basic:
  role: arn:aws:iam::[[ o11y_account ]]:role/auto-deploy-cli
  outputBucket: [[ output_bucket ]]
  dAccountRoles:
  [%- for account in d_accounts %]
    - arn:aws:iam::[[ account ]]:role/auto-deploy-cli
  [%- endfor %]
eks:
  version: "1.35"
  template-path: etc/k8s-templates/eks-v1.yaml
  tags:
    servicetype: o11y
    usedby: o11y-region-control
    tenant: admin
  admin-roles:
    - cicd-role
    - autonomous-oncall
    - arn:aws:iam::557537366020:role/jump-service-role
  availabilityZones: '{{ getAvailabilityZonesN 2 | awsAzId2Name "" }}'
  vpc: # see https://eksctl.io/usage/schema/#vpc
    cidr: 10.1.0.0/16
    nat:
      gateway: Single
    clusterEndpoints:
      privateAccess: true
      publicAccess: true
    publicAccessCIDRs:
      - 0.0.0.0/0
  node-groups: # see https://eksctl.io/usage/schema/#managedNodeGroups
    - name: worker
      amiFamily: Bottlerocket
      instanceType: "[[ o11y_instance_type ]]"
      desiredCapacity: 3
      maxSize: 10
      maxPodsPerNode: 110
      availabilityZones:
        - '{{ getAvailabilityZoneIndex 0 | awsAzId2Name "" }}'
      privateNetworking: true # must set to true
      labels:
        node_type: worker
      iam:
        attachPolicyARNs:
          - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
          - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
          - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
          - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
          - arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy
          - arn:aws:iam::[[ o11y_account ]]:policy/autonomous-o11y-rs-data
          - arn:aws:iam::[[ o11y_account ]]:policy/autonomous-o11y-rs-control
  addons:
    # query latest version:
    # aws eks describe-addon-versions --profile=dev --region ap-southeast-2 --kubernetes-version 1.33 --query "addons[].addonVersions[0].addonVersion" --addon-name metrics-server
    - name: vpc-cni
      version: "latest"
      attachPolicyARNs:
        - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
      configurationValues: |
        {
          "env": {
            "ENABLE_PREFIX_DELEGATION": "true"
          }
        }
    - name: coredns
      version: latest
    - name: kube-proxy
      version: latest
    - name: metrics-server
      version: latest
    - name: aws-ebs-csi-driver
      version: latest
      wellKnownPolicies:
        ebsCSIController: true
# jobOptions support go template syntax in STRING value
# and support extral functions:
# 1. getHostedZoneId name: get hosted zone id by name
# 2. getLoadBalancerHostedZoneId region: get elb hosted zone id by region name, such as us-west-2
# 3. getAvailabilityZones region: get availability zones by region name
# 4. getAwsRoleArn role: get role arn on m-account
jobOptions:
  jumpServer:
    enabled: true
    role: arn:aws:iam::[[ o11y_account ]]:role/jump-service-role
  dms:
    snsTopicArn: arn:aws:sns:us-west-2:557537366020:DMS-3057ba5
  o11y:
    dns:
      hostedZoneName: observability.tidbcloud.com
      rsDomainName: www.rs.{{ .Name }}.aws.observability.tidbcloud.com
      dsDomainName: www.ds.{{ .Name }}.aws.observability.tidbcloud.com
    zone: '{{ getAvailabilityZoneIndex 0 | awsAzId2Name ""}}'
    elbAccountIdForS3BucketPolicy: "{{ getS3PolicyElbAccount }}"
    enableRDS: [[ enable_rds ]]
    RDSInstanceClass: db.t4g.large
    nlbAllowedPrincipals:
      - arn:aws:iam::143458967504:root
      - arn:aws:iam::730335266318:root
      - arn:aws:iam::380838443567:root
      - arn:aws:iam::385595570414:root