basic:
  mAccountRole: arn:aws:iam::[[ m_account ]]:role/auto-deploy-cli
  outputBucket: prod-auto-deploy-3567
  tfStateBucket: prod-auto-deploy-tf-state-3567
  dAccountRoles:
  [%- for account in d_accounts %]
    - arn:aws:iam::[[ account ]]:role/auto-deploy-cli
  [%- endfor %]
forGlobal:
  openedTenantIds: []
  isPublic: false
  sortPriority: 1999
eks:
  version: "1.35"
  template-path: etc/k8s-templates/eks-v1.yaml
  tags:
    environment: prod
    servicetype: dedicated
    usedby: dbaas-control-plane-seed
    tenant: admin
  admin-roles:
    - cicd-role
    - argocd-oidc-role
    - bastion-5fddc83
    - dbaas-prod-devops
    - dbaas-central-role-prod
  availabilityZones: '{{ getAvailabilityZonesN 3 | awsAzId2Name "" }}'
  vpc: # see https://eksctl.io/usage/schema/#vpc
    cidr: 10.1.0.0/16
    nat:
      gateway: HighlyAvailable # Single | HighlyAvailable
    clusterEndpoints:
      privateAccess: true
      publicAccess: true
    publicAccessCIDRs:
      - "54.185.150.209/32"  # bastion IPs
      - "104.196.246.224/32" # github runner IPs
      - "35.233.250.206/32"  # github runner IPs
      - "34.69.36.199/32"    # argocd IPs
      - "35.82.108.84/32"    # new jump server IPs
      - "54.188.27.23/32"    # global IPs
      - "44.231.162.131/32"  # global IPs
      - "100.20.198.224/32"  # global IPs
  node-groups: # see https://eksctl.io/usage/schema/#managedNodeGroups
    - name: worker
      amiFamily: Bottlerocket
      instanceType: "[[ seed_instance_type ]]"
      desiredCapacity: 1
      maxSize: 10
      privateNetworking: true # must set to true
  addons:
    - name: vpc-cni
      version: "latest"
      attachPolicyARNs:
        - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
    - name: coredns
      version: "latest"
    - name: kube-proxy
      version: "latest"
    - name: aws-ebs-csi-driver
      version: "latest"
      wellKnownPolicies:
        ebsCSIController: true
# job Options support go template syntax in STRING value
# and support extened functions:
# 1. getHostedZoneId name: get hosted zone id by name
# 2. getLoadBalancerHostedZoneId: get current region  elb hosted zone id
# 3. getAvailabilityZones: get current region availability zones
# 4. getAwsRoleArn role: get role arn on m-account
jobOptions:
  regionalServer:
    dnsName: '{{ .Name }}.regional-api.prod.aws.tidbcloud.com'
    hostedZone: prod.aws.tidbcloud.com
    hostedZoneId: Z08648051F27XQI0DF51K
    loadBalancerHostedZoneId: '{{ getLoadBalancerHostedZoneId }}'
    availabilityZones: '{{ getAvailabilityZonesN 3 | awsAzId2Name "" }}'
    publicHostedZoneDomain: clusters.tidb-cloud.com
    publicHostedZoneID: Z09521541042LFILW1KL4
    defaultDataplaneAccount: "{{ (index .TidbClusterAccounts 0).AwsRole.AccountId }}"
    auth0Audience: prod-proxy-service
    auth0Domain: tidb.auth0.com
    globalControlplaneIPs:
      - 54.188.27.23/32        # global base IPs
      - 44.231.162.131/32      # global base IPs
      - 100.20.198.224/32      # global base IPs
      - 35.82.108.84/32        # new jump server IPs
    o11yRegionalServiceIPs: []
    clinicIPs:
      - 52.41.43.61/32
    bastionIPs:
      - 54.185.150.209/32
    authorizedSubjects:
      - arn:aws:iam::557537366020:role/devops-server-prod
    o11yRegionalServiceEndpoint: 'https://www.rs.{{ .Region }}.aws.observability.tidbcloud.com'
  clusterServer:
    clusterProxy:
      auth0Audience: prod-proxy-service
      auth0Domain: tidb.auth0.com
      enableDevMode: false
    configChange:
      activityClinicEp: https://clinic.pingcap.com
      activityEnabled: false
      activityHubEp: https://e4hr1v4oqh.execute-api.us-west-2.amazonaws.com
      activitySource: gitops
      env: prod
    fullManage:
      pcaArn: arn:aws:acm-pca:us-west-2:[[ m_account ]]:certificate-authority/ed5106d3-0890-4af9-bd60-b6df4f6299ca
    secrets:
      clusterProxyAuth0SecretKey: prod-proxy-auth0-client
      o11yAuth0Secret: prod-o11y-auth0-client
      configManagerAuthKey: prod-config-manager-account-xregion-auth-key
      configManagerClinicActivityKey: prod-config-manager-clinic-activity-key
  dpProvider:
    wafIpSetName: DBaas-Whitelist-For-Prod-Inner
    secretManager:
      infraAPIServerKey: prod-dedicated-infra-kubeconfig
      apiGatewayKey: prod-dp-compat-xregion-auth-key
    disabled: false
  jumpServer:
    enabled: true
    role: arn:aws:iam::380838443567:role/dbaas-prod-devops
  ng-service:
    disabled: true
  o11y:
    enabled: false
    auth0SecretID: prod-o11y-auth0-client
    globalEndpoint: www.gs.us-west-2.aws.observability.tidbcloud.com
    privateLinkZone: '{{ getAvailabilityZoneIndex 0 | awsAzId2Name "" }}' # first az
    projectId: seed
    ruleTemplateId: tidb-cloud-control-plane-dedicated-seed-rule
    tenantId: infra-prod
  vector:
    o11yRoleArn:
      - arn:aws:iam::[[ o11y_account ]]:role/*