knative-serving.0.3.yaml

apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: knative-serving

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: knative-serving-admin
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - namespaces
  - secrets
  - configmaps
  - endpoints
  - services
  - events
  - serviceaccounts
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - extensions
  resources:
  - ingresses
  - deployments
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - apps
  resources:
  - deployments
  - deployments/scale
  - statefulsets
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - mutatingwebhookconfigurations
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - serving.knative.dev
  resources:
  - configurations
  - routes
  - revisions
  - services
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - serving.knative.dev
  resources:
  - configurations/status
  - routes/status
  - revisions/status
  - services/status
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - autoscaling.internal.knative.dev
  resources:
  - podautoscalers
  - podautoscalers/status
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - autoscaling
  resources:
  - horizontalpodautoscalers
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - caching.internal.knative.dev
  resources:
  - images
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - networking.internal.knative.dev
  resources:
  - clusteringresses
  - clusteringresses/status
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - build.knative.dev
  resources:
  - builds
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - networking.istio.io
  resources:
  - virtualservices
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: controller
  namespace: knative-serving

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: knative-serving-controller-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: knative-serving-admin
subjects:
- kind: ServiceAccount
  name: controller
  namespace: knative-serving

---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: knative-ingress-gateway
  namespace: knative-serving
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - '*'
    port:
      name: http
      number: 80
      protocol: HTTP
  - hosts:
    - '*'
    port:
      name: https
      number: 443
      protocol: HTTPS
    tls:
      mode: PASSTHROUGH
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: knative-shared-gateway
  namespace: knative-serving
spec:
  selector:
    knative: ingressgateway
  servers:
  - hosts:
    - '*'
    port:
      name: http
      number: 80
      protocol: HTTP
  - hosts:
    - '*'
    port:
      name: https
      number: 443
      protocol: HTTPS
    tls:
      mode: PASSTHROUGH
---
apiVersion: v1
kind: Service
metadata:
  annotations: null
  labels:
    app: knative-ingressgateway
    chart: gateways-1.0.1
    heritage: Tiller
    knative: ingressgateway
    release: RELEASE-NAME
  name: knative-ingressgateway
  namespace: istio-system
spec:
  ports:
  - name: http2
    nodePort: 32380
    port: 80
    targetPort: 80
  - name: https
    nodePort: 32390
    port: 443
  - name: tcp
    nodePort: 32400
    port: 31400
  - name: tcp-pilot-grpc-tls
    port: 15011
    targetPort: 15011
  - name: tcp-citadel-grpc-tls
    port: 8060
    targetPort: 8060
  - name: tcp-dns-tls
    port: 853
    targetPort: 853
  - name: http2-prometheus
    port: 15030
    targetPort: 15030
  - name: http2-grafana
    port: 15031
    targetPort: 15031
  selector:
    app: knative-ingressgateway
    knative: ingressgateway
  type: LoadBalancer
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  labels:
    app: knative-ingressgateway
    chart: gateways-1.0.1
    heritage: Tiller
    knative: ingressgateway
    release: RELEASE-NAME
  name: knative-ingressgateway
  namespace: istio-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: knative-ingressgateway
      knative: ingressgateway
  template:
    metadata:
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ""
        sidecar.istio.io/inject: "false"
      labels:
        app: knative-ingressgateway
        knative: ingressgateway
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - ppc64le
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - s390x
            weight: 2
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
                - ppc64le
                - s390x
      containers:
      - args:
        - proxy
        - router
        - -v
        - "2"
        - --discoveryRefreshDelay
        - 1s
        - --drainDuration
        - 45s
        - --parentShutdownDuration
        - 1m0s
        - --connectTimeout
        - 10s
        - --serviceCluster
        - knative-ingressgateway
        - --zipkinAddress
        - zipkin:9411
        - --statsdUdpAddress
        - istio-statsd-prom-bridge:9125
        - --proxyAdminPort
        - "15000"
        - --controlPlaneAuthPolicy
        - NONE
        - --discoveryAddress
        - istio-pilot:8080
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        - name: ISTIO_META_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: docker.io/istio/proxyv2:1.0.2
        imagePullPolicy: IfNotPresent
        name: istio-proxy
        ports:
        - containerPort: 80
        - containerPort: 443
        - containerPort: 31400
        - containerPort: 15011
        - containerPort: 8060
        - containerPort: 853
        - containerPort: 15030
        - containerPort: 15031
        resources:
          requests:
            cpu: 10m
        volumeMounts:
        - mountPath: /etc/certs
          name: istio-certs
          readOnly: true
        - mountPath: /etc/istio/ingressgateway-certs
          name: ingressgateway-certs
          readOnly: true
        - mountPath: /etc/istio/ingressgateway-ca-certs
          name: ingressgateway-ca-certs
          readOnly: true
      serviceAccountName: istio-ingressgateway-service-account
      volumes:
      - name: istio-certs
        secret:
          optional: true
          secretName: istio.istio-ingressgateway-service-account
      - name: ingressgateway-certs
        secret:
          optional: true
          secretName: istio-ingressgateway-certs
      - name: ingressgateway-ca-certs
        secret:
          optional: true
          secretName: istio-ingressgateway-ca-certs
---
apiVersion: autoscaling/v2beta1
kind: HorizontalPodAutoscaler
metadata:
  name: knative-ingressgateway
  namespace: istio-system
spec:
  maxReplicas: 10
  metrics:
  - resource:
      name: cpu
      targetAverageUtilization: 60
    type: Resource
  minReplicas: 1
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: knative-ingressgateway

---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: cluster-local-gateway
  namespace: knative-serving
spec:
  selector:
    istio: cluster-local-gateway
  servers:
  - hosts:
    - '*'
    port:
      name: http
      number: 80
      protocol: HTTP

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: clusteringresses.networking.internal.knative.dev
spec:
  additionalPrinterColumns:
  - JSONPath: .status.conditions[?(@.type=="Ready")].status
    name: Ready
    type: string
  - JSONPath: .status.conditions[?(@.type=="Ready")].reason
    name: Reason
    type: string
  group: networking.internal.knative.dev
  names:
    categories:
    - all
    - knative-internal
    - networking
    kind: ClusterIngress
    plural: clusteringresses
    singular: clusteringress
  scope: Cluster
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: configurations.serving.knative.dev
spec:
  additionalPrinterColumns:
  - JSONPath: .status.latestCreatedRevisionName
    name: LatestCreated
    type: string
  - JSONPath: .status.latestReadyRevisionName
    name: LatestReady
    type: string
  - JSONPath: .status.conditions[?(@.type=="Ready")].status
    name: Ready
    type: string
  - JSONPath: .status.conditions[?(@.type=="Ready")].reason
    name: Reason
    type: string
  group: serving.knative.dev
  names:
    categories:
    - all
    - knative
    - serving
    kind: Configuration
    plural: configurations
    shortNames:
    - config
    - cfg
    singular: configuration
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: images.caching.internal.knative.dev
spec:
  group: caching.internal.knative.dev
  names:
    categories:
    - all
    - knative-internal
    - caching
    kind: Image
    plural: images
    shortNames:
    - img
    singular: image
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: podautoscalers.autoscaling.internal.knative.dev
spec:
  additionalPrinterColumns:
  - JSONPath: .status.conditions[?(@.type=="Ready")].status
    name: Ready
    type: string
  - JSONPath: .status.conditions[?(@.type=="Ready")].reason
    name: Reason
    type: string
  group: autoscaling.internal.knative.dev
  names:
    categories:
    - all
    - knative-internal
    - autoscaling
    kind: PodAutoscaler
    plural: podautoscalers
    shortNames:
    - kpa
    singular: podautoscaler
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: revisions.serving.knative.dev
spec:
  additionalPrinterColumns:
  - JSONPath: .status.serviceName
    name: Service Name
    type: string
  - JSONPath: .status.conditions[?(@.type=="Ready")].status
    name: Ready
    type: string
  - JSONPath: .status.conditions[?(@.type=="Ready")].reason
    name: Reason
    type: string
  group: serving.knative.dev
  names:
    categories:
    - all
    - knative
    - serving
    kind: Revision
    plural: revisions
    shortNames:
    - rev
    singular: revision
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: routes.serving.knative.dev
spec:
  additionalPrinterColumns:
  - JSONPath: .status.domain
    name: Domain
    type: string
  - JSONPath: .status.conditions[?(@.type=="Ready")].status
    name: Ready
    type: string
  - JSONPath: .status.conditions[?(@.type=="Ready")].reason
    name: Reason
    type: string
  group: serving.knative.dev
  names:
    categories:
    - all
    - knative
    - serving
    kind: Route
    plural: routes
    shortNames:
    - rt
    singular: route
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: services.serving.knative.dev
spec:
  additionalPrinterColumns:
  - JSONPath: .status.domain
    name: Domain
    type: string
  - JSONPath: .status.latestCreatedRevisionName
    name: LatestCreated
    type: string
  - JSONPath: .status.latestReadyRevisionName
    name: LatestReady
    type: string
  - JSONPath: .status.conditions[?(@.type=="Ready")].status
    name: Ready
    type: string
  - JSONPath: .status.conditions[?(@.type=="Ready")].reason
    name: Reason
    type: string
  group: serving.knative.dev
  names:
    categories:
    - all
    - knative
    - serving
    kind: Service
    plural: services
    shortNames:
    - kservice
    - ksvc
    singular: service
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: activator
  name: activator-service
  namespace: knative-serving
spec:
  ports:
  - name: http
    nodePort: null
    port: 80
    protocol: TCP
    targetPort: 8080
  - name: metrics
    nodePort: null
    port: 9090
    protocol: TCP
    targetPort: 9090
  selector:
    app: activator
  type: ClusterIP

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: controller
  name: controller
  namespace: knative-serving
spec:
  ports:
  - name: metrics
    port: 9090
    protocol: TCP
    targetPort: 9090
  selector:
    app: controller

---
apiVersion: v1
kind: Service
metadata:
  labels:
    role: webhook
  name: webhook
  namespace: knative-serving
spec:
  ports:
  - port: 443
    targetPort: 443
  selector:
    role: webhook

---
apiVersion: caching.internal.knative.dev/v1alpha1
kind: Image
metadata:
  name: queue-proxy
  namespace: knative-serving
spec:
  image: gcr.io/knative-releases/github.com/knative/serving/cmd/queue@sha256:fc49125cb29f7bb2de2c4d6bd51153ce190cb522cf42df59898147d2074885cc
---
apiVersion: caching.internal.knative.dev/v1alpha1
kind: Image
metadata:
  name: fluentd-sidecar
  namespace: knative-serving
spec:
  image: k8s.gcr.io/fluentd-elasticsearch:v2.0.4

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: activator
  namespace: knative-serving
spec:
  replicas: 1
  selector:
    matchLabels:
      app: activator
      role: activator
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true"
      labels:
        app: activator
        role: activator
    spec:
      containers:
      - args:
        - -logtostderr=false
        - -stderrthreshold=FATAL
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: gcr.io/knative-releases/github.com/knative/serving/cmd/activator@sha256:8d1696bb0e5fe143b0cb273f169b1f2841f71e48490247b8cad35bc65b2b2d6e
        name: activator
        ports:
        - containerPort: 8080
          name: activator-port
        - containerPort: 9090
          name: metrics-port
        resources:
          limits:
            cpu: 200m
            memory: 600Mi
          requests:
            cpu: 20m
            memory: 60Mi
        volumeMounts:
        - mountPath: /etc/config-logging
          name: config-logging
        - mountPath: /etc/config-observability
          name: config-observability
      serviceAccountName: controller
      volumes:
      - configMap:
          name: config-logging
        name: config-logging
      - configMap:
          name: config-observability
        name: config-observability

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: autoscaler
  name: autoscaler
  namespace: knative-serving
spec:
  ports:
  - name: http
    port: 8080
    protocol: TCP
    targetPort: 8080
  - name: metrics
    port: 9090
    protocol: TCP
    targetPort: 9090
  selector:
    app: autoscaler

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: autoscaler
  namespace: knative-serving
spec:
  replicas: 1
  selector:
    matchLabels:
      app: autoscaler
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true"
      labels:
        app: autoscaler
    spec:
      containers:
      - image: gcr.io/knative-releases/github.com/knative/serving/cmd/autoscaler@sha256:9d2db2ba2607b46af18a79c7cdf532d84b0aac34c1a418d6d4a239f8d8271566
        name: autoscaler
        ports:
        - containerPort: 8080
          name: websocket
        - containerPort: 9090
          name: metrics
        resources:
          limits:
            cpu: 300m
            memory: 400Mi
          requests:
            cpu: 30m
            memory: 40Mi
        volumeMounts:
        - mountPath: /etc/config-autoscaler
          name: config-autoscaler
        - mountPath: /etc/config-logging
          name: config-logging
        - mountPath: /etc/config-observability
          name: config-observability
      serviceAccountName: controller
      volumes:
      - configMap:
          name: config-autoscaler
        name: config-autoscaler
      - configMap:
          name: config-logging
        name: config-logging
      - configMap:
          name: config-observability
        name: config-observability

---
apiVersion: v1
data:
  container-concurrency-target-default: "100"
  container-concurrency-target-percentage: "1.0"
  enable-scale-to-zero: "true"
  enable-vertical-pod-autoscaling: "false"
  max-scale-up-rate: "10"
  panic-window: 6s
  scale-to-zero-grace-period: 30s
  stable-window: 60s
  tick-interval: 2s
kind: ConfigMap
metadata:
  name: config-autoscaler
  namespace: knative-serving

---
apiVersion: v1
data:
  queueSidecarImage: gcr.io/knative-releases/github.com/knative/serving/cmd/queue@sha256:fc49125cb29f7bb2de2c4d6bd51153ce190cb522cf42df59898147d2074885cc
  registriesSkippingTagResolving: ko.local,dev.local
kind: ConfigMap
metadata:
  name: config-controller
  namespace: knative-serving

---
apiVersion: v1
data:
  example.com: ""
kind: ConfigMap
metadata:
  name: config-domain
  namespace: knative-serving

---
apiVersion: v1
data:
  stale-revision-create-delay: 24h
  stale-revision-lastpinned-debounce: 5h
  stale-revision-minimum-generations: "1"
  stale-revision-timeout: 15h
kind: ConfigMap
metadata:
  name: config-gc
  namespace: knative-serving

---
apiVersion: v1
data:
  gateway.knative-ingress-gateway: istio-ingressgateway.istio-system.svc.cluster.local
  gateway.knative-shared-gateway: knative-ingressgateway.istio-system.svc.cluster.local
  local-gateway.cluster-local-gateway: cluster-local-gateway.istio-system.svc.cluster.local
kind: ConfigMap
metadata:
  name: config-istio
  namespace: knative-serving

---
apiVersion: v1
data:
  loglevel.activator: info
  loglevel.autoscaler: info
  loglevel.controller: info
  loglevel.queueproxy: info
  loglevel.webhook: info
  zap-logger-config: |
    {
      "level": "info",
      "development": false,
      "outputPaths": ["stdout"],
      "errorOutputPaths": ["stderr"],
      "encoding": "json",
      "encoderConfig": {
        "timeKey": "ts",
        "levelKey": "level",
        "nameKey": "logger",
        "callerKey": "caller",
        "messageKey": "msg",
        "stacktraceKey": "stacktrace",
        "lineEnding": "",
        "levelEncoder": "",
        "timeEncoder": "iso8601",
        "durationEncoder": "",
        "callerEncoder": ""
      }
    }
kind: ConfigMap
metadata:
  name: config-logging
  namespace: knative-serving

---
apiVersion: v1
data:
  istio.sidecar.includeOutboundIPRanges: '*'
kind: ConfigMap
metadata:
  name: config-network
  namespace: knative-serving

---
apiVersion: v1
data:
  logging.enable-var-log-collection: "false"
  logging.fluentd-sidecar-image: k8s.gcr.io/fluentd-elasticsearch:v2.0.4
  logging.fluentd-sidecar-output-config: |
    # Parse json log before sending to Elastic Search
    <filter **>
      @type parser
      key_name log
      <parse>
        @type multi_format
        <pattern>
          format json
          time_key fluentd-time # fluentd-time is reserved for structured logs
          time_format %Y-%m-%dT%H:%M:%S.%NZ
        </pattern>
        <pattern>
          format none
          message_key log
        </pattern>
      </parse>
    </filter>
    # Send to Elastic Search
    <match **>
      @id elasticsearch
      @type elasticsearch
      @log_level info
      include_tag_key true
      # Elasticsearch service is in monitoring namespace.
      host elasticsearch-logging.knative-monitoring
      port 9200
      logstash_format true
      <buffer>
        @type file
        path /var/log/fluentd-buffers/kubernetes.system.buffer
        flush_mode interval
        retry_type exponential_backoff
        flush_thread_count 2
        flush_interval 5s
        retry_forever
        retry_max_interval 30
        chunk_limit_size 2M
        queue_limit_length 8
        overflow_action block
      </buffer>
    </match>
  logging.revision-url-template: |
    http://localhost:8001/api/v1/namespaces/knative-monitoring/services/kibana-logging/proxy/app/kibana#/discover?_a=(query:(match:(kubernetes.labels.knative-dev%2FrevisionUID:(query:'${REVISION_UID}',type:phrase))))
  metrics.backend-destination: prometheus
kind: ConfigMap
metadata:
  name: config-observability
  namespace: knative-serving

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: controller
  namespace: knative-serving
spec:
  replicas: 1
  selector:
    matchLabels:
      app: controller
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
      labels:
        app: controller
    spec:
      containers:
      - image: gcr.io/knative-releases/github.com/knative/serving/cmd/controller@sha256:5a5a0d5fffe839c99fc8f18ba028375467fdcd83cbee9c7015c1a58d01ca6929
        name: controller
        ports:
        - containerPort: 9090
          name: metrics
        resources:
          limits:
            cpu: 1000m
            memory: 1000Mi
          requests:
            cpu: 100m
            memory: 100Mi
        volumeMounts:
        - mountPath: /etc/config-logging
          name: config-logging
      serviceAccountName: controller
      volumes:
      - configMap:
          name: config-logging
        name: config-logging

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: webhook
  namespace: knative-serving
spec:
  replicas: 1
  selector:
    matchLabels:
      app: webhook
      role: webhook
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
      labels:
        app: webhook
        role: webhook
    spec:
      containers:
      - image: gcr.io/knative-releases/github.com/knative/serving/cmd/webhook@sha256:4a91a1991db282ea62426023bae4ae3ea331b10e2b4ac20f4581afdd90c6bdce
        name: webhook
        resources:
          limits:
            cpu: 200m
            memory: 200Mi
          requests:
            cpu: 20m
            memory: 20Mi
        volumeMounts:
        - mountPath: /etc/config-logging
          name: config-logging
      serviceAccountName: controller
      volumes:
      - configMap:
          name: config-logging
        name: config-logging

---