provider: gke
providerConfig:
  crossplaneProvider: dbaas-prod
  accountId: dbaas-prod
regionConfig:
  name: asia-south1
  zones:
    - asia-south1-a
    - asia-south1-b
    - asia-south1-c
env: prod
appBoxConfig:
  nodeConfig:
    # set default maxPods for gke, can be override by nodepools
    maxPodsPerNode: 16
  k8sVersion: "1.35"
  gkeMaintenanceExclusionTimeWindow:
    autoUpdate: true
    startTime: "2025-07-15T00:00:00Z"
    endTime: "2025-08-14T00:00:00Z"
  enableK8sPublicAccess: true
  apiserverPublicAccessCidrs:
    - "54.185.150.209/32" # bastion NAT IP
    - "54.188.27.23/32" # global controlplane (base cluster) NAT IP
    - "44.231.162.131/32" # global controlplane (base cluster) NAT IP
    - "100.20.198.224/32" # global controlplane (base cluster) NAT IP
    - "34.180.31.223/32" # regional controlplane (seed cluster) NAT IP
    - "34.93.52.151/32" # regional controlplane (seed cluster) NAT IP
    - "34.47.211.176/32" # o11y regional service NAT IP
    - "35.82.108.84/32" # devops cluster
  enableArtifactRegistry: true
  authorizedSubjects:
    - prod-gke-provider@dbaas-prod.iam.gserviceaccount.com
    - regional-server@gcp-autonomous-prod.iam.gserviceaccount.com
    - devops-server@gcp-resilience-dev.iam.gserviceaccount.com
predicate:
  matchExpressions:
    - key: "cloud.pingcap.com/reconciler"
      operator: "NotIn"
      values:
        - e2e-test
resourceLabels:
  cloud.pingcap.com/bizType: dedicated
  tags.tidbcloud.com/environment: prod
  tags.tidbcloud.com/servicetype: dedicated
  tags.tidbcloud.com/usedby: dbaas-control-plane-shoot
gcConfig:
  checkIdleInterval: 5m
  nodePoolGC:
    enabled: true
    autoApproveDeletion: true
  idleTimeThreshold: 24h
  idleTimeRetention: 1h
componentPCAARN: "arn:aws:acm-pca:us-west-2:380838443567:certificate-authority/ed5106d3-0890-4af9-bd60-b6df4f6299ca"
clusterControlServiceEndpoint: "http://cluster-control-service.cluster-service"
o11yRegionalServiceEndpoint: "https://www.rs.asia-south1.gcp.observability.tidbcloud.com"
globalCrossplaneProviderConfig: provider-aws-gr # used to provision global resources such as route53 recordset and pca certificate
publicHostedZoneDomain: "clusters.tidb-cloud.com"
publicHostedZoneID: Z09521541042LFILW1KL4
dataPlaneAccountNamespace: regional-server-system
featureGates:
  allocate_more_nats:
    all: true
  set_gke_cidr_placeholder:
    all: false
    enabledProjects:
      - 1372813089190551322
      - 1372813089190791298
      - 1372813089197601282
  allocate_shared_bucket:
    all: true
  deploy_tidb_operator_v2:
    all: true
    disabledTenants:
      - 1372813089188151296 # Catalyst Software
      - 1372813089209256793 # UE
      - 1372813089191601283 # SB Payment Service(not poc)
      - 1372813089209213994 # Pionex
      - 1372813089209061633 # wetech
      - 1372813089209238420 # bingoplus
      - 1372813089201471287 # mecari
      - 1372813089209214865 # bitget wallet
  o11y_new_agent_controller:
    all: true
    enabledProjects:
      - "1372813089454776791"
ticdcServiceEndpoint: "http://ticdc-service-server.ticdc-service"