apiVersion: v1
kind: Namespace
metadata:
  name: tekton-pipelines

---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: tekton-triggers
spec:
  allowPrivilegeEscalation: false
  fsGroup:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  hostIPC: false
  hostNetwork: false
  hostPID: false
  privileged: false
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  volumes:
  - emptyDir
  - configMap
  - secret

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: tekton-triggers-admin
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  - secrets
  - services
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - apps
  resources:
  - deployments
  - deployments/finalizers
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - mutatingwebhookconfigurations
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - tekton.dev
  resources:
  - eventlisteners
  - triggerbindings
  - triggertemplates
  - eventlisteners/finalizers
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - tekton.dev
  resources:
  - eventlisteners/status
  - triggerbindings/status
  - triggertemplates/status
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - policy
  resourceNames:
  - tekton-triggers
  resources:
  - podsecuritypolicies
  verbs:
  - use

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tekton-triggers-controller
  namespace: tekton-pipelines

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: tekton-triggers-controller-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tekton-triggers-admin
subjects:
- kind: ServiceAccount
  name: tekton-triggers-controller
  namespace: tekton-pipelines

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: eventlisteners.tekton.dev
spec:
  group: tekton.dev
  names:
    categories:
    - all
    - tekton-triggers
    kind: EventListener
    plural: eventlisteners
    shortNames:
    - el
    singular: eventlistener
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: triggerbindings.tekton.dev
spec:
  group: tekton.dev
  names:
    categories:
    - all
    - tekton-triggers
    kind: TriggerBinding
    plural: triggerbindings
    shortNames:
    - tb
    singular: triggerbinding
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: triggertemplates.tekton.dev
spec:
  group: tekton.dev
  names:
    categories:
    - all
    - tekton-triggers
    kind: TriggerTemplate
    plural: triggertemplates
    shortNames:
    - tt
    singular: triggertemplate
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
  name: tekton-triggers-aggregate-edit
rules:
- apiGroups:
  - tekton.dev
  resources:
  - eventlisteners
  - triggerbindings
  - triggertemplates
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    rbac.authorization.k8s.io/aggregate-to-view: "true"
  name: tekton-triggers-aggregate-view
rules:
- apiGroups:
  - tekton.dev
  resources:
  - eventlisteners
  - triggerbindings
  - triggertemplates
  verbs:
  - get
  - list
  - watch

---
apiVersion: v1
data:
  loglevel.controller: info
  loglevel.webhook: info
  zap-logger-config: |
    {
      "level": "info",
      "development": false,
      "sampling": {
        "initial": 100,
        "thereafter": 100
      },
      "outputPaths": ["stdout"],
      "errorOutputPaths": ["stderr"],
      "encoding": "json",
      "encoderConfig": {
        "timeKey": "",
        "levelKey": "level",
        "nameKey": "logger",
        "callerKey": "caller",
        "messageKey": "msg",
        "stacktraceKey": "stacktrace",
        "lineEnding": "",
        "levelEncoder": "",
        "timeEncoder": "",
        "durationEncoder": "",
        "callerEncoder": ""
      }
    }
kind: ConfigMap
metadata:
  name: config-logging-triggers
  namespace: tekton-pipelines

---
apiVersion: v1
data:
  _example: |
    ################################
    #                              #
    #    EXAMPLE CONFIGURATION     #
    #                              #
    ################################

    # This block is not actually functional configuration,
    # but serves to illustrate the available configuration
    # options and document them in a way that is accessible
    # to users that `kubectl edit` this config map.
    #
    # These sample configuration options may be copied out of
    # this example block and unindented to be in the data block
    # to actually change the configuration.

    # metrics.backend-destination field specifies the system metrics destination.
    # It supports either prometheus (the default) or stackdriver.
    # Note: Using stackdriver will incur additional charges
    metrics.backend-destination: prometheus

    # metrics.stackdriver-project-id field specifies the stackdriver project ID. This
    # field is optional. When running on GCE, application default credentials will be
    # used if this field is not provided.
    metrics.stackdriver-project-id: "<your stackdriver project id>"

    # metrics.allow-stackdriver-custom-metrics indicates whether it is allowed to send metrics to
    # Stackdriver using "global" resource type and custom metric type if the
    # metrics are not supported by "knative_revision" resource type. Setting this
    # flag to "true" could cause extra Stackdriver charge.
    # If metrics.backend-destination is not Stackdriver, this is ignored.
    metrics.allow-stackdriver-custom-metrics: "false"
kind: ConfigMap
metadata:
  name: config-observability-triggers
  namespace: tekton-pipelines

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: tekton-triggers-controller
  name: tekton-triggers-controller
  namespace: tekton-pipelines
spec:
  ports:
  - name: metrics
    port: 9090
    protocol: TCP
    targetPort: 9090
  selector:
    app: tekton-triggers-controller

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tekton-triggers-controller
  namespace: tekton-pipelines
spec:
  replicas: 1
  selector:
    matchLabels:
      app: tekton-triggers-controller
  template:
    metadata:
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
      labels:
        app: tekton-triggers-controller
    spec:
      containers:
      - args:
        - -logtostderr
        - -stderrthreshold
        - INFO
        - -el-image
        - gcr.io/tekton-releases/github.com/tektoncd/triggers/cmd/eventlistenersink@sha256:34dc184a59d0c8e357b6208388cbbc9095a92508f522d18a3a371c22e0d4c930
        env:
        - name: SYSTEM_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: CONFIG_LOGGING_NAME
          value: config-logging-triggers
        - name: CONFIG_OBSERVABILITY_NAME
          value: config-observability-triggers
        - name: METRICS_DOMAIN
          value: tekton.dev/triggers
        image: gcr.io/tekton-releases/github.com/tektoncd/triggers/cmd/controller@sha256:c04694411632b05b0bc2116c641432b8d596c5814394adbc659f16505fed9db4
        name: tekton-triggers-controller
        volumeMounts:
        - mountPath: /etc/config-logging
          name: config-logging
      serviceAccountName: tekton-triggers-controller
      volumes:
      - configMap:
          name: config-logging-triggers
        name: config-logging

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: tekton-triggers-webhook
  name: tekton-triggers-webhook
  namespace: tekton-pipelines
spec:
  ports:
  - port: 443
    targetPort: 8443
  selector:
    app: tekton-triggers-webhook

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tekton-triggers-webhook
  namespace: tekton-pipelines
spec:
  replicas: 1
  selector:
    matchLabels:
      app: tekton-triggers-webhook
  template:
    metadata:
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
      labels:
        app: tekton-triggers-webhook
    spec:
      containers:
      - env:
        - name: SYSTEM_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        image: gcr.io/tekton-releases/github.com/tektoncd/triggers/cmd/webhook@sha256:c0f6cd59922c472bb3ad386513b681b8bf5aaf48e6811bd6de24bdf09062af8a
        name: webhook
        volumeMounts:
        - mountPath: /etc/config-logging
          name: config-logging
      serviceAccountName: tekton-triggers-controller
      volumes:
      - configMap:
          name: config-logging-triggers
        name: config-logging

---
