provider: aks
providerConfig:
  crossplaneProvider: "ad881159-0593-4502-96e4-e2698b790a3d"
  accountId: "ad881159-0593-4502-96e4-e2698b790a3d"
acrResourceGroup: "container_registry_rg"
regionConfig:
  name: japaneast
  zones:
    - "japaneast-1"
    - "japaneast-2"
    - "japaneast-3"
env: prod
appBoxConfig:
  nodeConfig:
    # set default maxPods for gke, can be override by nodepools
    maxPodsPerNode: 16
  k8sVersion: "1.35"
  enableK8sPublicAccess: true
  apiserverPublicAccessCidrs:
    # - "0.0.0.0/0"
    - "54.188.27.23/32" # global controlplane NAT IP
    - "44.231.162.131/32" # global controlplane NAT IP
    - "100.20.198.224/32" # global controlplane NAT IP
    - "20.188.5.127/32" # regional control plane NAT IP
    - "48.218.120.230/32" # o11y regional service
    - "35.82.108.84/32" # devops cluster
  enableArtifactRegistry: false
  adminGroupObjectIDs:
    - a422f92e-abb6-4706-8ee7-995c7dc79ce3 # pingcap group
    - 69500f83-4674-4aad-b082-7d95d93f8c2c # prod-control-plane-services
predicate:
  matchExpressions:
    - key: "cloud.pingcap.com/reconciler"
      operator: "DoesNotExist"
resourceLabels:
  cloud.pingcap.com/bizType: dedicated
  tags.tidbcloud.com/environment: prod
  tags.tidbcloud.com/servicetype: dedicated
  tags.tidbcloud.com/usedby: dbaas-control-plane-shoot
gcConfig:
  checkIdleInterval: 5m
  nodePoolGC:
    enabled: true
    autoApproveDeletion: true
  idleTimeThreshold: 24h
  idleTimeRetention: 1h
componentPCAARN: "arn:aws:acm-pca:us-west-2:380838443567:certificate-authority/ed5106d3-0890-4af9-bd60-b6df4f6299ca"
clusterControlServiceEndpoint: "http://cluster-control-service.cluster-service"
o11yRegionalServiceEndpoint: "https://www.rs.japaneast.azure.observability.tidbcloud.com"
globalCrossplaneProviderConfig: provider-aws-gr # used to provision global resources such as route53 recordset and pca certificate
publicHostedZoneDomain: "clusters.japaneast.prod.azure.tidb-cloud.com"
publicHostedZoneID: ""
publicHostedZoneResourceGroup: "prod-japaneast-controlplane"
dataPlaneAccountNamespace: regional-server-system
selfSignedCAConfig:
  tidbServerSelfSignedCAPath: /etc/cluster-controller/issuer-ca/tidb-server-cluster-issuer-ca
featureGates:
  deploy_tidb_operator_v2:
    all: true
  o11y_new_agent_controller:
    all: true