# 配置静态加密: https://docs.pingcap.com/zh/tidb/stable/encryption-at-rest#br-%E5%A4%87%E4%BB%BD
# 通过 init container 在 pod 启动时将密钥写到 PV 挂载路径的文件里，从而被 pd/tikv/tiflash 在启动时读取
generateName: testbed-
items:
  - name: tc-upstream
    type: TIDB_CLUSTER
    spec:
      version: "v5.2.1"
      pd:
        initContainers:
          - name: "encryption-init"
            image: alpine
            command: [
                "sh",
                "-c",
                # echo 内容可换成任意符合要求的密钥
                "echo 603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4 > /var/lib/pd/master_key",
              ]
            volumeMounts:
              - mountPath: /var/lib/pd
                name: pd
        replicas: 1
        baseImage: registry-mirror.pingcap.net/pingcap/pd
        config: |
          [log]
          level = "info"
          [security]
            [security.encryption]
              data-encryption-method = "aes256-ctr"
              [security.encryption.master-key]
                path = "/var/lib/pd/master_key"
                type = "file"
      tidb:
        replicas: 1
        baseImage: registry-mirror.pingcap.net/pingcap/tidb
        config: |
          [log]
          # Log level: debug, info, warn, error, fatal.
          level = "info"
      tikv:
        initContainers:
          - name: "encryption-init"
            image: alpine
            command:
              [
                "sh",
                "-c",
                "echo 603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4 > /var/lib/tikv/master_key",
              ]
            volumeMounts:
              - mountPath: /var/lib/tikv
                name: tikv
        replicas: 1
        baseImage: registry-mirror.pingcap.net/pingcap/tikv
        config: |
          ## Log levels: trace, debug, info, warning, error, critical.
          ## Note that `debug` and `trace` are only available in development builds.
          log-level = "info"
          [storage]
          reserve-space = "0MB"
          [security]
            [security.encryption]
              data-encryption-method = "aes256-ctr"
              [security.encryption.master-key]
                path = "/var/lib/tikv/master_key"
                type = "file"
      tiflash:
        initContainers:
          - name: "encryption-init"
            image: alpine
            command:
              [
                "sh",
                "-c",
                "echo 603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4 > /data0/master_key",
              ]
            volumeMounts:
              - mountPath: /data0
                name: data0
        replicas: 1
        baseImage: hub.pingcap.net/qa/tiflash
        # more refer to: https://docs.pingcap.com/zh/tidb/stable/tiflash-configuration#%E9%85%8D%E7%BD%AE%E6%96%87%E4%BB%B6-tiflashtoml
        # you need at lease uses github.com/pingcap/test-infra/sdk@v0.0.0-20210705141439-f1670c1d3048 or newer version
        config: |
          log-level = "info"
          [security]
            [security.encryption]
              data-encryption-method = "aes256-ctr"
              [security.encryption.master-key]
                path = "/data0/master_key"
                type = "file"