config.yaml

plank:
  job_url_template: '{{if .Spec.Refs}}{{if eq .Spec.Refs.Org "kubernetes-security"}}https://console.cloud.google.com/storage/browser/kubernetes-security-prow/{{else}}https://gubernator.k8s.io/build/kubernetes-jenkins/{{end}}{{else}}https://gubernator.k8s.io/build/kubernetes-jenkins/{{end}}{{if eq .Spec.Type "presubmit"}}pr-logs/pull{{else if eq .Spec.Type "batch"}}pr-logs/pull{{else}}logs{{end}}{{if .Spec.Refs}}{{if ne .Spec.Refs.Org ""}}{{if ne .Spec.Refs.Org "kubernetes"}}/{{if and (eq .Spec.Refs.Org "kubernetes-sigs") (ne .Spec.Refs.Repo "poseidon")}}sigs.k8s.io{{else}}{{.Spec.Refs.Org}}{{end}}_{{.Spec.Refs.Repo}}{{else if ne .Spec.Refs.Repo "kubernetes"}}/{{.Spec.Refs.Repo}}{{end}}{{end}}{{end}}{{if eq .Spec.Type "presubmit"}}/{{with index .Spec.Refs.Pulls 0}}{{.Number}}{{end}}{{else if eq .Spec.Type "batch"}}/batch{{end}}/{{.Spec.Job}}/{{.Status.BuildID}}/'
  report_template: '[Full PR test history](https://gubernator.k8s.io/pr/{{if eq .Spec.Refs.Org "kubernetes"}}{{if eq .Spec.Refs.Repo "kubernetes"}}{{else}}{{.Spec.Refs.Repo}}/{{end}}{{else}}{{.Spec.Refs.Org}}_{{.Spec.Refs.Repo}}/{{end}}{{with index .Spec.Refs.Pulls 0}}{{.Number}}{{end}}). [Your PR dashboard](https://gubernator.k8s.io/pr/{{with index .Spec.Refs.Pulls 0}}{{.Author}}{{end}}). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/{{.Spec.Refs.Org}}/{{.Spec.Refs.Repo}}/issues?q=is:issue+is:open) when you hit one in your PR.'
  job_url_prefix: https://gubernator.k8s.io/build/
  pod_pending_timeout: 60m
  default_decoration_config:
    timeout: 7200000000000 # 2h
    grace_period: 15000000000 # 15s
    utility_images:
      clonerefs: "gcr.io/k8s-prow/clonerefs:v20181129-31c544b"
      initupload: "gcr.io/k8s-prow/initupload:v20181129-31c544b"
      entrypoint: "gcr.io/k8s-prow/entrypoint:v20181129-31c544b"
      sidecar: "gcr.io/k8s-prow/sidecar:v20181129-31c544b"
    gcs_configuration:
      bucket: "kubernetes-jenkins"
      path_strategy: "legacy"
      default_org: "kubernetes"
      default_repo: "kubernetes"
    gcs_credentials_secret: "service-account"

sinker:
  resync_period: 1m
  max_prowjob_age: 48h
  max_pod_age: 30m

deck:
  spyglass:
    size_limit: 500000000 # 500MB
    viewers:
      # TODO(Katharine, #10274): These names are deprecated, rename after deploy.
      "started.json|finished.json":
      - "metadata-viewer"
      "build-log.txt":
      - "build-log-viewer"
      "artifacts/junit.*\\.xml":
      - "junit-viewer"
  tide_update_period: 1s
  hidden_repos:
  - kubernetes-security

prowjob_namespace: default
pod_namespace: test-pods
log_level: debug

branch-protection:
  allow_disabled_policies: true  # TODO(fejta): remove, needed by k/website
  orgs:
    kubernetes:
      protect: true
      required_status_checks:
        contexts:
        - cla/linuxfoundation
      repos:
        api:
          restrictions:
            users: []
            teams:
            - stage-bots
        apiextensions-apiserver:
          restrictions:
            users: []
            teams:
            - stage-bots
        apimachinery:
          restrictions:
            users: []
            teams:
            - stage-bots
        apiserver:
          restrictions:
            users: []
            teams:
            - stage-bots
        client-go:
          restrictions:
            users: []
            teams:
            - stage-bots
        cli-runtime:
          restrictions:
            users: []
            teams:
            - stage-bots
        cloud-provider:
          restrictions:
            users: []
            teams:
            - stage-bots
        cluster-bootstrap:
          restrictions:
            users: []
            teams:
            - stage-bots
        code-generator:
          restrictions:
            users: []
            teams:
            - stage-bots
        dashboard:
          required_pull_request_reviews:
            required_approving_review_count: 1
        dns:
          required_status_checks:
            strict: true
            contexts:
            - continuous-integration/travis-ci
          required_pull_request_reviews:
            required_approving_review_count: 1
        git-sync:
          enforce_admins: true
          required_status_checks:
            strict: true
          restrictions: # only allow admins
            users: []
            teams: []
        kompose:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
          required_pull_request_reviews:
            required_approving_review_count: 1
        kubectl:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
        kubelet:
          restrictions:
            users: []
            teams:
            - stage-bots
        kubernetes:
          restrictions: # only allow admins
            users: []
            teams: []
        kube-aggregator:
          restrictions:
            users: []
            teams:
            - stage-bots
        kube-controller-manager:
          restrictions:
            users: []
            teams:
            - stage-bots
        kube-proxy:
          restrictions:
            users: []
            teams:
            - stage-bots
        kube-scheduler:
          restrictions:
            users: []
            teams:
            - stage-bots
        metrics:
          restrictions:
            users: []
            teams:
            - stage-bots
        node-api:
          restrictions:
            users: []
            teams:
            - stage-bots
        org:
          restrictions: # only allow admins
            users: []
            teams: []
        repo-infra:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
        sample-apiserver:
          restrictions:
            users: []
            teams:
            - stage-bots
        sample-cli-plugin:
          restrictions:
            users: []
            teams:
            - stage-bots
        sample-controller:
          restrictions:
            users: []
            teams:
            - stage-bots
        utils:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
        website:
          protect: false # TODO(fejta): protect all branches soon
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
          branches:
            master:
              protect: true
            release-1.4:
              protect: true
            release-1.5:
              protect: true
            release-1.6:
              protect: true
            release-1.7:
              protect: true
            release-1.8:
              protect: true
            release-1.9:
              protect: true
    kubernetes-client:
      protect: true
      required_status_checks:
        contexts:
        - cla/linuxfoundation
      repos:
        python:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
        python-base:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
    kubernetes-csi:
      protect: true
      required_status_checks:
        contexts:
        - cla/linuxfoundation
      repos:
        csi-test:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
        drivers:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
        external-attacher:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
        external-provisioner:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
        external-snapshotter:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
        livenessprobe:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
    kubernetes-incubator:
      protect: true
      required_status_checks:
        contexts:
        - cla/linuxfoundation
      repos:
        apiserver-builder:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
        bootkube:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
        cluster-proportional-autoscaler:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
        external-storage:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
        kube-aws:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
        metrics-server:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
    kubernetes-sigs:
      protect: true
      required_status_checks:
        contexts:
        - cla/linuxfoundation
      repos:
        kube-batch:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci
        kubespray:
          required_status_checks:
            contexts:
            - Kubespray CI Pipeline
        node-feature-discovery:
          required_status_checks:
            contexts:
            - continuous-integration/travis-ci

tide:
  queries:
  - orgs:
    - kubeflow
    labels:
    - lgtm
    - approved
    missingLabels:
    - do-not-merge
    - do-not-merge/hold
    - do-not-merge/invalid-owners-file
    - do-not-merge/work-in-progress
    - needs-rebase
  - repos:
    - helm/charts
    labels:
    - lgtm
    - approved
    - "Contribution Allowed"
    missingLabels:
    - do-not-merge
    - do-not-merge/blocked-paths
    - do-not-merge/cherry-pick-not-approved
    - do-not-merge/hold
    - do-not-merge/invalid-owners-file
    - do-not-merge/release-note-label-needed
    - do-not-merge/work-in-progress
    - needs-rebase
  - orgs:
    - kubernetes-client
    - kubernetes-csi
    - kubernetes-incubator
    - kubernetes-sigs
    repos:
    - client-go/unofficial-docs
    - kubernetes/autoscaler
    - kubernetes/client-go
    - kubernetes/cloud-provider-aws
    - kubernetes/cloud-provider-alibaba-cloud
    - kubernetes/cloud-provider-azure
    - kubernetes/cloud-provider-gcp
    - kubernetes/cloud-provider-openstack
    - kubernetes/cloud-provider-vsphere
    - kubernetes/cluster-registry
    - kubernetes/community
    - kubernetes/contrib
    - kubernetes/dashboard
    - kubernetes/dns
    - kubernetes/enhancements
    - kubernetes/examples
    - kubernetes/federation
    - kubernetes/frakti
    - kubernetes/gengo
    - kubernetes/git-sync
    - kubernetes/heapster
    - kubernetes/ingress-gce
    - kubernetes/ingress-nginx
    - kubernetes/k8s.io
    - kubernetes/klog
    - kubernetes/komposer
    - kubernetes/kops
    - kubernetes/kube-deploy
    - kubernetes/kube-openapi
    - kubernetes/kube-state-metrics
    - kubernetes/kubeadm
    - kubernetes/kubectl
    - kubernetes/kubernetes-anywhere
    - kubernetes/kubernetes-template-project
    - kubernetes/minikube
    - kubernetes/node-problem-detector
    - kubernetes/org
    - kubernetes/perf-tests
    - kubernetes/publishing-bot
    - kubernetes/release
    - kubernetes/repo-infra
    - kubernetes/sig-release
    - kubernetes/steering
    - kubernetes/test-infra
    - kubernetes/utils
    - kubernetes/website
    labels:
    - lgtm
    - approved
    - "cncf-cla: yes"
    missingLabels:
    - do-not-merge
    - do-not-merge/blocked-paths
    - do-not-merge/cherry-pick-not-approved
    - do-not-merge/hold
    - do-not-merge/invalid-owners-file
    - do-not-merge/release-note-label-needed
    - do-not-merge/work-in-progress
    - needs-rebase
  - repos:
    - kubernetes/kubernetes
    labels:
    - lgtm
    - approved
    - "cncf-cla: yes"
    missingLabels:
    - do-not-merge
    - do-not-merge/blocked-paths
    - do-not-merge/cherry-pick-not-approved
    - do-not-merge/hold
    - do-not-merge/invalid-owners-file
    - do-not-merge/release-note-label-needed
    - do-not-merge/work-in-progress
    - needs-kind
    - needs-rebase
    - needs-sig
  merge_method:
    helm/charts: squash
    kubeflow: squash
    kubernetes-client/csharp: squash
    kubernetes-client/gen: squash
    kubernetes-incubator/service-catalog: squash
    kubernetes-sigs/cluster-api-provider-aws: squash
    kubernetes-sigs/cluster-api-provider-digitalocean: squash
    kubernetes-sigs/cluster-api-provider-gcp: squash
    kubernetes-sigs/cluster-api-provider-openstack: squash
    kubernetes-sigs/cluster-api-provider-vsphere: squash
    kubernetes-sigs/cluster-api: squash
    kubernetes-sigs/kubespray: squash
    kubernetes/dashboard: squash
    kubernetes/kube-deploy: squash
    kubernetes/website: squash
  pr_status_base_url: https://prow.k8s.io/pr
  blocker_label: merge-blocker
  squash_label: tide/squash
  context_options:
    optional-contexts:
    - "Submit Queue"

push_gateway:
  endpoint: pushgateway


presets:
# credential presets
- labels:
    preset-service-account: "true"
  env:
  - name: GOOGLE_APPLICATION_CREDENTIALS
    value: /etc/service-account/service-account.json
  # storage e2e tests borrow this as a preconfigured key instead of creating and
  # injecting a new key. this allows us to avoid mass key download warnings
  - name: E2E_GOOGLE_APPLICATION_CREDENTIALS
    value: /etc/service-account/service-account.json
  volumes:
  - name: service
    secret:
      secretName: service-account
  volumeMounts:
  - name: service
    mountPath: /etc/service-account
    readOnly: true
- labels:
    preset-gke-alpha-service: "true"
  env:
  - name: GOOGLE_APPLICATION_CREDENTIALS
    value: /etc/service-account/service-account.json
  # storage e2e tests borrow this as a preconfigured key instead of creating and
  # injecting a new key. this allows us to avoid mass key download warnings
  - name: E2E_GOOGLE_APPLICATION_CREDENTIALS
    value: /etc/service-account/service-account.json
  volumes:
  - name: service
    secret:
      secretName: gke-alpha-service-account
  volumeMounts:
  - name: service
    mountPath: /etc/service-account
    readOnly: true
- labels:
    preset-istio-service: "true"
  env:
  - name: GOOGLE_APPLICATION_CREDENTIALS
    value: /etc/service-account/istio-service-account.json
  # storage e2e tests borrow this as a preconfigured key instead of creating and
  # injecting a new key. this allows us to avoid mass key download warnings
  - name: E2E_GOOGLE_APPLICATION_CREDENTIALS
    value: /etc/service-account/service-account.json
  volumes:
  - name: service
    secret:
      secretName: istio-service-account
  volumeMounts:
  - name: service
    mountPath: /etc/service-account
    readOnly: true
- labels:
    preset-k8s-ssh: "true"
  env:
  - name: USER
    value: prow
  - name: JENKINS_GCE_SSH_PRIVATE_KEY_FILE
    value: /etc/ssh-key-secret/ssh-private
  - name: JENKINS_GCE_SSH_PUBLIC_KEY_FILE
    value: /etc/ssh-key-secret/ssh-public
  volumes:
  - name: ssh
    secret:
      defaultMode: 0400
      secretName: ssh-key-secret
  volumeMounts:
  - name: ssh
    mountPath: /etc/ssh-key-secret
    readOnly: true
- labels:
    preset-aws-ssh: "true"
  env:
  - name: USER
    value: prow
  - name: JENKINS_AWS_SSH_PRIVATE_KEY_FILE
    value: /etc/aws-ssh/aws-ssh-private
  - name: JENKINS_AWS_SSH_PUBLIC_KEY_FILE
    value: /etc/aws-ssh/aws-ssh-public
  volumes:
  - name: aws-ssh
    secret:
      defaultMode: 0400
      secretName: aws-ssh-key-secret
  volumeMounts:
  - name: aws-ssh
    mountPath: /etc/aws-ssh
    readOnly: true
- labels:
    preset-aws-credential: "true"
  env:
  - name: JENKINS_AWS_CREDENTIALS_FILE
    value: /etc/aws-cred/credentials
  volumes:
  - name: aws-cred
    secret:
      defaultMode: 0400
      secretName: aws-cred-new
  volumeMounts:
  - name: aws-cred
    mountPath: /etc/aws-cred
    readOnly: true
# storage / caching presets
- labels:
    preset-bazel-scratch-dir: "true"
  env:
  - name: TEST_TMPDIR
    value: /bazel-scratch/.cache/bazel
  volumes:
  - name: bazel-scratch
    emptyDir: {}
  volumeMounts:
  - name: bazel-scratch
    mountPath: /bazel-scratch/.cache
- labels:
    preset-bazel-remote-cache-enabled: "true"
  env:
  - name: BAZEL_REMOTE_CACHE_ENABLED
    value: "true"
# docker-in-docker (with images/bootstrap) preset
# NOTE: using this also requires using that image,
# ensuring you run your test under either the ENTRYPOINT or:
# /usr/local/bin/runner my-test-command --foo --bar
# AND setting the following on your PodSpec:
# securityContext:
#   privileged: true
- labels:
    preset-dind-enabled: "true"
  env:
  - name: DOCKER_IN_DOCKER_ENABLED
    value: "true"
  volumes:
  - name: docker-graph
    emptyDir: {}
  volumeMounts:
  - name: docker-graph
    mountPath: /docker-graph
# experimental preset for dind, prefer the one above
- labels:
    preset-dind-memory-backed: "true"
  env:
  - name: DOCKER_IN_DOCKER_ENABLED
    value: "true"
  volumes:
  - name: docker-graph
    emptyDir:
      medium: "Memory"
  volumeMounts:
  - name: docker-graph
    mountPath: /docker-graph