config.yaml

plank:
  job_url_template: 'https://prow.build-infra.jetstack.net/view/jetstack-logs/{{if eq .Spec.Type "presubmit"}}pr-logs/pull{{else if eq .Spec.Type "batch"}}pr-logs/pull{{else}}logs{{end}}{{if .Spec.Refs}}{{if ne .Spec.Refs.Org ""}}/{{.Spec.Refs.Org}}_{{.Spec.Refs.Repo}}{{end}}{{end}}{{if eq .Spec.Type "presubmit"}}/{{with index .Spec.Refs.Pulls 0}}{{.Number}}{{end}}{{else if eq .Spec.Type "batch"}}/batch{{end}}/{{.Spec.Job}}/{{.Status.BuildID}}/'
  report_templates:
    '*': '[Full PR test history](https://prow.build-infra.jetstack.net/pr-history?org={{.Spec.Refs.Org}}&repo={{.Spec.Refs.Repo}}&pr={{with index .Spec.Refs.Pulls 0}}{{.Number}}{{end}}). [Your PR dashboard](https://jetstack-build-infra.appspot.com/pr/{{with index .Spec.Refs.Pulls 0}}{{.Author}}{{end}}). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#github-issues-for-known-flakes) an [open issue](https://github.com/{{.Spec.Refs.Org}}/{{.Spec.Refs.Repo}}/issues?q=is:issue+is:open) when you hit one in your PR.'
  job_url_prefix_config:
    '*': https://prow.build-infra.jetstack.net/view/
  pod_pending_timeout: 120m
  pod_unscheduled_timeout: 60m
  pod_running_timeout: 48h0m0s
  default_decoration_configs:
    '*':
      timeout: 7200000000000 # 2h
      grace_period: 15000000000 # 15s
      utility_images:
        clonerefs: "gcr.io/k8s-prow/clonerefs:v20210409-985ef5e721"
        initupload: "gcr.io/k8s-prow/initupload:v20210409-985ef5e721"
        entrypoint: "gcr.io/k8s-prow/entrypoint:v20210409-985ef5e721"
        sidecar: "gcr.io/k8s-prow/sidecar:v20210409-985ef5e721"
      gcs_configuration:
        bucket: "jetstack-logs"
        path_strategy: "legacy"
        # Leave this as k/k so that all logs use org_repo in the path
        default_org: "kubernetes"
        default_repo: "kubernetes"
      gcs_credentials_secret: "service-account"

branch-protection:
  allow_disabled_policies: true
  orgs:
    cert-manager:
      protect: true
      required_status_checks:
        contexts:
        - dco
      repos:
        cert-manager:
          required_status_checks:
            contexts:
            - pull-cert-manager-bazel
            - pull-cert-manager-deps
            - pull-cert-manager-chart
            - pull-cert-manager-e2e-v1-23
        website:
          required_status_checks:
            contexts:
            - pull-cert-manager-website-verify
        webhook-example:
          required_status_checks:
            contexts:
            - pull-cert-manager-webhook-example-verify
        trust:
          required_status_checks:
            contexts:
            - pull-cert-manager-trust-verify
            - pull-cert-manager-trust-smoke
sinker:
  resync_period: 1h
  max_prowjob_age: 48h
  max_pod_age: 1h

deck:
  spyglass:
    size_limit: 500000000 # 500MB
    gcs_browser_prefix: https://console.cloud.google.com/storage/browser/
    testgrid_config: gs://k8s-testgrid/config
    testgrid_root: https://testgrid.k8s.io/
    lenses:
    - lens:
        name: metadata
      required_files:
      - started.json|finished.json
    - lens:
        name: buildlog
      required_files:
        - build-log.txt
    - lens:
        name: junit
      required_files:
        - artifacts/junit.*\.xml
    - lens:
        name: coverage
      required_files:
        - artifacts/filtered.cov
      optional_files:
        - artifacts/filtered.html
  tide_update_period: 1s
  rerun_auth_configs:
    '*':
      github_team_ids:
      - 2805308 # cert-manager milestone-maintainers
      github_users:
      - munnerz
      - JoshVanL

prowjob_namespace: default
pod_namespace: test-pods
log_level: info

presets:
- labels:
    preset-service-account: "true"
  env:
  - name: GOOGLE_APPLICATION_CREDENTIALS
    value: /etc/service-account/service-account.json
  volumes:
  - name: service
    secret:
      secretName: service-account
  volumeMounts:
  - name: service
    mountPath: /etc/service-account
    readOnly: true

# docker-in-docker (with images/bootstrap) preset
# NOTE: using this also requires using that image,
# ensuring you run your test under either the ENTRYPOINT or:
# /usr/local/bin/runner my-test-command --foo --bar
# AND setting the following on your PodSpec:
# securityContext:
#   privileged: true
- labels:
    preset-dind-enabled: "true"
  env:
  - name: DOCKER_IN_DOCKER_ENABLED
    value: "true"
  - name: DOCKER_CLI_EXPERIMENTAL
    value: "enabled"
  volumes:
  - name: docker-graph
    emptyDir: {}
  volumeMounts:
  - name: docker-graph
    mountPath: /docker-graph

- labels:
    libvirt-socket: "true"
  volumes:
  - name: var-run-libvirt-libvirt-sock
    hostPath:
      path: /var/run/libvirt/libvirt-sock
      type: Socket
  volumeMounts:
  - name: var-run-libvirt-libvirt-sock
    mountPath: /var/run/libvirt/libvirt-sock

- labels:
    minikube-support: "true"
  volumeMounts:
  - name: var-lib-libvirt
    mountPath: /var/lib/libvirt
  - name: minikube-certs
    mountPath: /var/lib/libvirt/caches/minikube/.minikube/certs
  volumes:
  - name: var-lib-libvirt
    hostPath:
      path: /var/lib/libvirt
      type: Directory
  - name: minikube-certs
    emptyDir: {}
  env:
  - name: MINIKUBE_HOME
    value: /var/lib/libvirt/caches/minikube

- labels:
    minikube-medium: "true"
  env:
  - name: MINIKUBE_CPUS
    value: "4"
  - name: MINIKUBE_MEMORY
    value: "12288"

- labels:
    minikube-small: "true"
  env:
  - name: MINIKUBE_CPUS
    value: "3"
  - name: MINIKUBE_MEMORY
    value: "8192"

# storage / caching presets
- labels:
    preset-bazel-scratch-dir: "true"
  env:
  - name: TEST_TMPDIR
    value: /bazel-scratch/.cache/bazel
  volumes:
  - name: bazel-scratch
    emptyDir: {}
  volumeMounts:
  - name: bazel-scratch
    mountPath: /bazel-scratch/.cache

# Use this preset to cache Go modules and build artifacts on the prow cluster
# nodes nodes.
# This idea is stolen from the Istio Prow configuration.
# You can see how they implemented it in the following PRs:
#  https://github.com/istio/test-infra/pulls?q=is%3Apr+cache
# Additionally configure bazel-gazelle to get Go modules from this cache. See:
#  https://github.com/bazelbuild/bazel-gazelle/blob/136915ee0ab40b6cf6461670bf2a1a04b0929d66/repository.rst#go_repository
- labels:
    preset-bazel-go-cache: "true"
  env:
  - name: GO_REPOSITORY_USE_HOST_CACHE
    value: "1"
  volumes:
  - name: go-cache
    hostPath:
      path: /var/tmp/prow/cache/go/pkg
      type: DirectoryOrCreate
  volumeMounts:
  - name: go-cache
    mountPath: /home/prow/go/pkg

- labels:
    preset-bazel-remote-cache-enabled: "true"
  volumes:
  - name: bazel-cache-credentials
    secret:
      secretName: bazel-cache-credentials
  volumeMounts:
  - name: bazel-cache-credentials
    mountPath: /etc/bazel-cache-credentials
    readOnly: true
  env:
  - name: BAZEL_REMOTE_CACHE_ENABLED
    value: "true"
  - name: BAZEL_CACHE_CREDENTIALS
    value: /etc/bazel-cache-credentials/credentials.json

tide:
  pr_status_base_urls:
    '*': https://prow.build-infra.jetstack.net/pr
  squash_label: tide/squash
  queries:
  # Default tide config for all repos in the cert-manager org
  - orgs:
    - cert-manager
    labels:
    - lgtm
    - approved
    - "dco-signoff: yes"
    missingLabels:
    - do-not-merge
    - do-not-merge/blocked-paths
    - do-not-merge/cherry-pick-not-approved
    - do-not-merge/hold
    - do-not-merge/invalid-owners-file
    - do-not-merge/work-in-progress
    - needs-rebase
  # cert-manager/cert-manager is the only repo in the cert-manager org which
  # currently uses the release-note plugin so we duplicate the organization
  # query parameters here and add the do-not-merge/release-note-label-needed to
  # the list of labels which block a PR from being merged.
  # TODO: Find out whether the org-wide defaults are added to the repo specific
  # query fields here, in which case the fields can be de-duplicated.
  - repos:
    - cert-manager/cert-manager
    labels:
    - lgtm
    - approved
    - "dco-signoff: yes"
    missingLabels:
    - do-not-merge
    - do-not-merge/blocked-paths
    - do-not-merge/cherry-pick-not-approved
    - do-not-merge/hold
    - do-not-merge/invalid-owners-file
    - do-not-merge/work-in-progress
    - needs-rebase
    - needs-kind
    - do-not-merge/release-note-label-needed
  # Repositories that enable the release-notes plugin (except cert-manager)
  - repos:
    - jetstack/tarmak
    - jetstack/kube-oidc-proxy
    - jetstack/version-checker
    labels:
    - lgtm
    - approved
    - "dco-signoff: yes"
    missingLabels:
    - do-not-merge
    - do-not-merge/blocked-paths
    - do-not-merge/cherry-pick-not-approved
    - do-not-merge/hold
    - do-not-merge/invalid-owners-file
    - do-not-merge/release-note-label-needed
    - do-not-merge/work-in-progress
    - needs-rebase
  # Maintain separate testing configuration as PRs in this repo don't need release note
  - repos:
    - jetstack/testing
    labels:
    - lgtm
    - approved
    - "dco-signoff: yes"
    missingLabels:
    - do-not-merge
    - do-not-merge/blocked-paths
    - do-not-merge/cherry-pick-not-approved
    - do-not-merge/hold
    - do-not-merge/invalid-owners-file
    - do-not-merge/work-in-progress
    - needs-rebase
  merge_method:
    jetstack/preflight: squash

# push_gateway:
#   endpoint: pushgateway