provider: eks
controlplaneAWSProviderConfig: provider-aws # used to provision global resources such as route53 recordset and pca certificate
amiConfig:
  supportedVersions:
    - "1.27"
    - "1.28"
    - "1.29"
    - "1.30"
    - "1.31"
    - "1.32"
    - "1.33"
    - "1.34"
    - "1.35"
    - "1.36"
clusterController:
  aws:
    enableBatchOpsExport: true
    nodeRolePolicyFile: /etc/cluster-controller/extra/node-policy-config.json
    nodeUserdataSystemConfigurationFile: /etc/cluster-controller/extra/node-userdata-system-configuration.toml
    nodeRoleManagedPolicies: # AWS managed policies to attach to node role
      - "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      - "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      - "arn:aws:iam::aws:policy/AWSDirectConnectFullAccess"
      - "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      - "arn:aws:iam::aws:policy/AmazonRoute53ResolverFullAccess"
      # See https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started.html for more detail.
      - "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
  configChange:
    accountEnv: prod
    activity:
      enabled: false
      activityHubEndpoint: https://e4hr1v4oqh.execute-api.us-west-2.amazonaws.com
      activityHubSource: gitops
      clinicEndpoint: https://clinic.pingcap.com
  clusterAgent:
    chartPath: /etc/helm/cluster-agent
    agentImage:
      repo: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/cluster-agent
      tag: 4f164cbaa37f5d5e652d027de9da286f21be94ac
    pdPatrolImage:
      # only used to fetch pd-patrol.
      tag: master-c53f203
  mysqlProtocolProbe:
    image: "380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/mysql-readiness-probe:latest"
    binaryName: "mysql-readiness-probe"
    timeoutSeconds: 5
    # Will have a maximum of 150 minutes (900 * 10 = 9000s = 150m) to finish its startup
    periodSeconds: 10
    failureThreshold: 900
  audit:
    sidecarImage: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/audit:81dc098e2ad54c6918e7c5aac80b052f532bc39f
    sidecarCommand: ["/audit", "server", "--config", "/etc/audit/audit.yaml"]
    defaultTag: v1.0.4
network:
  proxy:
    enableDevMode: false
    auth0Audience: prod-proxy-service
    auth0Domain: tidb.auth0.com
  region: ap-southeast-7
  zones:
    - ap-southeast-7a
    - ap-southeast-7b
    - ap-southeast-7c
override:
  overrideHelperImage: "380838443567.dkr.ecr.us-west-2.amazonaws.com/third-party/busybox:1.34.1"
  overrideRegistry: "380838443567.dkr.ecr.us-west-2.amazonaws.com"
  overrideRepoPrefix: "tidbcloud"
  overrideThirdPartyRepoPrefix: "third-party"
featureGates:
  set_priority_class:
    all: true
storageClassConfigFile: /etc/cluster-controller/extra/storageclass-config.yaml
instanceTypeConfigFile: /etc/cluster-controller/extra/instancetype-config.yaml
predicate:
  matchLabels:
    cloud.pingcap.com/provider-type: eks
    cloud.pingcap.com/region: ap-southeast-7
  matchExpressions:
    - key: "cloud.pingcap.com/reconciler"
      operator: "DoesNotExist"
fullManage:
  project: prod
  publicHostedZoneDomain: clusters.tidb-cloud.com
  publicHostedZoneID: Z09521541042LFILW1KL4
  serviceRoleARN: "arn:aws:iam::380838443567:role/full-manager-eks-role"
  serviceRoleName: "full-manager-eks-role"
  assumeRoleName: "dev-us-east-1-cluster-controller-assumed-role"
  componentPCAARN: arn:aws:acm-pca:us-west-2:380838443567:certificate-authority/ed5106d3-0890-4af9-bd60-b6df4f6299ca
  assumeRoleExternalID: "123"
maxConcurrentReconciles:
  cluster: 10
  clusterNodeProtector: 5