basic:
  mAccountRole: arn:aws:iam::[[ m_account ]]:role/auto-deploy-cli
  outputBucket: dev-auto-deploy
  tfStateBucket: [[ tf_state_bucket ]]
  dAccountRoles:
    - arn:aws:iam::[[ d_account ]]:role/auto-deploy-cli
forGlobal:
  openedTenantIds: []
  isPublic: false
  sortPriority: 1999
eks:
  version: "1.35"
  template-path: etc/k8s-templates/eks-v1.yaml
  tags:
    environment: dev
    servicetype: byoc
    usedby: dbaas-control-plane-seed
    tenant: admin
    tidbcloud-auto-deploy-owner: "[[ resouce_owner_tag ]]"
  admin-roles:
    - cicd-role
    - argocd-oidc-role
    - full-manager-service-role
    - dbaas-dev
    - dbaas-dev-readonly
    - dbaas-central-role-dev
    - arn:aws:iam::552185537300:role/devops-server-dev
  availabilityZones: '{{ awsAzId2Name "" "[[ availability_zones ]]" }}'
  vpc: # see https://eksctl.io/usage/schema/#vpc
    cidr: 10.1.0.0/16
    nat:
      gateway: Single
    clusterEndpoints:
      publicAccess: true
    publicAccessCIDRs:
      - 0.0.0.0/0
  node-groups: # see https://eksctl.io/usage/schema/#managedNodeGroups
    - name: worker
      amiFamily: Bottlerocket
      instanceType: "[[ seed_instance_type ]]"
      desiredCapacity: 1
      maxSize: 10
      privateNetworking: true # must set to true
  addons:
    - name: vpc-cni
      version: latest
      attachPolicyARNs:
        - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
    - name: coredns
      version: latest
    - name: kube-proxy
      version: latest
    - name: aws-ebs-csi-driver
      version: latest
      wellKnownPolicies:
        ebsCSIController: true
      configurationValues: |
        controller: # set extral tags on pvc
          extraVolumeTags:
            environment: dev
            servicetype: dedicated
            usedby: dbaas-control-plane-seed
            tenant: admin
# job Options support go template syntax in STRING value
# and support extened functions:
# 1. getHostedZoneId name: get hosted zone id by name
# 2. getLoadBalancerHostedZoneId: get current region  elb hosted zone id
# 3. getAvailabilityZones: get current region availability zones
# 4. getAwsRoleArn role: get role arn on m-account
jobOptions:
  isByoc: "true"
  resourceOwnerTag: "[[ resouce_owner_tag ]]"
  dataplaneManager:
    dnsName: '{{ .Name }}.regional-api.dev.aws.tidbcloud.com'
    hostedZone: dev.aws.tidbcloud.com
    hostedZoneId: '{{ getHostedZoneId "dev.aws.tidbcloud.com" }}'
    loadBalancerHostedZoneId: '{{ getLoadBalancerHostedZoneId }}'
    availabilityZones: '{{ awsAzId2Name "[[ d_account ]]" "[[ availability_zones ]]" }}'
    publicHostedZoneDomain: [[ byoc.tidb_hosted_zone ]]
    defaultDataplaneAccount: [[ d_account ]]
    auth0Audience: dev-proxy-service
    auth0Domain: tidb-dev.us.auth0.com
    tidbImageRegistry: "[[ byoc.ecr ]]"
    dataplaneAssumedRole: tidbcloud-dataplane-manager-assumed-role
    eksServiceRoleName: tidbcloud-eks-service-role
    nodeRoleName: tidbcloud-eks-node-role
    globalControlplaneIPs:
      - 54.148.240.60/32       # global base IPs
      - 54.71.2.116/32         # global base IPs
      - 52.13.110.238/32       # global base IPs
      - 44.245.243.63/32       # new jump server
    o11yRegionalServiceIPs: []
    clinicIPs:
      - 35.83.225.251/32
    bastionIPs:
      - 0.0.0.0/0              # allow all ip access k8s
    authorizedSubjects: []
  secrets:
    o11yAuth0Secret: dev-o11y-auth0-client
  jumpServer:
    enabled: true
    role: arn:aws:iam::385595570414:role/dbaas-dev
  ng-service:
    rds:
      [% for k, v in rds.items() %]
      [[ k ]]: [[ v ]]
      [% endfor %]
    enable_pca: [[ byoc.pca_arn != "" ]]
    pcaArn: "[[ byoc.pca_arn ]]"
  o11y: # controlplane-o11y-agent options
    enabled: false
    globalEndpoint: www.gs.us-west-2.aws.observability.tidbcloud.com
    tenantId: infra-dev
    projectId: seed
    ruleTemplateId: tidb-cloud-control-plane-dedicated-seed-rule
    privateLinkZone: '{{ awsAzId2Name "" "[[ first_availability_zone ]]" }}'
  sli:
    firehouseRoleArn: arn:aws:iam::[[ d_account ]]:role/tidbcloud-sli-firehose-role
  metering:
    writeOnlyRoleName: tidbcloud-metering-write-only-role
    readWriteRoleName: tidbcloud-metering-read-write-role
    billingSQSArn: arn:aws:sqs:us-west-2:385595570414:billing-report-nightly
  o11yEksOptions:
    k8s_version: "1.35"
    cidr: 10.1.0.0/16
    availability_zones: '{{ awsAzId2Name "[[ d_account ]]" "[[ availability_zones ]]" }}'
    clinic_endpoint_service_name: com.amazonaws.vpce.us-west-2.vpce-svc-0505bca8b8f57fd21
    auth_roles: []
    cluster_role_name: tidbcloud-o11y-eks-cluster-role
    node_role_name: tidbcloud-o11y-eks-node-role
    public_access_cidrs:
      - 0.0.0.0/0
    node_groups:
      worker:
        name: worker
        use_name_prefix: false
        instance_types: ["[[ o11y_instance_type ]]"]
        availability_zones: ['{{ awsAzId2Name "[[ d_account ]]" "[[ first_availability_zone ]]" }}']
        labels:
          node_type: worker
    tags:
        environment: dev
        servicetype: o11y
        usedby: o11y-region-control
        tenant: admin
        tidbcloud-auto-deploy-owner: "[[ resouce_owner_tag ]]"
  o11yRegion:
    elbAccountIdForS3BucketPolicy: '{{ getS3PolicyElbAccount }}'
    nlbAllowedPrincipals:
    - arn:aws:iam::[[ d_account ]]:root
    zone: '{{ awsAzId2Name "[[ d_account ]]" "[[ first_availability_zone ]]" }}'
    deployRoleArn: arn:aws:iam::552185537300:role/auto-deploy-cli
    snsTopicArn: arn:aws:sns:us-west-2:552185537300:DMS-edcf439
    imageRegistry: "[[ byoc.ecr ]]"
    dns:
      hostedZoneName: [[ byoc.o11y_hosted_zone]]
    clinicUrl: http://dev-clinic.pingcap.com:8085
    byocTenantID: '[[ byoc.tenant_id ]]'
    clinicSecretID: clinic-auto-deploy-token
    rsImage: "[[ byoc.ecr ]]/observability-regional-server:dev-a3eb71171cd1b6aa7ebe45239395f9da65abbcad"
    dsImage: "[[ byoc.ecr ]]/observability-regional-data-server:dev-a3eb71171cd1b6aa7ebe45239395f9da65abbcad"
    roleName: tidbcloud-o11y-control-plane-role
    preSetAgentRole: arn:aws:iam::[[ d_account ]]:role/tidbcloud-o11y-agent-role
  vector:
    o11yRoleArn:
      - arn:aws:iam::[[ o11y_account ]]:role/*