.base.yaml

autogen_header: "# THIS FILE IS AUTOGENERATED. See prow/config/README.md"

path_aliases:
  istio: istio.io

node_selector:
  testing: test-pool

auto_max_procs: true

cluster_overrides:
  arm64: prow-arm

env:
- name: BUILD_WITH_CONTAINER
  value: "0"

testgrid_config:
  enabled: true
  alert_email: istio-oncall@googlegroups.com
  num_failures_to_alert: "1"

resources_presets:
  default:
    limits:
      cpu: 3000m
      memory: 24Gi
    requests:
      cpu: 1000m
      memory: 3Gi

requirements: [cache]
requirement_presets:
  kind:
    volumeMounts:
    - mountPath: /lib/modules
      name: modules
      readOnly: true
    - mountPath: /sys/fs/cgroup
      name: cgroup
      readOnly: true
    - mountPath: /var/lib/docker
      name: docker-root
    volumes:
    - hostPath:
        path: /lib/modules
        type: Directory
      name: modules
    - hostPath:
        path: /sys/fs/cgroup
        type: Directory
      name: cgroup
    - emptyDir: {}
      name: docker-root
  docker:
    volumeMounts:
    - mountPath: /var/lib/docker
      name: docker-root
    volumes:
    - emptyDir: {}
      name: docker-root
  cache:
    volumeMounts:
    - mountPath: /home/prow/go/pkg
      name: build-cache
      subPath: gomod
    volumes:
    - hostPath:
        path: /var/tmp/prow/cache
        type: DirectoryOrCreate
      name: build-cache
  gocache:
    volumeMounts:
    - mountPath: /gocache
      name: build-cache
      subPath: gocache
    volumes:
    - hostPath:
        path: /var/tmp/prow/cache
        type: DirectoryOrCreate
      name: build-cache
  cratescache:
    # Rust quite expensive to compile and benefits from faster CPUs.
    # Additionally, its jobs are not super common, minimizing cache sharing when spread across all nodes.
    # Prefer the "C3" nodes, which are faster. Since that cuts down the number of nodes we prefer, it results in better caching too.
    podSpec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 1
            preference:
              matchExpressions:
                - key: cloud.google.com/machine-family
                  operator: In
                  values: [c3]
    volumeMounts:
    - mountPath: /home/.cargo
      name: build-cache
      subPath: cargo
    volumes:
    - hostPath:
        path: /var/tmp/prow/cache
        type: DirectoryOrCreate
      name: build-cache
  rustccache:
    env:
    - name: RUST_CACHE_DIR
      value: /var/run/rustc-cache
    volumeMounts:
    - mountPath: /var/run/rustc-cache
      name: build-cache # Depends on 'cratescache' to define the volume
      subPath: rustc

  # Access to istio-testing GitHub, with `admin:org`.
  # Highly privileged, should only be used from istio/community.
  # TODO: move to GCP Secrets
  github-organization:
    volumeMounts:
    - mountPath: /etc/github-token
      name: github
      readOnly: true
    volumes:
    - name: github
      secret:
        secretName: oauth-token
  # Access to anonymous readonly GitHub.
  github-readonly:
    podSpec:
      serviceAccountName: prowjob-github-read
    secrets:
      - secret: github-read_github_read
        project: istio-prow-build
        env: GH_TOKEN
  # Access to push GitHub from 'istio-testing' account.
  github-istio-testing:
    podSpec:
      serviceAccountName: prowjob-github-istio-testing
    secrets:
      - secret: github_istio-testing_pusher
        project: istio-prow-build
        env: GH_TOKEN
  # build-base has access to push to dockerhub and to push as istio-testing github. Only for use with base image building
  build-base:
    env:
    - name: DOCKER_CONFIG
      value: /var/run/ci/docker
    podSpec:
      serviceAccountName: prowjob-release
    secrets:
      - secret: release_docker_istio
        project: istio-prow-build
        file: /var/run/ci/docker/config.json
      - secret: github_istio-testing_pusher # Note: This is NOT "release_github_istio-release", which is why this is separate from 'releae'
        project: istio-prow-build
        env: GH_TOKEN
  # release is used for release jobs. This is the most privileged type of job.
  release:
    # For publish, we also need Grafana token, DockerHub token, and GitHub login
    podSpec:
      serviceAccountName: prowjob-release
    env:
      - name: COSIGN_KEY
        value: "gcpkms://projects/istio-prow-build/locations/global/keyRings/istio-cosign-keyring/cryptoKeys/istio-cosign-key/versions/1"
      - name: DOCKER_CONFIG
        value: /var/run/ci/docker
      - name: GRAFANA_TOKEN_FILE
        value: /var/run/ci/grafana/token
      - name: GITHUB_TOKEN_FILE
        value: /var/run/ci/github/token
    secrets:
      - secret: release_docker_istio
        project: istio-prow-build
        file: /var/run/ci/docker/config.json
      - secret: release_github_istio-release
        project: istio-prow-build
        file: /var/run/ci/github/token
      - secret: release_grafana_istio
        project: istio-prow-build
        file: /var/run/ci/grafana/token
  # If enabled, jobs will report traces to GCP Cloud Trace
  tracing:
    env:
    - name: OTEL_EXPORTER_OTLP_PROTOCOL
      value: grpc
    - name: OTEL_EXPORTER_OTLP_ENDPOINT
      value: http://collector.opentelemetry:4317
    - name: OTEL_EXPORTER_OTLP_INSECURE
      value: "true"