provider: eks
regionConfig:
  name: eu-west-1
  zones:
    - eu-west-1a
    - eu-west-1b
    - eu-west-1c
env: prod
appBoxConfig:
  serviceRoleName: prod-eu-west-1-eks-service-role
  nodeConfig:
    capacityType: ON_DEMAND
    adminNodesAMIType: BOTTLEROCKET_x86_64
    systemVolumeSize: 20
  k8sVersion: "1.36"
  enableK8sPublicAccess: true
  apiserverPublicAccessCidrs:
    - 54.185.150.209/32
    - 54.188.27.23/32
    - 44.231.162.131/32
    - 100.20.198.224/32
    - 108.128.204.125/32
    - 34.242.39.186/32
    - 52.215.241.118/32
    - 52.31.14.154/32
    - 35.82.108.84/32 # devops cluster
  authorizedSubjects:
    - arn:aws:iam::380838443567:role/devops-server-prod
    - arn:aws:iam::557537366020:role/devops-server-prod
    - arn:aws:iam::380838443567:role/prod-eu-west-1-cluster-controller
    - arn:aws:iam::380838443567:role/prod-eu-west-1-dm-controller
    - arn:aws:iam::380838443567:role/prod-eu-west-1-import-controller
    - arn:aws:iam::730335266318:role/full-manager-service-role
    - arn:aws:iam::143458967504:role/full-manager-service-role
    - arn:aws:iam::380838443567:role/full-manager-service-role
    - arn:aws:iam::730335266318:role/prod-eu-west-1-cluster-controller-assumed-role
    - arn:aws:iam::143458967504:role/prod-eu-west-1-cluster-controller-assumed-role
    - arn:aws:iam::380838443567:role/prod-eu-west-1-cluster-controller-assumed-role
    - arn:aws:iam::730335266318:role/prod-eu-west-1-dm-controller-assumed-role
    - arn:aws:iam::730335266318:role/prod-eu-west-1-import-controller-assumed-role
    - arn:aws:iam::143458967504:role/prod-eu-west-1-dm-controller-assumed-role
    - arn:aws:iam::143458967504:role/prod-eu-west-1-import-controller-assumed-role
    - arn:aws:iam::380838443567:role/prod-eu-west-1-dm-controller-assumed-role
    - arn:aws:iam::380838443567:role/prod-eu-west-1-import-controller-assumed-role
    - arn:aws:iam::557537366020:role/regional-server-o11y-prod-regional-eu-west-1
    - arn:aws:iam::131464424160:role/full-manager-service-role
  adminNodeRoleConfig:
    trustPolicyFile: /etc/configs/admin-node-role-trust-policy.json
    policyTemplateFile: /etc/configs/admin-node-role-policy-template.json
    awsLBControllerPolicyFile: /etc/configs/aws-lb-controller-policy.json
    managedPolicies:
      - "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      - "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      - "arn:aws:iam::aws:policy/AWSDirectConnectFullAccess"
      - "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      - "arn:aws:iam::aws:policy/AmazonRoute53ResolverFullAccess"
      # See https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started.html for more detail.
      - "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
  tiCDCNodeRoleConfig:
    policyTemplateFile: /etc/configs/ticdc-node-role-policy-template.json
    managedPolicies:
      - "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      - "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      - "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      # See https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started.html for more detail.
      - "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
componentPCAARN: arn:aws:acm-pca:us-west-2:380838443567:certificate-authority/ed5106d3-0890-4af9-bd60-b6df4f6299ca
clusterControllerAssumeRoleName: prod-eu-west-1-cluster-controller-assumed-role
readonlyClusterControllerAssumeRoleName: ro-prod-eu-west-1-cluster-controller-assumed
dpControllerAssumeRoleName: full-manager-service-role
ticdcControllerAssumeRoleName: prod-eu-west-1-ticdc-controller-assumed-role
predicate:
  matchExpressions:
    - key: "cloud.pingcap.com/reconciler"
      operator: "NotIn"
      values:
        - e2e-test
resourceLabels:
  cloud.pingcap.com/bizType: dedicated
  tags.tidbcloud.com/environment: prod
  tags.tidbcloud.com/servicetype: dedicated
  tags.tidbcloud.com/usedby: dbaas-control-plane-shoot
gcConfig:
  checkIdleInterval: 5m
  nodePoolGC:
    enabled: true
    autoApproveDeletion: true
  idleTimeThreshold: 24h
  idleTimeRetention: 1h
clusterControlServiceEndpoint: "http://cluster-control-service.cluster-service"
o11yRegionalServiceEndpoint: https://www.rs.eu-west-1.aws.observability.tidbcloud.com
o11ySeedClusterID: 5ccad509-1d51-4874-a61d-0515c4e3de63
globalCrossplaneProviderConfig: provider-aws-gr # used to provision global resources such as route53 recordset and pca certificate
publicHostedZoneDomain: clusters.tidb-cloud.com
publicHostedZoneID: Z09521541042LFILW1KL4
dataPlaneAccountNamespace: regional-server-system
featureGates:
  allocate_shared_bucket:
    all: true
  o11y_new_agent_controller:
    all: true
  update_legacy_node_role_policy:
    all: true
ticdcServiceEndpoint: "http://ticdc-service-server.ticdc-service"