# Copyright 2020 The Knative Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: ConfigMap
metadata:
  name: config-features
  namespace: knative-serving
  labels:
    serving.knative.dev/release: devel
    app.kubernetes.io/version: devel
    app.kubernetes.io/part-of: knative-serving
  annotations:
    knative.dev/example-checksum: "3bac317a"
data:
  _example: |-
    ################################
    #                              #
    #    EXAMPLE CONFIGURATION     #
    #                              #
    ################################

    # This block is not actually functional configuration,
    # but serves to illustrate the available configuration
    # options and document them in a way that is accessible
    # to users that `kubectl edit` this config map.
    #
    # These sample configuration options may be copied out of
    # this example block and unindented to be in the data block
    # to actually change the configuration.

    # Indicates whether multi container support is enabled
    #
    # WARNING: Cannot safely be disabled once enabled.
    # See: https://knative.dev/docs/serving/feature-flags/#multi-containers
    multi-container: "enabled"

    # Indicates whether Kubernetes affinity support is enabled
    #
    # WARNING: Cannot safely be disabled once enabled.
    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-affinity
    kubernetes.podspec-affinity: "disabled"

    # Indicates whether Kubernetes hostAliases support is enabled
    #
    # WARNING: Cannot safely be disabled once enabled.
    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-host-aliases
    kubernetes.podspec-hostaliases: "disabled"

    # Indicates whether Kubernetes nodeSelector support is enabled
    #
    # WARNING: Cannot safely be disabled once enabled.
    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-selector
    kubernetes.podspec-nodeselector: "disabled"

    # Indicates whether Kubernetes tolerations support is enabled
    #
    # WARNING: Cannot safely be disabled once enabled
    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-toleration
    kubernetes.podspec-tolerations: "disabled"

    # Indicates whether Kubernetes FieldRef support is enabled
    #
    # WARNING: Cannot safely be disabled once enabled.
    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-fieldref
    kubernetes.podspec-fieldref: "disabled"

    # Indicates whether Kubernetes RuntimeClassName support is enabled
    #
    # WARNING: Cannot safely be disabled once enabled.
    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-runtime-class
    kubernetes.podspec-runtimeclassname: "disabled"

    # This feature allows end-users to set a subset of fields on the Pod's SecurityContext
    # in addition to expanding the allowable fields within a Container's SecurityContext.
    #
    # When set to "enabled" or "allowed" it allows the following
    # PodSecurityContext properties:
    # - FSGroup
    # - RunAsGroup
    # - RunAsNonRoot
    # - SupplementalGroups
    # - RunAsUser
    #
    # When set to "enabled" or "allowed" it allows the following
    # Container SecurityContext properties:
    # - RunAsNonRoot
    # - RunAsGroup
    # - RunAsUser (already allowed without this flag)
    #
    # This feature flag should be used with caution as the PodSecurityContext
    # properties may have a side-effect on non-user sidecar containers that come
    # from Knative or your service mesh
    #
    # WARNING: Cannot safely be disabled once enabled.
    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-security-context
    kubernetes.podspec-securitycontext: "disabled"

    # This feature flag allows end-users to add a subset of capabilities on the Pod's SecurityContext.
    #
    # When set to "enabled" or "allowed" it allows capabilities to be added to the container.
    # For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html
    kubernetes.containerspec-addcapabilities: "disabled"

    # This feature validates PodSpecs from the validating webhook
    # against the K8s API Server.
    #
    # When "enabled", the server will always run the extra validation.
    # When "allowed", the server will not run the dry-run validation by default.
    #   However, clients may enable the behavior on an individual Service by
    #   attaching the following metadata annotation: "features.knative.dev/podspec-dryrun":"enabled".
    # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dry-run
    kubernetes.podspec-dryrun: "allowed"

    # Controls whether tag header based routing feature are enabled or not.
    # 1. Enabled: enabling tag header based routing
    # 2. Disabled: disabling tag header based routing
    # See: https://knative.dev/docs/serving/feature-flags/#tag-header-based-routing
    tag-header-based-routing: "disabled"

    # Controls whether http2 auto-detection should be enabled or not.
    # 1. Enabled: http2 connection will be attempted via upgrade.
    # 2. Disabled: http2 connection will only be attempted when port name is set to "h2c".
    autodetect-http2: "disabled"

    # Controls whether volume support for EmptyDir is enabled or not.
    # 1. Enabled: enabling EmptyDir volume support
    # 2. Disabled: disabling EmptyDir volume support
    kubernetes.podspec-volumes-emptydir: "disabled"
