encryptionsalt: v1:Wvqk/LCOnbI=:v1:o/Y/troNiDY1tvMy:0PdMAKENGOmkvobhkncsOomekQCdOg==
config:
  aws:region: us-west-2
  aws:defaultTags: # auto attaching tags, for billing. see: https://stackoverflow.com/questions/68814723/how-to-define-default-tags-with-pulumi-aws-provider
    tags:
      usedby: test-infra

  eks:config:
    route53:
      hostedZoneName: pingcap.net
      associatedVPCs:
        - vpcID: "vpc-0602d594c0a5ec5c7"
          vpcRegion: "us-west-2"
      dnsRecords:
        - name: rms-aws.pingcap.net
          records: ["10.234.150.4"] # should match node IP of EKS(visited by nodeport)
          type: A
        - name: tcms.pingcap.net
          records: ["10.100.0.2"]
          type: A
        - name: db.benchbot.pingcap.net
          records: ["10.100.0.2"]
          type: A

    eksCluster:
      clusterName: test-infra
      k8sVersion: "1.21"
      vpc:
        id: vpc-0602d594c0a5ec5c7 # test-infra
        privateSubnetIds:
          - subnet-0f79dd8a61e31464c # us-west-2a
          - subnet-02a9f564ffb63bdf2 # us-west-2b
        publicSubnetIds:
          - subnet-02a6a4d20d8951c71 # us-west-2a
          - subnet-07d211cf80e0e0427 # us-west-2b
      storageClass:
        type: gp3

      # policy for worker nodes, used by all node groups
      # used by kubelet, needed policy see: https://docs.aws.amazon.com/zh_cn/eks/latest/userguide/create-node-role.html
      nodeGroupPolicyArns:
        - "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
        - "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
        - "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      # attach extra rules to securityGroup, all are inbound rules
      extraNodeSecurityGroupRules:
        - name: allow-all
          protocol: all
          cidrBlocks:
            - "10.234.0.0/16" # in-VPC traffic
            - "10.100.0.0/16" # openvpn traffic
          fromPort: 0
          toPort: 0
        - name: allow-ssh
          protocol: tcp
          cidrBlocks:
            - "0.0.0.0/0"
          fromPort: 22
          toPort: 22

      # see: https://aws.amazon.com/cn/premiumsupport/knowledge-center/eks-api-server-unauthorized-error
      adminRoles:
        - AWSReservedSSO_DBaaS-DevLeader-Role_7e4c83a4a285e8a3
        - AWSReservedSSO_DBaaS-DevUser-Role_528b7d63384d3e2e
      adminUsers:
        - test-infra

      nodeGroups:
        - name: test-infra
          desiredCapacity: 1
          instanceType: t3.medium
          sshKeyName: test-infra
          maxSize: 5
          minSize: 0
          amiID: ami-06502611c98f05956 # amazon-eks-node-1.21-v20220420, need to pin amiID otherwise all nodes can be rolling restarted
          nodeSubnetIds: # we can specify instance's availableZone by subnet's availableZone
            - subnet-02a9f564ffb63bdf2 # see vpc above
          labels:
            resourcepool: test-infra # for test-infra services
          autoScalingGroupTags: # used by cluster-auto-scaler
            k8s.io/cluster-autoscaler: "enabled"
            k8s.io/cluster-autoscaler/node-template/label/resourcepool: test-infra
          extraNodeGroupPolicyArns: # extra nodeGroupPolicy used by this group only
            # used by cluster-auto-scaler(attach to worker node to keep away from complicated authorization)
            - arn:aws:iam::aws:policy/AutoScalingFullAccess
            - arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess
            # used by RMS to assume role to tidbcloud account, so that it can visit EKS of tidbcloud
            - arn:aws:iam::946646677266:policy/AssumeTiDBCloudAdmin

        - name: test-infra-eks-amd64-default # naming convention: $clusterName-$resourcePoolName
          desiredCapacity: 0
          instanceType: c6a.4xlarge
          sshKeyName: test-infra
          maxSize: 5
          minSize: 0
          amiID: ami-06502611c98f05956 # amazon-eks-node-1.21-v20220420, need to pin amiID otherwise all nodes can be rolling restarted
          nodeSubnetIds:
            - subnet-02a9f564ffb63bdf2 # see vpc above
          labels:
            resourcepool: eks-amd64-default
          kubeletExtraArgs: "--cpu-manager-policy static --topology-manager-policy best-effort"
          autoScalingGroupTags: # tags for cluster-autoscaler to make decision, see: https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#auto-discovery-setup
            k8s.io/cluster-autoscaler: "enabled"
            k8s.io/cluster-autoscaler/node-template/label/resourcepool: eks-amd64-default

        # - name: arm64-private
        #   desiredCapacity: 1
        #   instanceType: c6g.medium
        #   sshKeyName: test-infra
        #   maxSize: 5
        #   minSize: 1
        #   amiID: ami-04531e07813ba6491 # amazon-eks-arm64-node-1.21-v20220420, arm node group cannot start with default amiID: https://github.com/pulumi/pulumi-eks/issues/582
        #   nodeSubnetIds:
        #     - subnet-02a9f564ffb63bdf2 # see vpc above

        # we don't need worker with public IP
        # - name: amd64-public
        #   desiredCapacity: 1
        #   instanceType: t3.medium
        #   sshKeyName: test-infra
        #   maxSize: 5
        #   minSize: 1
        #   amiID: ami-06502611c98f05956 # amazon-eks-node-1.21-v20220420, need to pin amiID otherwise all nodes can be rolling restarted
        #   nodeSubnetIds:
        #     - subnet-07d211cf80e0e0427 # see vpc above