config.yaml

prowjob_namespace: default
pod_namespace: default
decorate_all_jobs: true

plank:
  job_url_prefix_config:
    "*": https://status.build.kyma-project.io/view/
  report_templates:
    "*": >-
      [Full PR test history](https://status.build.kyma-project.io/pr-history?org={{.Spec.Refs.Org}}&repo={{.Spec.Refs.Repo}}&pr={{with index .Spec.Refs.Pulls 0}}{{.Number}}{{end}}).
      [Your PR dashboard](https://status.build.kyma-project.io/pr?query=is:pr+state:open+author:{{with
      index .Spec.Refs.Pulls 0}}{{.Author}}{{end}}).
  max_concurrency: 100 # Limit of concurrent ProwJobs. Need to be adjusted depending of the cluster size.
  pod_pending_timeout: 60m
  default_decoration_config_entries:
    - config:
        timeout: 3h
        grace_period: 10m
        censor_secrets: true
        censoring_options:
          censoring_concurrency: 2 # 2 concurrent censoring
          censoring_buffer_size: 3092 # 3kB
        utility_images:
          clonerefs: gcr.io/k8s-prow/clonerefs:v20240805-37a08f946
          initupload: gcr.io/k8s-prow/initupload:v20240805-37a08f946
          entrypoint: gcr.io/k8s-prow/entrypoint:v20240805-37a08f946
          sidecar: gcr.io/k8s-prow/sidecar:v20240805-37a08f946
        resources:
          clonerefs:
            requests:
              cpu: 100m
              memory: 250Mi
            limits:
              cpu: 100m
              memory: 250Mi
          initupload:
            requests:
              cpu: 100m
              memory: 250Mi
            limits:
              cpu: 100m
              memory: 250Mi
          place_entrypoint:
            requests:
              cpu: 100m
              memory: 250Mi
            limits:
              cpu: 100m
              memory: 250Mi
          sidecar:
            requests:
              cpu: 100m
              memory: 250Mi
            limits:
              cpu: 100m
              memory: 250Mi
        gcs_configuration:
          bucket: kyma-prow-logs
          path_strategy: "explicit"
        gcs_credentials_secret: ""
        default_service_account_name: prowjob-default-sa
    - cluster: "untrusted-workload"
      config:
        gcs_credentials_secret: ""
        default_service_account_name: prowjob-default-sa
    - cluster: "trusted-workload"
      config:
        gcs_credentials_secret: ""
        default_service_account_name: prowjob-default-sa

deck:
  spyglass:
    size_limit: 500000000 # 500MB
    gcs_browser_prefix: https://gcsweb.build.kyma-project.io/gcs/
    lenses:
      - lens:
          name: metadata
        required_files:
          - ^(?:started|finished)\.json$
        optional_files:
          - ^(?:podinfo|prowjob)\.json$
      - lens:
          name: buildlog
          config:
            highlighter:
              endpoint: http://halogen.default.svc.cluster.local
              pin: true
              auto: false
            highlight_regexes:
              - Automatic merge failed
              - cannot convert.+to type
              - "cannot use.+as.+(type|value)"
              - Cluster failed to initialize
              - cluster unreachable
              - "compilepkg: error"
              - configuration error
              - contact Google support
              - could not apply prowjob annotations
              - could not find the referenced.+TestGroup
              - could not write config
              - "couldn't load prow config:"
              - curl.+Failed to connect
              - DATA RACE
              - dirty working directory
              - ^E\d{4} \d\d:\d\d:\d\d\.\d+
              - (Error|ERROR|error)s?(:|\s)
              - Error.+executing benchmarks
              - Expected.+got
              - FAILED. See logs
              - failed to acquire k8s binaries
              - failed to solve
              - (FAIL|Failure \[)\b
              - fatal error
              - flag provided but not defined
              - Full Stack Trace
              - got.+expected
              - hash mismatch
              - Hit an unsupported type
              - imported but not used
              - Incompatible changes
              - incorrect boilerplate
              - indent-error-flow
              - INSTALLATION FAILED
              - is a misspelling
              - LimitExceeded
              - "make:.+Error"
              - Master not detected
              - Merge conflict
              - not enough arguments in call
              - panic\b
              - Previous (write|read)
              - Process did not finish before.+timeout
              - race detected
              - security token.+invalid
              - "signal: killed"
              - Something went wrong
              - too few arguments
              - too many errors
              - "[Tt]imed out"
              - type.+has no field
              - unable to start the controlplane
              - "undefined:"
              - Unfortunately, an error
              - unused.+deadcode
              - "[Uu]nexpected error"
              - verify.+failed
              - want.+got
              - Your cluster may not be fully functional
              - ^\s+\^$
              - \^-- # script validation
              - \[(0;)?31m
              - "^diff " # [+-]{3}\\s" has too much noise from go test output and set -x
              - • Failure
              # This highlights the start of bazel tests/runs to skip go importing noise.
              - "^INFO: Analyzed \\d+ targets"
              - "JobGuard caught error"
              - "Directory vpath is present"
              - '"status": "Vulns"' # protecode guard
              - "command not found"
              - '\[ERROR\]'
              # This highlights prowjobconfigtests failed tests.
              - '\[PJ config test failed\]'
        required_files:
          - ^.*build-log\.txt$
      - lens:
          name: junit
        required_files:
          - ^artifacts(/.*/|/)junit.*\.xml$ # https://regex101.com/r/vCSegS/1
      - lens:
          name: coverage
        required_files:
          - ^artifacts/filtered\.cov$
        optional_files:
          - ^artifacts/filtered\.html$
      - lens:
          name: podinfo
        required_files:
          - ^podinfo\.json$
        optional_files:
          - ^prowjob\.json$
      - lens:
          name: links
        required_files:
          - artifacts/.*\.link\.txt
      - lens:
          name: html
        required_files:
          - ^artifacts/report.*\.html$
  branding:
    header_color: "#0b74de" # Kyma color
    logo: "/static/extensions/logo.svg"
    favicon: "/static/extensions/favicon.png"
  rerun_auth_configs:
    "*":
      github_team_ids:
        - 3108790 # cluster-access GH team in Kyma organization

sinker:
  max_prowjob_age: 168h
  max_pod_age: 5h
  resync_period: 1m
  terminated_pod_ttl: 30m

push_gateway:
  endpoint: pushgateway
  serve_metrics: true

slack_reporter_configs:
  "*":
    job_types_to_report:
      - postsubmit
      - periodic
      - batch
    job_states_to_report:
      - failure
      - error
    channel: kyma-ci-force
    report_template: |
      *Name:* {{.Spec.Job}}
      *Type:* {{.Spec.Type}}
      *Status:* {{.Status.State}}
      {{with .Spec.Refs}}*Repository:* {{.Org}}/{{.Repo}}
      *Commit:* <{{.BaseLink}}|{{printf "%.7s" .BaseSHA}}>
      {{end}}*<{{.Status.URL}}|View logs>*

in_repo_config:
  enabled:
    "*": true
  allowed_clusters:
    "*": ["untrusted-workload"]

presets:
  - labels:
      preset-recreate-cluster: "true"
    env:
      - name: RECREATE_CLUSTER
        value: "true"
  - labels:
      preset-slack-alerts: "true"
    env:
      - name: STABILITY_SLACK_CLIENT_CHANNEL_ID
        value: "#kyma-ci-force"
      - name: KYMA_ALERTS_SLACK_API_URL
        valueFrom:
          secretKeyRef:
            name: kyma-alerts-slack-api-url
            key: secret
      - name: KYMA_ALERTS_CHANNEL
        value: "#kyma-ci-force"
  # cluster version
  - labels:
      preset-cluster-version: "true"
    env:
      - name: AKS_CLUSTER_VERSION
        value: "1.28"
      - name: GKE_CLUSTER_VERSION
        value: "1.28"
  # test clusters log collector
  - labels:
      preset-log-collector-slack-token: "true"
    env:
      - name: LOG_COLLECTOR_SLACK_TOKEN
        valueFrom:
          secretKeyRef:
            name: log-collector-slack-token
            key: token
  - labels:
      preset-certificates-bucket: "true"
    env:
      - name: CERTIFICATES_BUCKET
        value: "kyma-prowjobs-secrets"
  - labels:
      preset-gke-kyma-developers-group: "true"
    env:
      - name: GCLOUD_SECURITY_GROUP
        value: "kyma_developers"
      - name: GCLOUD_SECURITY_GROUP_DOMAIN
        value: "sap.com"
  - labels:
      preset-gc-compute-envs: "true"
    env:
      - name: CLOUDSDK_COMPUTE_REGION
        value: "europe-west4"
  - labels:
      preset-sa-vm-kyma-integration: "true" # Service account with "Compute Admin" and "Compute OS Admin Login" roles
    env:
      - name: GOOGLE_APPLICATION_CREDENTIALS
        value: /etc/credentials/sa-vm-kyma-integration/service-account.json
    volumes:
      - name: sa-vm-kyma-integration
        secret:
          secretName: sa-vm-kyma-integration
      - name: sa-vm-kyma-ssh-key # https://github.com/kyma-project/kyma/issues/10818
        secret:
          secretName: sa-vm-kyma-ssh-key
          defaultMode: 0700
    volumeMounts:
      - name: sa-vm-kyma-integration
        mountPath: /etc/credentials/sa-vm-kyma-integration
        readOnly: true
      - name: sa-vm-kyma-ssh-key
        mountPath: /root/.ssh/user
  - labels:
      preset-sa-gke-kyma-integration: "true"
    env:
      - name: GOOGLE_APPLICATION_CREDENTIALS
        value: /etc/credentials/sa-gke-kyma-integration/service-account.json
      - name: CLOUDSDK_DNS_ZONE_NAME
        value: "build-kyma-workloads" #GCloud DNS Zone Name (NOT it's DNS name!)
      - name: KYMA_PROJECT_DIR
        value: "/home/prow/go/src/github.com/kyma-project"
    volumes:
      - name: sa-gke-kyma-integration
        secret:
          secretName: sa-gke-kyma-integration
    volumeMounts:
      - name: sa-gke-kyma-integration
        mountPath: /etc/credentials/sa-gke-kyma-integration
        readOnly: true
  - labels:
      preset-sa-test-gcr-push: "true" # Service account with write access to test gcr.
    env:
      - name: GCR_PUSH_GOOGLE_APPLICATION_CREDENTIALS
        value: /etc/credentials/sa-test-gcr-push/service-account.json
    volumes:
      - name: sa-test-gcr-push
        secret:
          secretName: sa-gke-kyma-integration
    volumeMounts:
      - name: sa-test-gcr-push
        mountPath: /etc/credentials/sa-test-gcr-push
        readOnly: true
  - labels:
      preset-sa-kyma-push-images: "true"
    env:
      - name: GOOGLE_APPLICATION_CREDENTIALS
        value: /etc/credentials/sa-kyma-push-images/service-account.json
    volumes:
      - name: sa-kyma-push-images
        secret:
          secretName: sa-kyma-push-images
    volumeMounts:
      - name: sa-kyma-push-images
        mountPath: /etc/credentials/sa-kyma-push-images
        readOnly: true
  - labels:
      preset-sa-kyma-artifacts: "true"
    env:
      - name: GOOGLE_APPLICATION_CREDENTIALS
        value: /etc/credentials/sa-kyma-artifacts/service-account.json
    volumes:
      - name: sa-kyma-artifacts
        secret:
          secretName: sa-kyma-artifacts
    volumeMounts:
      - name: sa-kyma-artifacts
        mountPath: /etc/credentials/sa-kyma-artifacts
  - labels:
      preset-sa-prow-job-github-issues: "true"
    env:
      - name: GOOGLE_APPLICATION_CREDENTIALS
        value: /etc/credentials/sa-prow-job-github-issues/service-account.json
    volumes:
      - name: sa-prow-job-github-issues
        secret:
          secretName: sa-prow-job-github-issues
    volumeMounts:
      - name: sa-prow-job-github-issues
        mountPath: /etc/credentials/sa-prow-job-github-issues
        readOnly: true
  - labels:
      preset-az-kyma-prow-credentials: "true"
    env:
      - name: AZURE_CREDENTIALS_FILE
        value: /etc/credentials/az-kyma-prow-credentials/azure-credentials.json
      - name: AZURE_SUBSCRIPTION_ID
        valueFrom:
          secretKeyRef:
            name: kyma-azure-credential-id
            key: subscription-id
    volumes:
      - name: az-kyma-prow-credentials
        secret:
          secretName: az-kyma-prow-credentials
    volumeMounts:
      - name: az-kyma-prow-credentials
        mountPath: /etc/credentials/az-kyma-prow-credentials

  - labels:
      preset-dind-enabled: "true"
    env:
      - name: DOCKER_IN_DOCKER_ENABLED
        value: "true"
    volumes:
      - name: docker-graph
        emptyDir: {}
    volumeMounts:
      - name: docker-graph
        mountPath: /docker-graph
  - labels:
      preset-docker-push-repository-kyma: "true"
    env:
      - name: DOCKER_PUSH_REPOSITORY
        value: "eu.gcr.io/kyma-project"
  - labels:
      preset-docker-push-repository-gke-integration: "true" # Needed for kyma installer image
    env:
      - name: DOCKER_PUSH_REPOSITORY
        value: "eu.gcr.io/sap-kyma-prow-workloads"
  - labels:
      preset-build-pr: "true"
    env:
      - name: BUILD_TYPE
        value: pr
      - name: DOCKER_PUSH_DIRECTORY
        value: "/pr"
  - labels:
      preset-build-main: "true"
    env:
      - name: BUILD_TYPE
        value: master
      - name: DOCKER_PUSH_DIRECTORY
        value: "/develop"
  - labels:
      preset-build-artifacts-main: "true"
    env:
      - name: BUILD_TYPE
        value: master
  - labels:
      preset-build-release: "true"
    env:
      - name: BUILD_TYPE
        value: release
  # Kyma-bot
  - labels:
      preset-bot-github-token: "true"
    env:
      - name: BOT_GITHUB_TOKEN
        valueFrom:
          secretKeyRef:
            name: kyma-bot-github-token
            key: token
      - name: GITHUB_TOKEN
        valueFrom:
          secretKeyRef:
            name: kyma-bot-github-token
            key: token
    volumeMounts:
      - name: kyma-bot-token-path
        mountPath: /etc/github
        readOnly: true
    volumes:
      - name: kyma-bot-token-path
        secret:
          secretName: kyma-bot-github-token
  - labels:
      kyma-bot-github-public-repo-token: "true"
    env:
      - name: GITHUB_TOKEN
        valueFrom:
          secretKeyRef:
            name: kyma-bot-github-public-repo-token
            key: token
    volumeMounts:
      - name: kyma-bot-github-public-repo-token-path
        mountPath: /etc/github
        readOnly: true
    volumes:
      - name: kyma-bot-github-public-repo-token-path
        secret:
          secretName: kyma-bot-github-public-repo-token
  - labels:
      preset-autobump-bot-github-token: "true"
    volumes:
      - name: kyma-autobump-bot-token-path
        secret:
          secretName: kyma-autobump-bot-github-token
    volumeMounts:
      - name: kyma-autobump-bot-token-path
        mountPath: /etc/github
        readOnly: true
  - labels:
      preset-bot-github-sap-token: "true"
    env:
      - name: BOT_GITHUB_SAP_TOKEN
        valueFrom:
          secretKeyRef:
            name: kyma-bot-github-sap-token
            key: token
  # BTP-Manager Bot
  - labels:
      preset-kyma-btp-manager-bot-github-token: "true"
    env:
      - name: BOT_GITHUB_TOKEN
        valueFrom:
          secretKeyRef:
            name: kyma-btp-manager-bot-github-token
            key: token
  - labels:
      preset-kyma-eventing-auth-ias-creds: "true"
    env:
      - name: TEST_EVENTING_AUTH_IAS_URL
        value: "https://tunas.accounts400.ondemand.com"
      - name: TEST_EVENTING_AUTH_IAS_USER
        value: "skydiving-tunas@groups.sap.com"
      - name: TEST_EVENTING_AUTH_IAS_PASSWORD
        valueFrom:
          secretKeyRef:
            name: kyma-eventing-auth-ias-creds
            key: token
  # Kyma Guard Bot
  - labels:
      preset-kyma-guard-bot-github-token: "true"
    env:
      - name: BOT_GITHUB_TOKEN
        valueFrom:
          secretKeyRef:
            name: kyma-guard-bot-github-token
            key: token
    # for new jobguard which does not use env for tokens
    volumes:
      - name: kyma-guard-bot-token-path
        secret:
          secretName: kyma-guard-bot-github-token
    volumeMounts:
      - name: kyma-guard-bot-token-path
        mountPath: /etc/github
        readOnly: true
  - labels:
      preset-kyma-artifacts-bucket: "true"
    env:
      - name: KYMA_ARTIFACTS_BUCKET
        value: gs://kyma-prow-artifacts
  - labels:
      preset-kyma-cli-stable: "true"
    env:
      - name: KYMA_CLI_STABLE_BUCKET
        value: gs://kyma-cli-stable
      - name: STABLE
        value: "true"
  - labels:
      preset-kyma-cli-pr-unstable: "true"
    env:
      - name: KYMA_CLI_PR_UNSTABLE_BUCKET
        value: gs://kyma-cli-pr
      - name: UNSTABLE
        value: "true"
  - labels:
      preset-nightly-github-integration: "true"
    env:
      - name: GITHUB_INTEGRATION_APP_CLIENT_ID
        valueFrom:
          secretKeyRef:
            name: nightly-github-integration-app-client-id
            key: client-id
      - name: GITHUB_INTEGRATION_APP_CLIENT_SECRET
        valueFrom:
          secretKeyRef:
            name: nightly-github-integration-app-client-secret
            key: client-secret
  - labels:
      preset-kyma-development-artifacts-bucket: "true"
    env:
      - name: KYMA_DEVELOPMENT_ARTIFACTS_BUCKET
        value: "gs://kyma-development-artifacts"
  - labels:
      preset-whitesource-product-kyma: "true"
    env:
      - name: WS_PRODUCTNAME
        value: "SHC - XF KYMA RUNTIME 2.0"
  - labels:
      preset-whitesource-product-control-plane: "true"
    env:
      - name: WS_PRODUCTNAME
        value: "SHC - KYMA CONTROL PLANE 2.0"
  - labels:
      preset-whitesource-product-kyma-dashboard: "true"
    env:
      - name: WS_PRODUCTNAME
        value: "SHC - KYMA DASHBOARD 1.0"
  - labels:
      preset-whitesource-product-kyma-release: "true"
    env:
      - name: WS_PRODUCTNAME
        value: "SHC - KYMA RUNTIME RELEASE"
  - labels:
      preset-whitesource-product-kyma-release-previous: "true"
    env:
      - name: WS_PRODUCTNAME
        value: "SHC - KYMA RUNTIME RELEASE-1"
  - labels:
      preset-whitesource-product-kyma-test: "true"
    env:
      - name: WS_PRODUCTNAME
        value: "TEST - KYMA"
  # volume mounts for kind
  - labels:
      preset-kind-volume-mounts: "true"
    volumeMounts:
      - mountPath: /lib/modules
        name: modules
        readOnly: true
      - mountPath: /sys/fs/cgroup
        name: cgroup
    volumes:
      - name: modules
        hostPath:
          path: /lib/modules
          type: Directory
      - name: cgroup
        hostPath:
          path: /sys/fs/cgroup
          type: Directory
  - labels:
      preset-cluster-use-ssd: "true"
    env:
      - name: CLUSTER_USE_SSD
        value: "true"
  # whitesource labels
  - labels:
      preset-wssagent-keys: "true"
    env:
      - name: WHITESOURCE_APIKEY
        value: /etc/credentials/whitesource-apikey/apikey
      - name: WHITESOURCE_USERKEY
        value: /etc/credentials/whitesource-userkey/userkey
    volumes:
      - name: whitesource-apikey
        secret:
          secretName: whitesource-apikey
      - name: whitesource-userkey
        secret:
          secretName: whitesource-userkey
    volumeMounts:
      - name: whitesource-apikey
        mountPath: /etc/credentials/whitesource-apikey
        readOnly: true
      - name: whitesource-userkey
        mountPath: /etc/credentials/whitesource-userkey
        readOnly: true
  - labels:
      preset-sa-gke-kyma-integration-kyma-project-whitesource: "true"
    env:
      - name: GOOGLE_APPLICATION_CREDENTIALS
        value: /etc/credentials/sa-gke-kyma-integration/service-account.json
      - name: CLOUDSDK_DNS_ZONE_NAME
        value: "build-kyma-workloads" #GCloud DNS Zone Name (NOT it's DNS name!)
      - name: GITHUB_ORG_DIR
        value: "/home/prow/go/src/github.com/kyma-project"
    volumes:
      - name: sa-gke-kyma-integration
        secret:
          secretName: sa-gke-kyma-integration
    volumeMounts:
      - name: sa-gke-kyma-integration
        mountPath: /etc/credentials/sa-gke-kyma-integration
        readOnly: true
  - labels:
      preset-sa-secret-update: "true"
    env:
      - name: GOOGLE_APPLICATION_CREDENTIALS
        value: /etc/credentials/sa-secret-update/service-account.json
    volumes:
      - name: sa-secret-update
        secret:
          secretName: sa-secret-update
    volumeMounts:
      - name: sa-secret-update
        mountPath: /etc/credentials/sa-secret-update
        readOnly: true
  - labels:
      preset-kyma-integration-compass-dev: "true"
    env:
      - name: COMPASS_TENANT
        valueFrom:
          secretKeyRef:
            name: compass-dev-credentials
            key: COMPASS_TENANT
      - name: COMPASS_HOST
        valueFrom:
          secretKeyRef:
            name: compass-dev-credentials
            key: COMPASS_HOST
      - name: COMPASS_CLIENT_ID
        valueFrom:
          secretKeyRef:
            name: compass-dev-credentials
            key: COMPASS_CLIENT_ID
      - name: COMPASS_CLIENT_SECRET
        valueFrom:
          secretKeyRef:
            name: compass-dev-credentials
            key: COMPASS_CLIENT_SECRET
  - labels:
      preset-kyma-integration-compass-enabled: "true"
    env:
      - name: COMPASS_INTEGRATION_ENABLED
        value: "true"
  - labels:
      preset-kyma-integration-istio-evaluation: "true"
    env:
      - name: ISTIO_INTEGRATION_ENABLED
        value: "true"
      - name: KYMA_PROFILE
        value: "evaluation"
  - labels:
      preset-kyma-integration-istio-production: "true"
    env:
      - name: ISTIO_INTEGRATION_ENABLED
        value: "true"
      - name: KYMA_PROFILE
        value: "production"
  - labels:
      preset-kyma-integration-central-app-connectivity-enabled: "true"
    env:
      - name: CENTRAL_APPLICATION_CONNECTIVITY_ENABLED
        value: "true"
  - labels:
      preset-kyma-integration-telemetry-enabled: "true"
    env:
      - name: TELEMETRY_ENABLED
        value: "true"
  - labels:
      preset-kyma-integration-subaccounnt: "true"
    env:
      - name: KEB_SUBACCOUNT_ID
        value: "prow-keb-integration"
  - labels:
      preset-keb-plan-azure: "true"
    env:
      - name: KEB_PLAN_ID
        value: "4deee563-e5ec-4731-b9b1-53b42d855f0c"
  - labels:
      preset-busola-nightly-provision-type-kyma: "true"
    env:
      - name: BUSOLA_PROVISION_TYPE
        value: KYMA
  - labels:
      preset-skr-al-service-key: "true"
    env:
      - name: AL_SERVICE_KEY
        valueFrom:
          secretKeyRef:
            name: skr-al-secret-key
            key: secret.json
  - labels:
      preset-kyma-integration-kcp-client-credentials: "true"
    env:
      - name: KCP_TECH_USER_LOGIN
        valueFrom:
          secretKeyRef:
            name: kcp-client-credentials
            key: KCP_TECH_USER_LOGIN
      - name: KCP_TECH_USER_PASSWORD
        valueFrom:
          secretKeyRef:
            name: kcp-client-credentials
            key: KCP_TECH_USER_PASSWORD
      - name: KCP_OIDC_CLIENT_ID
        valueFrom:
          secretKeyRef:
            name: kcp-client-credentials
            key: KCP_OIDC_CLIENT_ID
      - name: KCP_OIDC_CLIENT_SECRET
        valueFrom:
          secretKeyRef:
            name: kcp-client-credentials
            key: KCP_OIDC_CLIENT_SECRET
  - labels:
      preset-signify-prod-secret: "true"
    volumes:
      - name: signify-prod-secret
        secret:
          secretName: signify-prod-secret
    volumeMounts:
      - name: signify-prod-secret
        mountPath: /secret-prod
        readOnly: true
  - labels:
      preset-tunas-github-bot-token: "true"
    volumes:
      - name: tunas-github-bot-token
        secret:
          secretName: tunas-github-bot-token
    volumeMounts:
      - name: tunas-github-bot-token
        mountPath: /tunas-bot
        readOnly: true
  - labels:
      preset-sa-kyma-dns-serviceuser: "true"
    volumes:
      - name: sa-kyma-dns-serviceuser
        secret:
          secretName: sa-kyma-dns-serviceuser
    volumeMounts:
      - name: sa-kyma-dns-serviceuser
        mountPath: /sa-kyma-dns-serviceuser
        readOnly: true
  - labels:
      preset-k3d-enabled: "true"
    env:
      - name: K3D_ENABLED
        value: "true"
  - labels:
      preset-provision-registry: "true"
    env:
      - name: PROVISION_REGISTRY
        value: "true"
  - labels:
      preset-compass-director-secret: "true"
    volumes:
      - name: compass-director-secret
        secret:
          secretName: compass-director-secret
    volumeMounts:
      - name: compass-director-secret
        mountPath: /compass-director-secret
        readOnly: true
  - labels:
      preset-image-builder-ado-token: "true"
    env:
      - name: ADO_PAT
        valueFrom:
          secretKeyRef:
            name: image-builder-ado-token
            key: token