "get"
      - "list"
      - "create"
      - "update"
      - "delete"
      - "patch"
      - "watch"
  - apiGroups:
      - "tls.cloudrun.com"
    resources:
      - "orders/status"
    verbs:
      - "get"
      - "list"
      - "create"
      - "update"
      - "delete"
      - "patch"
      - "watch"
  - apiGroups:
      - "anthos.gke.io"
    resources:
      - "entitlements"
    verbs:
      - "get"
      - "list"
      - "watch"

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    operator.knative.dev/release: devel
    k8s-app: appdevexperience-operator
  name: appdevexperience-operator
  namespace: appdevexperience
subjects:
  - kind: ServiceAccount
    name: appdevexperience-operator
    namespace: appdevexperience
roleRef:
  kind: Role
  name: appdevexperience-operator
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    operator.knative.dev/release: devel
    k8s-app: appdevexperience-operator
  name: appdevexperience-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: appdevexperience-operator
subjects:
  - kind: ServiceAccount
    name: appdevexperience-operator
    namespace: appdevexperience
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    operator.knative.dev/release: devel
    k8s-app: appdevexperience-operator
  name: appdevexperience:system:auth-delegator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
  - kind: ServiceAccount
    name: appdevexperience-operator
    namespace: appdevexperience
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    operator.knative.dev/release: devel
    k8s-app: appdevexperience-operator
  name: appdevexperience-subresource-auth-reader
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: extension-apiserver-authentication-reader
subjects:
  - kind: ServiceAccount
    name: appdevexperience-operator
    namespace: appdevexperience

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: config-appdevexperience
  namespace: appdevexperience
  labels:
    operator.knative.dev/release: devel
    k8s-app: appdevexperience-operator
data:
  _example: |
    ################################
    #                              #
    #    EXAMPLE CONFIGURATION     #
    #                              #
    ################################
    imagePullSecrets: secret-name to pull images from
  imageRegistry: gcr.io/gke-release-staging

---
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    operator.knative.dev/release: devel
    k8s-app: appdevexperience-operator
  name: appdevexperience-operator-config-logging
  namespace: appdevexperience

---
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    operator.knative.dev/release: devel
    k8s-app: appdevexperience-operator
  name: appdevexperience-operator-config-observability
  namespace: appdevexperience

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    operator.knative.dev/release: devel
    k8s-app: appdevexperience-operator
  name: appdevexperience-operator
  namespace: appdevexperience
spec:
  replicas: 1
  selector:
    matchLabels:
      name: appdevexperience-operator
      k8s-app: appdevexperience-operator
  template:
    metadata:
      annotations:
        components.gke.io/component-name: value-hardcoded-into-900-operator-yaml
        components.gke.io/component-version: value.hardcoded-into.900-operator-yaml
      labels:
        name: appdevexperience-operator
        k8s-app: appdevexperience-operator
        operator.knative.dev/release: devel
    spec:
      serviceAccountName: appdevexperience-operator
      containers:
        - name: appdevexperience-operator
          image: gcr.io/kf-releases/manager-8c1c8ab781874571a2922c5ee0f809ef@sha256:099af669644d93a0f96f24ed5bdbffdbb7f79372f81a56e6ddb10de96818c751
          imagePullPolicy: IfNotPresent
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - all
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: "appdevexperience-operator"
            - name: SYSTEM_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: METRICS_DOMAIN
              value: appdevexperience/appdevexperience-operator
            - name: CONFIG_LOGGING_NAME
              value: appdevexperience-operator-config-logging
            - name: CONFIG_OBSERVABILITY_NAME
              value: appdevexperience-operator-config-observability
            - name: COMPONENT_NAME_ANNOTATION
              valueFrom:
                fieldRef:
                  fieldPath: metadata.annotations['components.gke.io/component-name']
            - name: COMPONENT_VERSION_ANNOTATION
              valueFrom:
                fieldRef:
                  fieldPath: metadata.annotations['components.gke.io/component-version']

---
