kustomization.yaml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

sortOptions:
  order: legacy
  legacySortOptions:
    orderFirst:
    - Namespace
    - ResourceQuota
    - StorageClass
    - CustomResourceDefinition
    - MutatingWebhookConfiguration
    - ServiceAccount
    - PodSecurityPolicy
    - NetworkPolicy
    - Role
    - ClusterRole
    - RoleBinding
    - ClusterRoleBinding
    - ConfigMap
    - Secret
    - Endpoints
    - Service
    - LimitRange
    - PriorityClass
    - PersistentVolume
    - PersistentVolumeClaim
    - Deployment
    - StatefulSet
    - CronJob
    - PodDisruptionBudget
    orderLast:
    - ValidatingWebhookConfiguration

resources:
# Cert-Manager
#- manifests/common/cert-manager/base
- manifests/common/cert-manager/kubeflow-issuer/base
# Istio
- manifests/common/istio/istio-crds/base
- manifests/common/istio/istio-namespace/base
- manifests/common/istio/istio-install/overlays/oauth2-proxy
# NOTE: For Google Kubernetes Engine (GKE), use:
# - manifests/common/istio/istio-install/overlays/gke
#GKE mounts `/opt/cni/bin` as read-only for security reasons, preventing the Istio CNI installer from writing the CNI binary.
#Use the GKE-specific overlay: `kubectl apply -k common/istio/istio-install/overlays/gke`.
#This overlay uses GKE's writable CNI directory at `/home/kubernetes/bin`.
#For more details, see [Istio CNI Prerequisites](https://istio.io/latest/docs/setup/additional-setup/cni/#prerequisites) and [Platform Prerequisites](https://istio.io/latest/docs/ambient/install/platform-prerequisites/)
# oauth2-proxy
# NOTE: only uncomment ONE of the following overlays, depending on your cluster type
- manifests/common/oauth2-proxy/overlays/m2m-dex-only     # for all clusters
#- manifests/common/oauth2-proxy/overlays/m2m-dex-and-kind # for KIND clusters (allows K8S JWTs for gateway auth)
#- manifests/common/oauth2-proxy/overlays/m2m-dex-and-eks  # for EKS clusters (NOTE: requires you to configure issuer, see overlay)
# Dex
- manifests/common/dex/overlays/oauth2-proxy

# KNative
- manifests/common/knative/knative-serving/overlays/gateways
# Uncomment the following line if `knative-eventing` is required
# - manifests/common/knative/knative-eventing/base
- manifests/common/istio/cluster-local-gateway/base
# Kubeflow namespace
- manifests/common/kubeflow-namespace/base
# NetworkPolicies
- manifests/common/networkpolicies/base
# Kubeflow Roles
- manifests/common/kubeflow-roles/base
# Kubeflow Istio Resources
- manifests/common/istio/kubeflow-istio-resources/base
# Kubeflow Pipelines
- manifests/applications/pipeline/upstream/env/cert-manager/platform-agnostic-multi-user
# Katib
- manifests/applications/katib/upstream/installs/katib-with-kubeflow
# Central Dashboard
- manifests/applications/centraldashboard/overlays/oauth2-proxy
# Admission Webhook
- manifests/applications/admission-webhook/upstream/overlays/cert-manager
# Jupyter Web App
- manifests/applications/jupyter/jupyter-web-app/upstream/overlays/istio
# Notebook Controller
- manifests/applications/jupyter/notebook-controller/upstream/overlays/kubeflow
# Profiles + KFAM with PSS (Pod Security Standards)
- manifests/applications/profiles/pss
# PVC Viewer
- manifests/applications/pvcviewer-controller/upstream/base
# Volumes Web App
- manifests/applications/volumes-web-app/upstream/overlays/istio
# Tensorboards Controller
- manifests/applications/tensorboard/tensorboard-controller/upstream/overlays/kubeflow
# Tensorboard Web App
- manifests/applications/tensorboard/tensorboards-web-app/upstream/overlays/istio
# Training Operator
- manifests/applications/training-operator/upstream/overlays/kubeflow
# User namespace
#- manifests/common/user-namespace/base
- user-profile.yaml
# KServe
- manifests/applications/kserve/kserve
- manifests/applications/kserve/models-web-app/overlays/kubeflow
# Spark Operator
- manifests/applications/spark/spark-operator/overlays/kubeflow

# custom envoy filter to make sure kubeflow-userid header is passed through
- envoy-filter.yaml

secretGenerator:
  - name: dex-passwords
    namespace: auth
    behavior: replace
    envs:
      - dex-passwords.env

  - name: dex-keycloak-secret
    namespace: auth
    envs:
      - dex-keycloak-secret.env

configMapGenerator:
  - name: dex
    namespace: auth
    behavior: replace
    files:
      - config.yaml=dex-config.yaml

  - name: oauth2-proxy
    namespace: oauth2-proxy
    behavior: replace
    files:
      - oauth2_proxy.cfg

patches:
  - path: dex-deployment-patch.yaml
  - path: request-auth-patch.yaml
  - path: disable-registration.yaml

# the minio image couldn't be found
images:
  - name: gcr.io/ml-pipeline/minio
    newName: minio/minio
    newTag: RELEASE.2019-08-14T20-37-41Z