apiVersion: v1
kind: Namespace
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: build-service
    control-plane: controller-manager
  name: build-service
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: build-service
  name: build-service-controller-manager
  namespace: build-service
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: metrics-scraper
  namespace: build-service
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: build-service-build-pipeline-config-read-only
  namespace: build-service
rules:
- apiGroups:
  - ""
  resourceNames:
  - build-pipeline-config
  resources:
  - configmaps
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: build-service
  name: build-service-leader-election-role
  namespace: build-service
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: appstudio-pipelines-runner
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
- apiGroups:
  - security.openshift.io
  resourceNames:
  - appstudio-pipelines-scc
  resources:
  - securitycontextconstraints
  verbs:
  - use
- apiGroups:
  - appstudio.redhat.com
  resources:
  - enterprisecontractpolicies
  verbs:
  - get
  - list
- apiGroups:
  - eaas.konflux-ci.dev
  resources:
  - namespaces
  verbs:
  - get
  - create
  - delete
  - list
  - watch
- apiGroups:
  - tekton.dev
  resources:
  - pipelineruns
  - taskruns
  verbs:
  - get
  - list
- apiGroups:
  - ci.openshift.org
  resources:
  - testplatformclusters
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: build-service-manager-role
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  - secrets
  - serviceaccounts
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - namespaces
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  - events.k8s.io
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
- apiGroups:
  - appstudio.redhat.com
  resources:
  - components
  verbs:
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - appstudio.redhat.com
  resources:
  - components/status
  - imagerepositories
  - imagerepositories/status
  - nudgeconfigs
  - releaseplanadmissions
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - konflux-ci.dev
  resources:
  - components
  - components/status
  verbs:
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - pipelinesascode.tekton.dev
  resources:
  - repositories
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterroles
  verbs:
  - get
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - rolebindings
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - route.openshift.io
  resources:
  - routes
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - tekton.dev
  resources:
  - pipelineruns
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: build-service-metrics-auth-role
rules:
- apiGroups:
  - authentication.k8s.io
  resources:
  - tokenreviews
  verbs:
  - create
- apiGroups:
  - authorization.k8s.io
  resources:
  - subjectaccessreviews
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: build-service-metrics-reader
rules:
- nonResourceURLs:
  - /metrics
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: build-pipeline-config-read-only-binding
  namespace: build-service
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: build-service-build-pipeline-config-read-only
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:authenticated
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: build-service
  name: build-service-leader-election-rolebinding
  namespace: build-service
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: build-service-leader-election-role
subjects:
- kind: ServiceAccount
  name: build-service-controller-manager
  namespace: build-service
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: build-pipeline-runner-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: appstudio-pipelines-runner
subjects:
- kind: ServiceAccount
  name: build-service-controller-manager
  namespace: build-service
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: build-service
  name: build-service-manager-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: build-service-manager-role
subjects:
- kind: ServiceAccount
  name: build-service-controller-manager
  namespace: build-service
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: build-service-metrics-auth-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: build-service-metrics-auth-role
subjects:
- kind: ServiceAccount
  name: build-service-controller-manager
  namespace: build-service
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    konflux.konflux-ci.dev/metrics-scraper-binding: "true"
  name: prometheus-build-service-metrics-reader
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: build-service-metrics-reader
subjects: []
---
apiVersion: v1
data:
  config.yaml: |
    default-pipeline-name: docker-build-oci-ta-min
    pipelines:
    - name: fbc-builder
      bundle: quay.io/konflux-ci/tekton-catalog/pipeline-fbc-builder@sha256:b5a39917c2ad90699d77a462d916d6a8c635f23ea713e7ec68e2c6c6270a1780
    - name: docker-build
      bundle: quay.io/konflux-ci/tekton-catalog/pipeline-docker-build@sha256:7d95b38a80f448c944ac6a3e8a07577eb4c2b11b5ce9831055fba21662b545d1
    - name: docker-build-oci-ta
      bundle: quay.io/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta@sha256:67a12e62e8a2dab3fd3acf1e8b014a7566df864f2150f2b4e27bc11f2a73d23a
    - name: tekton-bundle-builder
      bundle: quay.io/konflux-ci/tekton-catalog/pipeline-tekton-bundle-builder@sha256:10a32de0be21a6be5b6c318544c8d80f0bf1a22f79fb4de6fbd0f94bf7e23756
    - name: tekton-bundle-builder-oci-ta
      bundle: quay.io/konflux-ci/tekton-catalog/pipeline-tekton-bundle-builder-oci-ta@sha256:944f48a77d5a69c6ddf805b990f8fcf83233e2c36feac611491509559e051213
    - name: docker-build-oci-ta-min
      bundle: quay.io/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta-min@sha256:3829dc2d363763799c7ce5e1bd827ba00e9154da94bd3327575f4582108af764
      description: minimal version of the docker-build-oci-ta pipeline, which requires less compute resources. In addition, it doesn't contain tasks which require user provided secrets.
kind: ConfigMap
metadata:
  name: build-pipeline-config
  namespace: build-service
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: build-service
    control-plane: controller-manager
  name: build-service-controller-manager-metrics-service
  namespace: build-service
spec:
  ports:
  - name: https
    port: 8443
    protocol: TCP
    targetPort: 8443
  selector:
    control-plane: controller-manager
---
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    ignore-check.kube-linter.io/liveness-port: Keeping upstream configs
    ignore-check.kube-linter.io/readiness-port: Keeping upstream configs
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: build-service
    control-plane: controller-manager
  name: build-service-controller-manager
  namespace: build-service
spec:
  progressDeadlineSeconds: 2147483647
  replicas: 1
  selector:
    matchLabels:
      control-plane: controller-manager
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: manager
      labels:
        control-plane: controller-manager
    spec:
      containers:
      - args:
        - --metrics-bind-address=:8443
        - --leader-elect=false
        - --health-probe-bind-address=:8081
        - -webhook-config-path=/mnt/webhook-config.json
        command:
        - /manager
        image: quay.io/konflux-ci/build-service:7e1a8b2cf9c580a3f3a111c75be36cd739166d5a
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8081
          initialDelaySeconds: 15
          periodSeconds: 20
        name: manager
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8081
          initialDelaySeconds: 5
          periodSeconds: 10
        resources:
          limits:
            cpu: 500m
            memory: 1024Mi
          requests:
            cpu: 10m
            memory: 64Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /etc/ssl/certs/ca-custom-bundle.crt
          name: trusted-ca
          readOnly: true
          subPath: ca-bundle.crt
        - mountPath: /mnt
          name: webhook-config
          readOnly: true
        - mountPath: /tmp/k8s-metrics-server/serving-certs
          name: metrics-certs
          readOnly: true
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: build-service-controller-manager
      terminationGracePeriodSeconds: 10
      volumes:
      - configMap:
          items:
          - key: ca-bundle.crt
            path: ca-bundle.crt
          name: trusted-ca
          optional: true
        name: trusted-ca
      - configMap:
          items:
          - key: webhook-config.json
            path: webhook-config.json
          name: webhook-config
          optional: true
        name: webhook-config
      - name: metrics-certs
        secret:
          items:
          - key: tls.crt
            path: tls.crt
          - key: tls.key
            path: tls.key
          optional: false
          secretName: metrics-server-cert
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  labels:
    app.kubernetes.io/component: certificate
    app.kubernetes.io/instance: metrics-certs
    app.kubernetes.io/name: metrics-certificate
  name: metrics-certs
  namespace: build-service
spec:
  dnsNames:
  - build-service-controller-manager-metrics-service.build-service.svc
  - build-service-controller-manager-metrics-service.build-service.svc.cluster.local
  issuerRef:
    group: cert-manager.io
    kind: ClusterIssuer
    name: konflux-issuer
  secretName: metrics-server-cert
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: build-service
  namespace: build-service
spec:
  endpoints:
  - bearerTokenSecret:
      key: token
      name: prometheus-scrape-token
    interval: 15s
    path: /metrics
    port: https
    scheme: https
    tlsConfig:
      ca:
        secret:
          key: ca.crt
          name: metrics-server-cert
      insecureSkipVerify: false
      serverName: build-service-controller-manager-metrics-service.build-service.svc
  selector:
    matchLabels:
      control-plane: controller-manager
---
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: false
allowPrivilegedContainer: false
allowedCapabilities:
- SETFCAP
apiVersion: security.openshift.io/v1
defaultAddCapabilities: null
fsGroup:
  type: MustRunAs
groups:
- system:cluster-admins
kind: SecurityContextConstraints
metadata:
  annotations:
    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
    argocd.argoproj.io/sync-wave: "0"
  name: appstudio-pipelines-scc
  namespace: build-service
priority: 10
readOnlyRootFilesystem: false
requiredDropCapabilities:
- MKNOD
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: MustRunAs
supplementalGroups:
  type: RunAsAny
users: []
volumes:
- configMap
- downwardAPI
- emptyDir
- persistentVolumeClaim
- projected
- secret