basic:
  imageRegistry: tidbcloudprod.azurecr.io
  outputBlobEndpoint: https://prodautodeploymeta.blob.core.windows.net/job-input-output
  terraformStateBlobEndpoint: https://prodautodeploymeta.blob.core.windows.net/tf-meta
  dAccountSubscriptionIds:
  [%- for subscription_id in d_account_subscription_ids %]
    - [[ subscription_id ]]
  [%- endfor %]
forGlobal:
  openedTenantIds: []
  isPublic: false
  sortPriority: 1999
aks:
  # see https://learn.microsoft.com/en-us/azure/templates/microsoft.containerservice/managedclusters?pivots=deployment-language-bicep#managedclusteraadprofile
  # 'managed' is set to true default
  aadProfile:
    adminGroupObjectIDs:
      - 69500f83-4674-4aad-b082-7d95d93f8c2c # prod-control-plane-services
  agentPools:
  # see https://learn.microsoft.com/en-us/azure/templates/microsoft.containerservice/managedclusters?pivots=deployment-language-bicep#managedclusteragentpoolprofile
  # default values:
  #   count: 1
  #   vmSize: 'Standard_DS2_v2'
  #   osDiskSizeGB: 32
  #   osSKU: 'AzureLinux'
  #   type: 'VirtualMachineScaleSets'
  #   upgradeSettings:
  #     maxSurge: '10%'
    - name: 'control'
      mode: 'System' # at least one pool mode is System
      osDiskSizeGB: 128
      enableAutoScaling: true
      minCount: 3
      maxCount: 10
  publicAccessCidrs:
    - 0.0.0.0/0
  tags:
    environment: prod
    servicetype: dedicated
    tenant: admin
    usedby: dbaas-control-plane-seed
  templatePath: etc/k8s-templates/aks-v1.bicep
  version: "1.35"
  vnet:
    addressSpace: 10.0.0.0/12
    serviceCidr: 172.16.0.0/16
    dnsServiceIp: 172.16.0.10
    outboundType: UserAssignedNATGateway
    subnets:
      - name: subnet
        addressPrefix: 10.0.0.0/17
        associatedGatway: true
      - name: api-server
        addressPrefix: 10.0.128.0/28
        delegation: Microsoft.ContainerService/managedClusters
jobOptions:
  awsAccountRole: arn:aws:iam::[[ m_account ]]:role/auto-deploy-cli
  regionalResource:
    controlplaneRootDnsName: prod.azure.tidbcloud.com
    dataplaneRootDnsName: prod.azure.tidb-cloud.com
  clusterServer:
    clusterProxy:
      auth0Audience: prod-proxy-service
      auth0Domain: tidb.auth0.com
      enableDevMode: false
    configChange:
      activityClinicEp: https://clinic.pingcap.com
      activityEnabled: false
      activityHubEp: https://e4hr1v4oqh.execute-api.us-west-2.amazonaws.com
      activitySource: gitops
      env: prod
    fullManage:
      pcaArn: arn:aws:acm-pca:us-west-2:[[ m_account ]]:certificate-authority/ed5106d3-0890-4af9-bd60-b6df4f6299ca
  initKeyVault:
    awsSecrets:
      - prod-config-manager-account-xregion-auth-key
      - prod-config-manager-clinic-activity-key
      - prod-dp-compat-xregion-auth-key
      - prod-o11y-auth0-client
      - prod-proxy-auth0-client
    awsRegion: us-west-2
  jumpServer:
    enabled: true
    clientId: d9777f90-ceab-4355-b14e-24f874733191
  o11y:
    enabled: false
    auth0SecretID: prod-o11y-auth0-client
    globalEndpoint: www.gs.us-west-2.aws.observability.tidbcloud.com
    tenantId: infra-prod
    projectId: seed
    ruleTemplateId: tidb-cloud-control-plane-dedicated-seed-rule
  regionalServer:
    dnsName: 'regional-api.{{ .Name }}.prod.azure.tidbcloud.com'
    availabilityZones: '{{ getAvailabilityZonesN 3 }}'
    defaultDataplaneSubscription: "{{ (index .TidbClusterAccounts 0).AzureClientId.SubscriptionId }}"
    auth0Audience: prod-proxy-service
    auth0Domain: tidb.auth0.com
    azureAdminGroupObjectIds:
      - 69500f83-4674-4aad-b082-7d95d93f8c2c # prod-control-plane-services
    globalControlplaneIPs:
      - 54.188.27.23/32        # global base IPs
      - 44.231.162.131/32      # global base IPs
      - 100.20.198.224/32      # global base IPs
      - 35.82.108.84/32        # new jump server IPs
    o11yRegionalServiceIPs: []
    clinicIPs:
      - 52.41.43.61/32
    bastionIPs:
      - 54.185.150.209/32
    o11yRegionalServiceEndpoint: "https://www.rs.{{ .Region }}.azure.observability.tidbcloud.com"