provider: eks
controlplaneAWSProviderConfig: provider-aws # used to provision global resources such as route53 recordset and pca certificate
amiConfig:
  supportedVersions:
    - "1.27"
    - "1.28"
    - "1.29"
    - "1.30"
    - "1.31"
    - "1.32"
    - "1.33"
    - "1.34"
clusterController:
  aws:
    nodeRoleTrustPolicyFile: /etc/cluster-controller/node-trust-policy.json
    nodeRolePolicyFile: /etc/cluster-controller/node-policy.json
    nodeUserdataSystemConfigurationFile: /etc/cluster-controller/node-userdata-system-configuration/node-userdata-system-configuration.toml
    nodeRoleManagedPolicies: # AWS managed policies to attach to node role
      - "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
      - "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
      - "arn:aws:iam::aws:policy/AWSDirectConnectFullAccess"
      - "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
      - "arn:aws:iam::aws:policy/AmazonRoute53ResolverFullAccess"
      # See https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started.html for more detail.
      - "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
  configChange:
    accountEnv: prod
    activity:
      enabled: false
      activityHubEndpoint: "https://e4hr1v4oqh.execute-api.us-west-2.amazonaws.com"
      activityHubSource: "gitops"
      clinicEndpoint: "https://clinic.pingcap.com"
  clusterAgent:
    chartPath: /etc/helm/cluster-agent
    agentImage:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/cluster-agent
      tag: v0.1.9
  mysqlProtocolProbe:
    image: "380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/mysql-readiness-probe:v0.1.0"
    binaryName: "mysql-readiness-probe"
    timeoutSeconds: 5
    # Will have a maximum of 150 minutes (900 * 10 = 9000s = 150m) to finish its startup
    periodSeconds: 10
    failureThreshold: 900
  audit:
    sidecarImage: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/audit:81dc098e2ad54c6918e7c5aac80b052f532bc39f
    sidecarCommand: ["/audit", "server", "--config", "/etc/audit/audit.yaml"]
network:
  k8sVersion: "1.34"
  certmanager:
    chartPath: /etc/helm/certmanager/cert-manager-v1.10.0.tgz
    crdPaths: [/etc/helm/certmanager/cert-manager-crds-v1.10.0.yaml]
    controllerImage:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/jetstack/cert-manager-controller
      tag: v1.10.0
    webhookImage:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/jetstack/cert-manager-webhook
      tag: v1.10.0
    cainjectorImage:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/jetstack/cert-manager-cainjector
      tag: v1.10.0
  awsLoadBalancerController:
    chartPath: /etc/helm/aws-load-balancer-controller/aws-load-balancer-controller-1.6.2.tgz
    crdPaths:
      - /etc/helm/aws-load-balancer-controller/aws-load-balancer-controller-crds.yaml
    controllerImage:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/amazon/aws-load-balancer-controller
      tag: v2.6.2
  clusterAutoscaler:
    chartPath: /etc/helm/aws-cluster-auto-scaler/
    image:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/autoscaling/cluster-autoscaler
      tag: v1.25.0
  csi:
    attacher:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/sig-storage/csi-attacher
      tag: v3.1.0
    chartPath: /etc/helm/csi/aws-ebs-csi-driver
    crdPaths: null
    driver:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/ebs-csi-driver/aws-ebs-csi-driver
      tag: v1.26.0
    livenessProbe:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/sig-storage/livenessprobe
      tag: v2.4.0
    nodeDriverRegistrar:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/sig-storage/csi-node-driver-registrar
      tag: v2.3.0
    provisioner:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/sig-storage/csi-provisioner
      tag: v2.2.2
    resizer:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/sig-storage/csi-resizer
      tag: v1.1.0
  operator:
    advancedStatefulset:
      name: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/advanced-statefulset:v0.8.0
    chartPath: /etc/helm/tidb-operator/tidb-operator-v1.7.0-alpha.4
    crdPaths:
      - /etc/helm/tidb-operator/advanced-statefulset-crd.v1.yaml
      - /etc/helm/tidb-operator/tidb-operator-v1.7.0-alpha.4.yaml
    operator:
      name: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/tidb-operator
      tag: v1.7.0-alpha.4
    tidbBackupManager:
      name: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/tidb-backup-manager
      tag: v1.7.0-alpha.4
    dbMonitorProm:
      name: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/prom/prometheus
      tag: v2.11.1
    dbMonitorGrafana:
      name: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/grafana/grafana
      tag: 6.0.1
  proxy:
    chartPath: /etc/helm/proxy/cluster-proxy
    proxyImage:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/cluster-proxy
      tag: v1.2.56
    gottyImage:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/gotty
      tag: "20211103"
    allowedCidrs: ["54.188.27.23/32", "44.231.162.131/32", "100.20.198.224/32", "18.181.117.169/32", "35.72.212.231/32", "54.248.62.133/32", "52.41.43.61/32"]
    auth0Audience: "prod-proxy-service"
    auth0Domain: "tidb.auth0.com"
  clusterGateway:
    chartPath: /etc/helm/kong
    crdPaths:
      - /etc/helm/kong/crds/custom-resource-definitions.yaml
      - /etc/helm/kong/crds/gateway-api-crd-standard-install.yaml
    kongImage:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/kong/kong
      tag: "3.6"
    kongIngressControllerImage:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/kong/kubernetes-ingress-controller
      tag: "3.1"
    allowedCidrs: ["54.188.27.23/32", # base NAT
      "44.231.162.131/32", # base NAT
      "100.20.198.224/32", # base NAT
      "52.41.43.61/32", # clinic
      "18.181.117.169/32", # seed-ap-northeast-1 NAT
      "35.72.212.231/32", # seed-ap-northeast-1 NAT
      "54.248.62.133/32", # seed-ap-northeast-1 NAT
      "35.82.108.84/32", # devops-server
    ]
  dataflowAgent:
    chartPath: /etc/helm/dataflow-agent/dataflow-agent.tgz
    dataflowAgentImage:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/dataflow-agent
      tag: release-v20260330
    allowedCidrs: ["54.188.27.23/32", "44.231.162.131/32", "100.20.198.224/32", "18.181.117.169/32", "35.72.212.231/32", "54.248.62.133/32"]
  tiflowOperator:
    chartPath: /etc/helm/tiflow-operator/tiflow-operator.tgz
    crdPaths:
      - /etc/helm/tiflow-operator/tiflow-operator/crds/pingcap.com_tiflowclusters.yaml
    tiflowOperatorImage:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/tiflow-operator
      tag: 9ab11c525e3693cc92199e344f0f394233800821
    enable: true
  pcaIssuer:
    chartPath: /etc/helm/pca-issuer/aws-privateca-issuer-1.2.0-fixed.tgz
    crdPaths:
      - /etc/helm/pca-issuer/aws-pca-issuer-crd.yaml
      - /etc/helm/pca-issuer/aws-pca-clusterissuer-crd.yaml
    image:
      # TODO(tennix): this used a fork version of aws-pca-issuer https://github.com/tidbcloud/aws-pca-issuer
      # We need to update to the upstream version
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/aws-pca-issuer
      tag: latest
  sliReporter:
    chartPath: /etc/helm/sli-reporter/sli-reporter.tgz
    image:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/sli-reporter
      tag: v2.3.2
    awsRegion: us-west-2
    deliveryStreamName: "sli-prod-metrics"
    deliveryStreamRoleArn: "arn:aws:iam::557537366020:role/sli-cross-account-role"
  region: ap-northeast-1
  zones:
    - ap-northeast-1a
    - ap-northeast-1c
    - ap-northeast-1d
  apiserverPublicAccessCidrs: ["54.185.150.209/32", "54.188.27.23/32", "44.231.162.131/32", "100.20.198.224/32", "18.181.117.169/32", "35.72.212.231/32", "54.248.62.133/32", "54.250.172.151/32", # o11y regional service
    "35.82.108.84/32", # devops cluster
  ]
  o11yConfig:
    env: prod
    seedVectorURL: "http://seed-ap-northeast-1-vector-aggregator.prod.aws.tidbcloud.com:9090"
    seedVectorEpSvcName: com.amazonaws.vpce.ap-northeast-1.vpce-svc-0294cde518bfaa59e
    infraTenantID: infra-prod
    openAPIAddress: https://www.gs.us-west-2.aws.observability.tidbcloud.com
    createO11yInfraPath: /api/v1/clusters
    deleteO11yInfraPath: /api/v1/clusters
    getO11yInfraPath: /api/v1/clusters
    pauseO11yInfraPath: /api/v1/clusters
    resumeO11yInfraPath: /api/v1/clusters
    auth0GetTokenURL: https://tidb-soc2.us.auth0.com/oauth/token
    auth0Audience: https://tidb-soc2.us.auth0.com/api/v2/
    effectiveRegion: [aws-us-west-2-*, aws-eu-central-1-*, aws-ap-south-1-*, aws-ap-southeast-1-*, aws-ap-southeast-3-*, aws-ap-northeast-1-*, aws-ap-northeast-2-*, aws-us-east-1-*, gcp-us-west1-*, gcp-asia-east1-*, gcp-us-central1-*, gcp-asia-northeast1-*, gcp-asia-southeast1-*, gcp-asia-northeast2-*]
    lokiServerDns: a5bb1e2a8625f4a28b44ff9ee740ec3a-1136545906.us-west-2.elb.amazonaws.com
    version: 20221123
    eventExporter:
      image:
        repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/resmoio/kubernetes-event-exporter
        tag: v1.0
      chartPath: /etc/helm/event-exporter/event-exporter.tgz
    metricsAgent:
      image:
        repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/victoriametrics/vmagent
        tag: v1.78.0
      chartPath: /etc/helm/vmagent/victoria_metrics_agent.tgz
    clusterAgent:
      image:
        repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/vector
        tag: 0.23.X-2-debian
    logAgent:
      image:
        repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/vector
        tag: 0.23.X-2-debian
      chartPath: /etc/helm/vector/vector.tgz
    loki:
      image:
        repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/grafana/fluent-bit-plugin-loki
        tag: main-8c1095a55-1.8.15-final-multi-arch
      chartPath: /etc/helm/fluent-bit
    so11y:
      image:
        repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/prom/prometheus
        tag: v2.38.0
      chartPath: /etc/helm/prometheus/prometheus.tgz
  kubeStateMetrics:
    chartPath: /etc/helm/kube-state-metrics/kube-state-metrics.tgz
    image:
      registry: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com
      repo: third-party/kube-state-metrics/kube-state-metrics
      tag: v2.10.0
  nodeExporter:
    chartPath: /etc/helm/node-exporter/node-exporter.tgz
    image:
      registry: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com
      repo: third-party/prom/node-exporter
      tag: v1.6.1
override:
  overrideHelperImage: "380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/third-party/busybox:1.34.1"
  overrideRegistry: "380838443567.dkr.ecr.ap-northeast-1.amazonaws.com"
  overrideRepoPrefix: "tidbcloud"
  overrideThirdPartyRepoPrefix: "third-party"
audit:
  sidecarImage: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/audit:81dc098e2ad54c6918e7c5aac80b052f532bc39f
  sidecarCommand: ["/audit", "server", "--config", "/etc/audit/audit.yaml"]
# sentry:
#   dsn: https://e85c9a30f8b54ae39ecf4a7b63dea760@o226447.ingest.sentry.io/6688512
#   env: prod
mixedDeployPDWithTiKV:
  enabled: false
  affectClusterCreatedAfter: "2022-11-03T00:00:00Z"
  affectNamespaceAllowList: []
tiflowCluster:
  master:
    defaultSpecCode: master-share-2c2g-2
    expirationMinute: 120
    shareDb:
      # 'privateLinkServiceName' is deprecated, use 'serviceName' instead.
      privateLinkServiceName: com.amazonaws.vpce.ap-northeast-1.vpce-svc-0fe026eafb90fe729
      serviceName: com.amazonaws.vpce.ap-northeast-1.vpce-svc-0fe026eafb90fe729
      port: 3306
      user: admin
      password: dataflow
    imageConfig:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/tiflow
      tag: de06be9be58e3f78564b4b37f94ee72206300762
  executor:
    imageConfig:
      repo: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/tiflow
      tag: de06be9be58e3f78564b4b37f94ee72206300762
featureGates:
  network_hibernation:
    all: true
  tidb_add_index:
    all: true
  tidb_expose_oom_path_for_new_cluster:
    all: true
    enabledProjects: []
    enabledTenants: []
    disabledProjects: []
    disabledTenants: []
  tidb_expose_oom_path_for_existing_cluster:
    all: false
    enabledProjects: []
    enabledTenants: []
    disabledProjects: []
    disabledTenants: []
  tidb_dedicated_sg:
    all: true
    enabledProjects: []
    enabledTenants: []
    disabledProjects:
      - 1372813089206751291
    disabledTenants: []
  tidb_expose_replayer_path_for_new_cluster:
    all: true
    enabledProjects: []
    enabledTenants: []
    disabledProjects: []
    disabledTenants: []
  tidb_expose_replayer_path_for_existing_cluster:
    all: false
    enabledProjects: []
    enabledTenants: []
    disabledProjects: []
    disabledTenants: []
  tidb_enable_audit_log:
    all: true
  o11y_deploy_crd:
    all: true
    enabledProjects: []
    enabledTenants: []
    disabledProjects: []
    disabledTenants: []
  o11y_deploy_crd_tiflow:
    all: true
  tls_cluster:
    all: true
  tidb_enable_bootstrap_sql:
    all: true
  tiproxy_gateway:
    all: false
    enabledProjects:
      - 1372813089454525883 # PingCAP_Japan > TestTiProxyOnEKS
      - 1372813089454550833 # PingCAP_Japan > koitabashi-demo
  tidb_self_managed_node_group:
    all: true
  tidb_monitor_disabled:
    all: true
  use_bottlerocker_for_admin_nodes:
    all: true
  enable_ethtool_collecter:
    all: true
  independent_config_change:
    all: false
    enabledTenants:
      - 1372813089187791289 # dbaastest3
  scale_out_tidb_in_parallel:
    all: true
  enable_cluster_agent:
    all: true
  cluster_gateway:
    all: true
  enable_dp_compatibility_mode:
    all: true
  set_priority_class:
    all: true
mysqlProtocolProbe:
  image: "380838443567.dkr.ecr.ap-northeast-1.amazonaws.com/tidbcloud/mysql-readiness-probe:v0.1.0"
  binaryName: "mysql-readiness-probe"
  timeoutSeconds: 5
  # Will have a maximum of 150 minutes (900 * 10 = 9000s = 150m) to finish its startup
  periodSeconds: 10
  failureThreshold: 900
expFeatureGates:
  - name: "AnalyzeVersion2"
    minSupportVersion: "v6.5.0"
    command: "SET GLOBAL tidb_analyze_version=2;"
    featureGate:
      all: true
      enabledProjects: []
      enabledTenants: []
      disabledProjects: []
      disabledTenants: []
  - name: "RuntimeFilterMode"
    minSupportVersion: "v7.3.0"
    command: "SET GLOBAL tidb_runtime_filter_mode=LOCAL;"
    featureGate:
      all: true
      enabledProjects: []
      enabledTenants: []
      disabledProjects: []
      disabledTenants: []
tiproxyConfig:
  projects:
    1372813089454525883:
      standalone: true
      replicas: 3
      instanceType: "c6g.large"
      tidbSSL: true
      crossaz: true
  clusters:
    1379661944644934074:
      standalone: true
      replicas: 2
      instanceType: "c6g.large"
      tidbSSL: true
      crossaz: true
configServiceEndpoint: http://adffa969f7149406b84145c461c3670a-344077277.us-west-2.elb.amazonaws.com:8090
storageClassConfigFile: /etc/cluster-controller/storageclass/storageclass-config.yaml
instanceTypeConfigFile: /etc/cluster-controller/instancetype/instancetype-config.yaml
predicate:
  matchLabels:
    cloud.pingcap.com/provider-type: eks
    cloud.pingcap.com/region: ap-northeast-1
  matchExpressions:
    - key: "cloud.pingcap.com/reconciler"
      operator: "DoesNotExist"
fullManage:
  project: prod
  publicHostedZoneDomain: clusters.tidb-cloud.com
  publicHostedZoneID: Z09521541042LFILW1KL4
  serviceRoleARN: "arn:aws:iam::380838443567:role/full-manager-eks-role"
  serviceRoleName: "full-manager-eks-role"
  assumeRoleName: "full-manager-service-role"
  awsClusterServerRoleName: "prod-ap-northeast-1-cluster-server"
  awsClusterServerRoleARN: "arn:aws:iam::380838443567:role/prod-ap-northeast-1-cluster-server"
  assumeRoleARN: "arn:aws:iam::380838443567:role/full-manager-service-role"
  componentPCAARN: arn:aws:acm-pca:us-west-2:380838443567:certificate-authority/ed5106d3-0890-4af9-bd60-b6df4f6299ca
  assumeRoleExternalID: "123"
  readonlyAssumeRoleName: "readonly-prod-ap-northeast-1-cluster-controller-assumed-role"
maxConcurrentReconciles:
  network: 5
  cluster: 15
  networkPeer: 5
  clusterNodeProtector: 5
  eksConnection: 5
  frpServer: 5
  privateLink: 5
  privateLinkEndpoint: 5
hibernation:
  enabled: true
configChangeConfig:
  accountEnv: prod
  activity:
    enabled: false
    activityHubEndpoint: "https://e4hr1v4oqh.execute-api.us-west-2.amazonaws.com"
    activityHubSource: "gitops"
    clinicEndpoint: "https://clinic.pingcap.com"
dpCompatEnv: prod
dpCompatAssumeRole: full-manager-service-role
dpCompatAssumeExternalId: "123"
dpCompatDataPlaneRoleArn: arn:aws:iam::380838443567:role/full-manager-service-role