---
apiVersion: v1
kind: Namespace
metadata:
  name: knative-build
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: knative-build
spec:
  allowPrivilegeEscalation: false
  fsGroup:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  hostIPC: false
  hostNetwork: false
  hostPID: false
  privileged: false
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  volumes:
  - configMap
  - secret
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: knative-build-admin
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - namespaces
  - secrets
  - events
  - serviceaccounts
  - configmaps
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - extensions
  resources:
  - deployments
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - mutatingwebhookconfigurations
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - build.knative.dev
  resources:
  - builds
  - buildtemplates
  - clusterbuildtemplates
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - build.knative.dev
  resources:
  - builds/status
  - buildtemplates/status
  - clusterbuildtemplates/status
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - caching.internal.knative.dev
  resources:
  - images
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - deletecollection
  - patch
  - watch
- apiGroups:
  - policy
  resourceNames:
  - knative-build
  resources:
  - podsecuritypolicies
  verbs:
  - use
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: build-controller
  namespace: knative-build
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: build-controller-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: knative-build-admin
subjects:
- kind: ServiceAccount
  name: build-controller
  namespace: knative-build
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: builds.build.knative.dev
spec:
  additionalPrinterColumns:
  - JSONPath: .status.conditions[?(@.type=="Succeeded")].status
    name: Succeeded
    type: string
  - JSONPath: .status.conditions[?(@.type=="Succeeded")].reason
    name: Reason
    type: string
  - JSONPath: .status.startTime
    name: StartTime
    type: date
  - JSONPath: .status.completionTime
    name: CompletionTime
    type: date
  group: build.knative.dev
  names:
    categories:
    - all
    - knative
    kind: Build
    plural: builds
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: buildtemplates.build.knative.dev
spec:
  additionalPrinterColumns:
  - JSONPath: .metadata.creationTimestamp
    name: Age
    type: date
  group: build.knative.dev
  names:
    categories:
    - all
    - knative
    kind: BuildTemplate
    plural: buildtemplates
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: clusterbuildtemplates.build.knative.dev
spec:
  additionalPrinterColumns:
  - JSONPath: .metadata.creationTimestamp
    name: Age
    type: date
  group: build.knative.dev
  names:
    categories:
    - all
    - knative
    kind: ClusterBuildTemplate
    plural: clusterbuildtemplates
  scope: Cluster
  subresources:
    status: {}
  version: v1alpha1
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: images.caching.internal.knative.dev
spec:
  group: caching.internal.knative.dev
  names:
    categories:
    - all
    - knative-internal
    - caching
    kind: Image
    plural: images
    shortNames:
    - img
    singular: image
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: build-controller
  name: build-controller
  namespace: knative-build
spec:
  ports:
  - name: metrics
    port: 9090
    protocol: TCP
    targetPort: 9090
  selector:
    app: build-controller
---
apiVersion: v1
kind: Service
metadata:
  labels:
    role: build-webhook
  name: build-webhook
  namespace: knative-build
spec:
  ports:
  - port: 443
    targetPort: 443
  selector:
    role: build-webhook
---
apiVersion: caching.internal.knative.dev/v1alpha1
kind: Image
metadata:
  name: creds-init
  namespace: knative-build
spec:
  image: gcr.io/knative-releases/github.com/knative/build/cmd/creds-init@sha256:22b3a971c3d1d5529ca16f6b6d168ba03c1f3bcb0744271ff8882374fd3b6fdb
---
apiVersion: caching.internal.knative.dev/v1alpha1
kind: Image
metadata:
  name: git-init
  namespace: knative-build
spec:
  image: gcr.io/knative-releases/github.com/knative/build/cmd/git-init@sha256:e6ffa2a922cdea55d51d8648b5b07435d5598ebb6789849c41802de63e7324a9
---
apiVersion: caching.internal.knative.dev/v1alpha1
kind: Image
metadata:
  name: gcs-fetcher
  namespace: knative-build
spec:
  image: gcr.io/cloud-builders/gcs-fetcher
---
apiVersion: caching.internal.knative.dev/v1alpha1
kind: Image
metadata:
  name: nop
  namespace: knative-build
spec:
  image: gcr.io/knative-releases/github.com/knative/build/cmd/nop@sha256:915db860d1bf101322f35b06e963a1dcc00e9c1beeecfaaef650db4e45364e61
---
apiVersion: v1
data:
  loglevel.controller: info
  loglevel.creds-init: info
  loglevel.git-init: info
  loglevel.webhook: info
  zap-logger-config: |
    {
      "level": "info",
      "development": false,
      "sampling": {
        "initial": 100,
        "thereafter": 100
      },
      "outputPaths": ["stdout"],
      "errorOutputPaths": ["stderr"],
      "encoding": "json",
      "encoderConfig": {
        "timeKey": "",
        "levelKey": "level",
        "nameKey": "logger",
        "callerKey": "caller",
        "messageKey": "msg",
        "stacktraceKey": "stacktrace",
        "lineEnding": "",
        "levelEncoder": "",
        "timeEncoder": "",
        "durationEncoder": "",
        "callerEncoder": ""
      }
    }
kind: ConfigMap
metadata:
  name: config-logging
  namespace: knative-build
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: build-controller
  namespace: knative-build
spec:
  replicas: 1
  selector:
    matchLabels:
      app: build-controller
  template:
    metadata:
      labels:
        app: build-controller
    spec:
      containers:
      - args:
        - -logtostderr
        - -stderrthreshold
        - INFO
        - -creds-image
        - gcr.io/knative-releases/github.com/knative/build/cmd/creds-init@sha256:22b3a971c3d1d5529ca16f6b6d168ba03c1f3bcb0744271ff8882374fd3b6fdb
        - -git-image
        - gcr.io/knative-releases/github.com/knative/build/cmd/git-init@sha256:e6ffa2a922cdea55d51d8648b5b07435d5598ebb6789849c41802de63e7324a9
        - -nop-image
        - gcr.io/knative-releases/github.com/knative/build/cmd/nop@sha256:915db860d1bf101322f35b06e963a1dcc00e9c1beeecfaaef650db4e45364e61
        env:
        - name: SYSTEM_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        image: gcr.io/knative-releases/github.com/knative/build/cmd/controller@sha256:6c9133810e75c057e6084f5dc65b6c55cb98e42692f45241f8d0023050f27ba9
        name: build-controller
        volumeMounts:
        - mountPath: /etc/config-logging
          name: config-logging
      serviceAccountName: build-controller
      volumes:
      - configMap:
          name: config-logging
        name: config-logging
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: build-webhook
  namespace: knative-build
spec:
  replicas: 1
  selector:
    matchLabels:
      app: build-webhook
  template:
    metadata:
      labels:
        app: build-webhook
        role: build-webhook
    spec:
      containers:
      - args:
        - -logtostderr
        - -stderrthreshold
        - INFO
        env:
        - name: SYSTEM_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        image: gcr.io/knative-releases/github.com/knative/build/cmd/webhook@sha256:9074519adf32e1d290a25a54699cf40c42c2313bc881d603cdcf57444ac28a37
        name: build-webhook
        volumeMounts:
        - mountPath: /etc/config-logging
          name: config-logging
      serviceAccountName: build-controller
      volumes:
      - configMap:
          name: config-logging
        name: config-logging
