apiVersion: v1
kind: Namespace
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: build-service
    control-plane: controller-manager
  name: build-service
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: build-service
  name: build-service-controller-manager
  namespace: build-service
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: metrics-scraper
  namespace: build-service
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: build-service-build-pipeline-config-read-only
  namespace: build-service
rules:
- apiGroups:
  - ""
  resourceNames:
  - build-pipeline-config
  resources:
  - configmaps
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: build-service
  name: build-service-leader-election-role
  namespace: build-service
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: appstudio-pipelines-runner
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
- apiGroups:
  - security.openshift.io
  resourceNames:
  - appstudio-pipelines-scc
  resources:
  - securitycontextconstraints
  verbs:
  - use
- apiGroups:
  - appstudio.redhat.com
  resources:
  - enterprisecontractpolicies
  verbs:
  - get
  - list
- apiGroups:
  - eaas.konflux-ci.dev
  resources:
  - namespaces
  verbs:
  - get
  - create
  - delete
  - list
  - watch
- apiGroups:
  - tekton.dev
  resources:
  - pipelineruns
  - taskruns
  verbs:
  - get
  - list
- apiGroups:
  - ci.openshift.org
  resources:
  - testplatformclusters
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: build-service-manager-role
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  - secrets
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - ""
  resources:
  - namespaces
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - serviceaccounts
  verbs:
  - create
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
- apiGroups:
  - appstudio.redhat.com
  resources:
  - components
  - components/status
  verbs:
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - appstudio.redhat.com
  resources:
  - imagerepositories
  - imagerepositories/status
  - releaseplanadmissions
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - pipelinesascode.tekton.dev
  resources:
  - repositories
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterroles
  verbs:
  - get
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - rolebindings
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - route.openshift.io
  resources:
  - routes
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - tekton.dev
  resources:
  - pipelineruns
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: build-service-metrics-auth-role
rules:
- apiGroups:
  - authentication.k8s.io
  resources:
  - tokenreviews
  verbs:
  - create
- apiGroups:
  - authorization.k8s.io
  resources:
  - subjectaccessreviews
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
  name: build-service-metrics-reader
rules:
- nonResourceURLs:
  - /metrics
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: build-pipeline-config-read-only-binding
  namespace: build-service
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: build-service-build-pipeline-config-read-only
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:authenticated
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: build-service
  name: build-service-leader-election-rolebinding
  namespace: build-service
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: build-service-leader-election-role
subjects:
- kind: ServiceAccount
  name: build-service-controller-manager
  namespace: build-service
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: build-pipeline-runner-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: appstudio-pipelines-runner
subjects:
- kind: ServiceAccount
  name: build-service-controller-manager
  namespace: build-service
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: build-service
  name: build-service-manager-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: build-service-manager-role
subjects:
- kind: ServiceAccount
  name: build-service-controller-manager
  namespace: build-service
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: build-service-metrics-auth-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: build-service-metrics-auth-role
subjects:
- kind: ServiceAccount
  name: build-service-controller-manager
  namespace: build-service
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
    konflux.konflux-ci.dev/metrics-scraper-binding: "true"
  name: prometheus-build-service-metrics-reader
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: build-service-metrics-reader
subjects: []
---
apiVersion: v1
data:
  config.yaml: |
    default-pipeline-name: docker-build-oci-ta-min
    pipelines:
    - name: fbc-builder
      bundle: quay.io/konflux-ci/tekton-catalog/pipeline-fbc-builder@sha256:d1c8bdaab0a9a25da4e9ddfca0802c0aa8fe3f168a88ada91bc5f6861417215e
    - name: docker-build
      bundle: quay.io/konflux-ci/tekton-catalog/pipeline-docker-build@sha256:45af8ff66760a2b81314465e844ceb15f812ddc89867b987b4b072c1f325f8fc
    - name: docker-build-oci-ta
      bundle: quay.io/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta@sha256:85cc8bd63149f6e4991e5ea2b22e41bc4bf6aeb6067eccfa7eaa6aaac86848b8
    - name: tekton-bundle-builder
      bundle: quay.io/konflux-ci/tekton-catalog/pipeline-tekton-bundle-builder@sha256:a257150dee37b66615a0bd71c5477af50d73898be4fe4b7e193f22266dcebe0a
    - name: tekton-bundle-builder-oci-ta
      bundle: quay.io/konflux-ci/tekton-catalog/pipeline-tekton-bundle-builder-oci-ta@sha256:2766cf3e7adbb784509c0e3798d031c4dbf14460180fb6d322afdd9e853bd6f4
    - name: docker-build-oci-ta-min
      bundle: quay.io/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta-min@sha256:5c6468abcc0564f4470e5a92a72ac50f2f4423b713a5e091f7820cc11fe90a58
      description: minimal version of the docker-build-oci-ta pipeline, which requires less compute resources. In addition, it doesn't contain tasks which require user provided secrets.
kind: ConfigMap
metadata:
  name: build-pipeline-config
  namespace: build-service
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: build-service
    control-plane: controller-manager
  name: build-service-controller-manager-metrics-service
  namespace: build-service
spec:
  ports:
  - name: https
    port: 8443
    protocol: TCP
    targetPort: 8443
  selector:
    control-plane: controller-manager
---
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    ignore-check.kube-linter.io/liveness-port: Keeping upstream configs
    ignore-check.kube-linter.io/readiness-port: Keeping upstream configs
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: build-service
    control-plane: controller-manager
  name: build-service-controller-manager
  namespace: build-service
spec:
  progressDeadlineSeconds: 2147483647
  replicas: 1
  selector:
    matchLabels:
      control-plane: controller-manager
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: manager
      labels:
        control-plane: controller-manager
    spec:
      containers:
      - args:
        - --metrics-bind-address=:8443
        - --leader-elect=false
        - --health-probe-bind-address=:8081
        - -webhook-config-path=/mnt/webhook-config.json
        command:
        - /manager
        image: quay.io/konflux-ci/build-service:40d2c83256e3cfe0905f827fbc47f20bc38b1bfc
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8081
          initialDelaySeconds: 15
          periodSeconds: 20
        name: manager
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8081
          initialDelaySeconds: 5
          periodSeconds: 10
        resources:
          limits:
            cpu: 500m
            memory: 1024Mi
          requests:
            cpu: 10m
            memory: 64Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /etc/ssl/certs/ca-custom-bundle.crt
          name: trusted-ca
          readOnly: true
          subPath: ca-bundle.crt
        - mountPath: /mnt
          name: webhook-config
          readOnly: true
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: build-service-controller-manager
      terminationGracePeriodSeconds: 10
      volumes:
      - configMap:
          items:
          - key: ca-bundle.crt
            path: ca-bundle.crt
          name: trusted-ca
          optional: true
        name: trusted-ca
      - configMap:
          items:
          - key: webhook-config.json
            path: webhook-config.json
          name: webhook-config
          optional: true
        name: webhook-config
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  annotations:
    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
  name: build-service
  namespace: build-service
spec:
  endpoints:
  - bearerTokenSecret:
      key: token
      name: prometheus-scrape-token
    interval: 15s
    path: /metrics
    port: https
    scheme: https
    tlsConfig:
      insecureSkipVerify: true
  selector:
    matchLabels:
      control-plane: controller-manager
---
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: false
allowPrivilegedContainer: false
allowedCapabilities:
- SETFCAP
apiVersion: security.openshift.io/v1
defaultAddCapabilities: null
fsGroup:
  type: MustRunAs
groups:
- system:cluster-admins
kind: SecurityContextConstraints
metadata:
  annotations:
    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
    argocd.argoproj.io/sync-wave: "0"
  name: appstudio-pipelines-scc
  namespace: build-service
priority: 10
readOnlyRootFilesystem: false
requiredDropCapabilities:
- MKNOD
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: MustRunAs
supplementalGroups:
  type: RunAsAny
users: []
volumes:
- configMap
- downwardAPI
- emptyDir
- persistentVolumeClaim
- projected
- secret