provider: gke
providerConfig:
  crossplaneProvider: TMPL_CONTROLPLANE_PROJECT
  accountId: TMPL_CONTROLPLANE_PROJECT
regionConfig:
  name: TMPL_REGION
  zones:
    - TMPL_REGION-a
    - TMPL_REGION-b
    - TMPL_REGION-c
env: prod
appBoxConfig:
  nodeConfig:
    # set default maxPods for gke, can be override by nodepools
    maxPodsPerNode: 16
  k8sVersion: "1.35"
  gkeMaintenanceExclusionTimeWindow:
    autoUpdate: true
  enableK8sPublicAccess: true
  apiserverPublicAccessCidrs:
    - "54.185.150.209/32" # bastion NAT IP
    - "54.188.27.23/32" # global controlplane (base cluster) NAT IP
    - "44.231.162.131/32" # global controlplane (base cluster) NAT IP
    - "100.20.198.224/32" # global controlplane (base cluster) NAT IP
    - "35.247.136.255/32" # regional controlplane (seed cluster) NAT IP
    - "35.240.206.166/32" # regional controlplane (seed cluster) NAT IP
    - "35.187.249.236/32" # o11y regional service
    - "35.82.108.84/32" # devops cluster
  enableArtifactRegistry: true
  authorizedSubjects:
    - prod-gke-provider@dbaas-prod.iam.gserviceaccount.com
    - regional-server@gcp-autonomous-prod.iam.gserviceaccount.com
    - devops-server@gcp-resilience-dev.iam.gserviceaccount.com
predicate:
  matchExpressions:
    - key: "cloud.pingcap.com/reconciler"
      operator: "NotIn"
      values:
        - e2e-test
resourceLabels:
  cloud.pingcap.com/bizType: dedicated
  tags.tidbcloud.com/environment: prod
  tags.tidbcloud.com/servicetype: dedicated
  tags.tidbcloud.com/usedby: dbaas-control-plane-shoot
gcConfig:
  checkIdleInterval: 5m
  nodePoolGC:
    enabled: true
    autoApproveDeletion: false
  idleTimeThreshold: 24h
  idleTimeRetention: 1h
componentPCAARN: TMPL_PCA_ARN
clusterControlServiceEndpoint: "http://cluster-control-service.cluster-service"
o11yRegionalServiceEndpoint: TMPL_O11Y_REGIONAL_SERVICE_ENDPOINT
globalCrossplaneProviderConfig: provider-aws-gr # used to provision global resources such as route53 recordset and pca certificate
publicHostedZoneDomain: TMPL_PUBLIC_HOSTED_ZONE_DOMAIN
publicHostedZoneID: TMPL_PUBLIC_HOSTED_ZONE_ID
dataPlaneAccountNamespace: regional-server-system
featureGates:
  allocate_more_nats:
    all: true
  set_gke_cidr_placeholder:
    all: false
    enabledProjects:
      - 1372813089190551322
      - 1372813089190791298
      - 1372813089197601282
  allocate_shared_bucket:
    all: true
  deploy_tidb_operator_v2:
    all: true
    disabledTenants:
      - 1372813089188151296 # Catalyst Software
      - 1372813089209256793 # UE
      - 1372813089191601283 # SB Payment Service(not poc)
      - 1372813089209213994 # Pionex
      - 1372813089209061633 # wetech
      - 1372813089209238420 # bingoplus
      - 1372813089201471287 # mecari
      - 1372813089209214865 # bitget wallet
  o11y_new_agent_controller:
    all: true
    enabledProjects:
      - "1372813089454776791"
ticdcServiceEndpoint: "http://ticdc-service-server.ticdc-service"