# used by cloudconfig service.
- id: cloudconfig/modify-config
  nodes:
  - name: Reviewed by Region TSE
    method: ANY
    condition: '!(tenant_region in ["TEST_INFRA"])'
    fromParam:
      paramName: tenant_region
      paramValueMapping:
        APAC:
          userGroup: cloud-operation-region-admin-apac
        EMEA:
          userGroup: cloud-operation-region-admin-emea
        JAPAN:
          userGroup: cloud-operation-region-admin-japan
        NA:
          userGroup: cloud-operation-region-admin-na
        LATAM:
          userGroup: cloud-operation-region-admin-na
      defaultApprover:
        userGroup: ops-portal-admin
  - parallel:
    - name: Reviewed by TiDB dev
      method: ANY
      condition: '(any(split(high_risk_components, ","), { # == "tidb" })) && (!(tenant_region in ["TEST_INFRA"]))'
      userGroup: config_approver_tidb
    - name: Reviewed by TiKV dev
      method: ANY
      condition: '(any(split(high_risk_components, ","), { # == "tikv" })) && (!(tenant_region in ["TEST_INFRA"]))'
      userGroup: config_approver_tikv
    - name: Reviewed by TiFlash dev
      method: ANY
      condition: '(any(split(high_risk_components, ","), { # == "tiflash" })) && (!(tenant_region in ["TEST_INFRA"]))'
      userGroup: config_approver_tiflash
    - name: Reviewed by PD dev
      method: ANY
      condition: '(any(split(high_risk_components, ","), { # == "pd" })) && (!(tenant_region in ["TEST_INFRA"]))'
      userGroup: config_approver_pd
    - name: Reviewed by Backup dev
      method: ANY
      condition: '(any(split(high_risk_components, ","), { # == "backup" })) && (!(tenant_region in ["TEST_INFRA"]))'
      userGroup: config_approver_br
    - name: Reviewed by Restore dev
      method: ANY
      condition: '(any(split(high_risk_components, ","), { # == "restore" })) && (!(tenant_region in ["TEST_INFRA"]))'
      userGroup: config_approver_br
    - name: Reviewed by TiCDC dev
      method: ANY
      condition: '(any(split(high_risk_components, ","), { # == "ticdc" })) && (!(tenant_region in ["TEST_INFRA"]))'
      userGroup: config_approver_ticdc
    - name: Reviewed by TiCDC dev for Changefeed
      method: ANY
      condition: '(configuration_change_type == "changefeed") && (!(tenant_region in ["TEST_INFRA"]))'
      userGroup: config_approver_ticdc
    - name: Reviewed by TiDB Lightning dev
      method: ANY
      condition: '(any(split(high_risk_components, ","), { # == "tidb-lightning" })) && (!(tenant_region in ["TEST_INFRA"]))'
      userGroup: config_approver_lightning
    - name: Reviewed by Tiproxy dev
      method: ANY
      condition: '(any(split(high_risk_components, ","), { # == "tiproxy" })) && (!(tenant_region in ["TEST_INFRA"]))'
      userGroup: config_approver_tiproxy
  ccTasks:
    email: sihao.yu@pingcap.com

# used by cloudconfig service.
- id: cloudconfig/modify-config-ng
  nodes:
  - name: Reviewed by Region TSE
    method: ANY
    condition: '!(tenant_region in ["TEST_INFRA"])'
    fromParam:
      paramName: tenant_region
      paramValueMapping:
        APAC:
          userGroup: cloud-operation-region-admin-apac
        EMEA:
          userGroup: cloud-operation-region-admin-emea
        JAPAN:
          userGroup: cloud-operation-region-admin-japan
        NA:
          userGroup: cloud-operation-region-admin-na
        LATAM:
          userGroup: cloud-operation-region-admin-na
      defaultApprover:
        userGroup: ops-portal-admin

# used by cloudconfig service.
- id: cloudconfig/modify-template
  nodes:
  - name: Reviewed by Real World Performance
    method: ANY
    condition: 'template_type == "custom"'
    userGroup: cloud-operation-premium-admin
  - name: Reviewed by Security
    method: ANY
    condition: 'template_type == "custom"'
    emails: [zhuoran.li@pingcap.com]
  - name: Reviewed by Resilience
    method: ANY
    condition: 'template_type == "custom"'
    emails: [charles.m@pingcap.com, sihao.yu@pingcap.com]
  - name: Reviewed by Xurui
    method: ANY
    condition: 'template_type == "custom"'
    emails: [xurui@pingcap.com]
  - name: Reviewed by Region TSE
    method: ANY
    condition: '(template_type == "tenant_default") && (!(tenant_region in ["TEST_INFRA"]))'
    fromParam:
      paramName: tenant_region
      paramValueMapping:
        APAC:
          userGroup: cloud-operation-region-admin-apac
        EMEA:
          userGroup: cloud-operation-region-admin-emea
        JAPAN:
          userGroup: cloud-operation-region-admin-japan
        NA:
          userGroup: cloud-operation-region-admin-na
        LATAM:
          userGroup: cloud-operation-region-admin-na
      defaultApprover:
        userGroup: ops-portal-admin
  ccTasks:
    email: wangkang@pingcap.com

# used by jump service, no need approval now
- id: jump/jump-to-controlplane
  nodes:
  - name: Reviewed By Your Leader
    method: ANY
    condition: 'privilege == "admin"'
    applicantLeader: true

# used by jump service
- id: jump/jump-to-dataplane
  nodes:
  - name: Reviewed By Your Leader
    method: ANY
    applicantLeader: true
  - parallel:
    - name: Reviewed By Admin
      method: ANY
      condition: 'privilege == "admin" && destination_type != "byoc"'
      userGroup: jump-dataplane-admin
    - name: Reviewed By BYOC Admin
      method: ANY
      condition: 'privilege == "admin" && destination_type == "byoc"'
      userGroup: jump-byoc-admin

# used by jump service
- id: jump/jump-to-controlplane-for-oncaller
  nodes: []

# used by jump service
- id: jump/jump-to-dataplane-for-oncaller
  nodes:
  - name: Reviewed By Your Leader
    method: ANY
    condition: 'privilege == "admin"'
    applicantLeader: true
  - parallel:
    - name: Reviewed By Admin
      method: ANY
      condition: 'privilege == "admin" && destination_type != "byoc"'
      userGroup: jump-dataplane-admin
    - name: Reviewed By BYOC Admin
      method: ANY
      condition: 'privilege == "admin" && destination_type == "byoc"'
      userGroup: jump-byoc-admin

# used by automated-test, no need approval
- id: automated-test
  nodes: []

- id: privilege/request-privilege
  nodes: 
  - name: Reviewed by Fire Master
    method: ANY
    userGroup: oncall-fire-master

# used by controlplane service.
- id: deployment/aws_premium_region
  nodes:
  - name: Reviewed by Admin
    method: ANY
    userGroup: cloud-operation-premium-admin

# used by controlplane service for byoc.
- id: deployment/aws_byoc_region
  nodes:
  - name: Reviewed by Admin
    method: ANY
    userGroup: cloud-operation-premium-admin