encryptionsalt: v1:gF5orucaNGg=:v1:2NwbVvL+mer7DIpA:YtV3VLVMY2ofW3s6bcXsUqpDwFxA3g==
config:
  aws:region: mx-central-1
  eks-freetier:admin-roles:
    - cicd-role
    - bastion-5fddc83
    - argocd-oidc-role
    - dbaas-prod-devops
  eks-freetier:auth0Audience: prod-proxy-service
  eks-freetier:auth0Domain: tidb.auth0.com
  eks-freetier:cidrBlock: 10.0.0.0/16
  eks-freetier:dbaas-proxy-image: 380838443567.dkr.ecr.us-west-2.amazonaws.com/dbaas/prod/cluster-proxy:v1.2.60
  eks-freetier:base-k8s-outbounds-cidrs:
    - "54.188.27.23/32"
    - "44.231.162.131/32"
    - "100.20.198.224/32"
  eks-freetier:env: prod
  eks-freetier:regional-infra: true
  # disable tiflash-wn S3 infra: its bucket policy uses Principal "*" which the new
  # mx-central-1 account's account-level S3 Block Public Access (BlockPublicPolicy)
  # rejects (AccessDenied on PutBucketPolicy for prod-mx-central-1-f01-tiflash).
  eks-freetier:disable-tiflash-wn-infra: true
  # numberOfAvailabilityZones left at default (3): VPC reserves subnets in all of
  # mx-central-1a/b/c so future multi-AZ expansion needs no VPC re-layout. Workloads
  # run only in primary for now (standby/witness replicas all 0).
  eks-freetier:stage: "tidb-serverless"
  eks-freetier:k8s-version: "1.34"
  # ESO >= v0.18.1 required for the new mx-central-1 region:
  #   - v0.18.0 is the first release resolving regions via aws-sdk-go-v2 secretsmanager
  #     endpoints (older charts' aws-sdk rejects the store: "region not found: mx-central-1").
  #   - but v0.18.0 has a regression where the IRSA/JWT (AssumeRoleWithWebIdentity) STS
  #     client ignores spec.provider.region -> "Invalid Configuration: Missing Region".
  #     Fixed in v0.18.1 (external-secrets PR #4940 / issue #4934).
  # v0.18.1 still serves ClusterSecretStore v1 (not v1beta1), matching the provider's
  # tidb-gateway:external-secrets-store-api-version=v1 override.
  eks-freetier:external-secrets-version: "v0.18.1"
  eks-freetier:ca-image: "380838443567.dkr.ecr.us-east-1.amazonaws.com/dbaas/nightly/cluster-autoscaler"
  eks-freetier:ca-version: "0241dd5d0aa8fad250d24c8b822b206e406b289b"
  eks-freetier:eks-releases:
    34v260527:
      ami:
        amd64: ami-014aa8e2b2d613538 # amazon-eks-node-al2023 1.34 mx-central-1 v20260527
        arm64: ami-016f8ca75585d591d # amazon-eks-arm64-node-al2023 1.34 mx-central-1 v20260527
      releaseVersion: 1.34.8-20260527
  eks-freetier:ca-releaseTag: "34v260527"
  eks-freetier:ca-costOptimization: true
  eks-freetier:public-access-cidrs:
    # Bastion
    - 54.185.150.209/32
    # Jenkins
    - 104.196.246.224/32
    - 35.233.250.206/32
    # Argo CD
    - 34.69.36.199/32
    # Base us-west-2
    - 54.188.27.23/32
    - 44.231.162.131/32
    - 100.20.198.224/32
    # o11y
    - 52.72.84.40/32
    # Jump Service
    - 35.82.108.84/32
  eks-freetier:public-hosted-zone-domain: prod.aws.tidbcloud.com
  eks-freetier:public-hosted-zone-id: Z08648051F27XQI0DF51K
  eks-freetier:region: mx-central-1
  eks-freetier:primary-zone: mx-central-1a
  eks-freetier:standby-zone: mx-central-1b # provisioned for future expansion; 0 nodes now
  eks-freetier:witness-zone: mx-central-1c # provisioned for future expansion; 0 nodes now
  eks-freetier:suffix: f01
  eks-freetier:index: "01"
  eks-freetier:tidb-operator-tag: 74508dc5061419e57fb25ecc2f412d7d1df67cea
  eks-freetier:tidb-operator-image: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/serverless/tidb-operator
  eks-freetier:downThreshold: 0.7
  eks-freetier:pca-arn: arn:aws:acm-pca:us-west-2:380838443567:certificate-authority/ed5106d3-0890-4af9-bd60-b6df4f6299ca
  eks-freetier:pca-region: us-west-2
  eks-freetier:serverless-cse-master-key-id: "alias/prod-mx-central-1-f01-key"
  eks-freetier:serverless-cse-master-key-cipher-text: "AQIDAHhjonGHGJ8aHyo4YVsqIkOxRqhPzXtSLwd04U+9LtWVPQEC64GLvl+8dNmD99erJwunAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMN0gn+H1CYs/fcP6pAgEQgDvYv5Pk945MCz9VY0lteh/lYiC3cgzpwcI9BpQSashDJnhjgM3QqJ35N9pwCFJIL8ccNWdQrfjSdVwjKQ==" # CSE master-key data key, generated from alias/prod-mx-central-1-f01-key (kms stage)
  eks-freetier:serverless-cse-master-key-vendor: "aws"
  eks-freetier:serverless-tikv-per-keyspace-configs: "{keyspace = 101036, split-size-factor = 2.0}"
  eks-freetier:serverless-tikv-config:
    # multiAZ left enabled (default): serverless ASGs span all 3 AZs (empty in standby/witness).
    # tikv pods stay primary-only via the single primary tikv group below.
    walSyncDir: "/var/lib/tikv-raft-wal"
    enableSafePointV2: true
    disableSafePointFallBackV1: true
    pushMetricsAddr: "http://serverless-metering.serverless-metering:9091"
    pushMetricsInterval: 30
    buildColumnar: true # kept true per operator (columnar readnode disabled, TiKV still builds columnar)
    buildFtsIndex: true
    storageVolumes:
      - storageClassName: "io2-500"
        storageSize: "10Gi"
        name: "raft-wal"
      - storageClassName: "ebs-sc"
        storageSize: "30Gi"
        name: "raft-db"
    blacklist:
      enableRollingUpdate: false
      keyspaceNames: []
      regionIDs: []
    failoverReplicasPerFailureStore: 2
    canaryUpgrade:
      enabled: true
      clusterReadySeconds: 900
      stageReadySeconds: 300
      stagePercents: [ 10, 67, 100 ]
    autoScaling:
      enabled: true
      paused: false
      maxReplicas: 9
      cpu:
        maxThreshold: 0.7
        minThreshold: 0.3
        scaleInIntervalSeconds: 900
        scaleOutIntervalSeconds: 600
      storage:
        maxThreshold: 0.8
        minThreshold: 0.6
        scaleInIntervalSeconds: 500
        scaleOutIntervalSeconds: 1
    scaleInProtection:
      enabled: true
      storageThreshold: 0.8
      minReplicas: 1
    storeLimit:
      enabled: true
      unbalanceThreshold: 0.7
      normalRate: 64
      scalingInRate: 128
      scalingOutRate: 128
    hotCluster: # kept as-is per operator (hot tikv tier removed; hot autoscaling config retained)
      enabled: true
      scaleToZero: true
      initialReplicas: 2
      cpuThreshold: 0.5
      hotDurationSeconds: 120
      hotRegionSeconds: 180
      coldRegionSeconds: 480
      autoScaling:
        cpu:
          maxThreshold: 0.6
          minThreshold: 0.2
          scaleInIntervalSeconds: 600
          scaleOutIntervalSeconds: 180
    workerReleaseTag: "34v260527"
    worker:
      replicas:
        min: 1
        max: 100
      resources:
        limits:
          cpu: 4000m
          memory: 7Gi
        requests:
          cpu: 1000m
          memory: 2Gi
    copWorker:
      replicas:
        min: 1
        max: 100
      resources:
        limits:
          cpu: 4000m
          memory: 31Gi
        requests:
          cpu: 1000m
          memory: 4Gi
          storage: 100Gi
    tikvApi:
      releaseTag: "34v260527"
      sharedPoolEnabled: true
    schemaManager:
      replicas: 1
    # replicationWorker disabled for this region (block omitted -> cdc.ts gates on replicas and creates nothing)
    runtimeConfig:
      - name: memoryLimit
        value: "Math.max(Math.round(${memory} * 0.8), ${memory} - 8) + 'Gi'"
      - name: storageSize
        value: "(${instanceStorage} ? ${instanceStorage} - 150 : 0) + 'Gi'"
  eks-freetier:serverless-cse-archive-config:
    suspend: false
  eks-freetier:serverless-cse-dfsgc-config:
    suspend: false
  eks-freetier:serverless-cop-worker-cache-size: 16GB
  eks-freetier:serverless-cop-worker-stateful-cache-size: 8GB
  eks-freetier:serverless-cop-worker-block-cache-size: 8GB
  eks-freetier:serverless-cop-worker-hpa-cpu-avg-util: 40
  eks-freetier:serverless-namespace: tidb-serverless

  # req#10: PD API mode + microservices OFF.
  #   pdMode "" -> PD_SERVICE_MODE="" (monolithic PD, not api/microservice mode).
  #   tso / sche / resource-manager servers are NOT created: their image tags are omitted, and
  #   serverless.ts now gates tso & sche creation on their imageTag (resource-manager was already gated).
  #   NOTE: pdMode="" is not yet runtime-verified; confirm it yields monolithic PD at the serverless stage.
  eks-freetier:pd-cluster:
    apiServerReleaseTag: "34v260527"
    pdBaseImage: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/serverless/pd
    pdMode: ""
    pdServerImageTag: 20260507-c7b45b8cf72f9337eb99a981a327218e614a67d3 # match release-0.61 ap-south-1-f01
    pdServerStorageSize: "50Gi"
    enableResourceManagerProxy: false
    multiAZ:
      replicas: [3, 0, 0] # primary-only now (3 PD in primary AZ); change to [1,1,1] to go multi-AZ later
  # keyspace-etcd-group is PERMANENTLY disabled for this region (operator: never enable; not needed here).
  # Do NOT bump to 1 at finalize — this region intentionally overrides the standard create-region finalize step.
  # keyspace-etcd-group-spec omitted (unused while count stays 0).
  eks-freetier:keyspace-etcd-group-count: 0

  eks-freetier:serverless-tikv-base-image: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/serverless/tikv
  eks-freetier:serverless-tikv-version: v26.3.5
  eks-freetier:serverless-tikv-worker-version: v26.3.6
  eks-freetier:serverless-tidb-base-image: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/serverless/tidb
  eks-freetier:serverless-tidb-version: d349efce65582e71bc46d9d4356c6eb426074a71
  eks-freetier:general-guaranteed-fleet:
    - tier: "standard"
      name: "guaranteed-2xl" # req#14: critical-services on 2xl (4xl/8xl dropped)
      releaseTag: "34v260527"
      instanceTypes: ["m6g.2xlarge", "m7g.2xlarge", "m6i.2xlarge", "m7i.2xlarge"]
      primary:
        min: 0
      standby:
        min: 0
      witness:
        min: 0
    - tier: "standard"
      name: "guaranteed-xl"
      releaseTag: "34v260527"
      instanceTypes: ["m6g.xlarge", "m7g.xlarge", "m6i.xlarge", "m7i.xlarge"]
      primary:
        min: 0
      standby:
        min: 0
      witness:
        min: 0
    - tier: "standard"
      name: "guaranteed-4xl"
      releaseTag: "34v260527"
      instanceTypes: ["m6g.4xlarge", "m7g.4xlarge", "m6i.4xlarge", "m7i.4xlarge"]
      primary:
        min: 0
      standby:
        min: 0
      witness:
        min: 0
  eks-freetier:general-guaranteed-nodegroup:
    category: "control-plane"
    component: "critical-services"
    min: 0
    zones: ["primary", "standby", "witness"]
  eks-freetier:memory-burstable-fleet:
    - tier: "standard"
      name: "memory-burstable"
      releaseTag: "34v260527"
      primary:
        min: 0
      standby:
        min: 0
  eks-freetier:memory-burstable-nodegroup:
    category: "control-plane"
    component: "burstable"
    min: 0
    instanceTypes: ["r6g.2xlarge", "r7g.2xlarge", "r6i.2xlarge", "r7i.2xlarge"]
    capacityType: "MIXED"
    mixedAsgOptions:
      alternativeAutoReplace: true
      alternativeParallelScaleUp: true
      alternativeScaleUpWait: "60s"
  eks-freetier:tidb-fleet:
    - tier: "standard"
      name: "tidb-x2xl" # req#12: tidb x2xl only, MIXED
      releaseTag: "34v260527"
      capacityType: "MIXED"
      mixedAsgOptions:
        alternativeAutoReplace: true
        alternativeParallelScaleUp: true
        alternativeScaleUpWait: "60s"
      spot:
        name: "tidb-tx2xl"
        instanceTypes: [ "t4g.2xlarge", "m6g.2xlarge" ]
        max: 200
        labels:
          nodedrainer.tidbcloud.com/capacityType: "SPOT"
      onDemand:
        name: "tidb-od-x2xl"
        instanceTypes: [ "m6g.2xlarge", "m7g.2xlarge", "m6i.2xlarge", "m7i.2xlarge" ]
        max: 100
        labels:
          nodedrainer.tidbcloud.com/capacityType: "ON_DEMAND"
  eks-freetier:tidb-nodegroup:
    category: "compute"
    component: "tidb"
    min: 0
  eks-freetier:tmp-worker-fleet:
    - tier: "standard"
      name: "tmp-worker-x4xl"
      releaseTag: "34v260527"
      instanceTypes:
        [ "m6g.4xlarge", "m7g.4xlarge" ]
  eks-freetier:tmp-worker-nodegroup:
    category: "control-plane"
    component: "tmp-worker"
    capacityType: "SPOT"
    min: 0
    max: 10
    spot:
      onDemandBaseCapacity: 1
  eks-freetier:dedicated-fleet:
    - tier: "standard"
      name: "dedicated-x12xl"
      releaseTag: "34v260527"
      instanceTypes: ["m6g.12xlarge", "m7g.12xlarge"]
      labels:
        dedicated-node-cpu-num: "48"
    - tier: "standard"
      name: "dedicated-x16xl"
      releaseTag: "34v260527"
      instanceTypes: ["m6g.16xlarge", "m7g.16xlarge"]
      labels:
        dedicated-node-cpu-num: "64"
    # NOTE: dedicated x24xl/x32xl/x48xl dropped — only m6a.* offered them and m6a is not available in mx-central-1
  eks-freetier:dedicated-nodegroup:
    category: "control-plane"
    component: "dedicated"
    capacityType: "ON_DEMAND"
    min: 0
    max: 10
  eks-freetier:import-super-vip-fleet:
    - tier: "standard"
      name: "import-super-vip-x12xl"
      releaseTag: "34v260527"
      instanceTypes:
        ["m6g.16xlarge", "m7g.16xlarge"]
  eks-freetier:import-super-vip-nodegroup:
    category: "control-plane"
    component: "import-super-vip"
    min: 0
    max: 10
  eks-freetier:import-pool-fleet:
    - tier: "standard"
      releaseTag: "34v260527"
      name: "import-pool"
      instanceTypes: ["r6g.2xlarge", "r7g.2xlarge"]
  eks-freetier:import-pool-nodegroup:
    category: "control-plane"
    component: "import-pool"
    min: 0
    max: 10
  eks-freetier:export-vip-tidb-fleet:
    - tier: "standard"
      name: "export-vip-tidb-x2xl"
      releaseTag: "34v260527"
      instanceTypes: ["r6g.2xlarge", "r7g.2xlarge", "r6i.2xlarge"]
  eks-freetier:export-vip-tidb-nodegroup:
    category: "control-plane"
    component: "export-vip-tidb"
    capacityType: "ON_DEMAND"
    min: 0
    max: 10
  eks-freetier:export-super-vip-fleet:
    - tier: "standard"
      name: "export-super-vip-x8xl"
      releaseTag: "34v260527"
      instanceTypes: ["c6g.8xlarge", "c7g.8xlarge", "c6i.8xlarge"]
  eks-freetier:export-super-vip-nodegroup:
    category: "control-plane"
    component: "export-super-vip"
    capacityType: "ON_DEMAND"
    min: 0
    max: 10
  eks-freetier:export-super-vip-tidb-fleet:
    - tier: "standard"
      name: "export-super-vip-tidb-x8xl"
      releaseTag: "34v260527"
      instanceTypes: ["r6g.8xlarge", "r7g.8xlarge", "r6i.8xlarge"]
  eks-freetier:export-super-vip-tidb-nodegroup:
    category: "control-plane"
    component: "export-super-vip-tidb"
    capacityType: "ON_DEMAND"
    min: 0
    max: 10
  eks-freetier:adhoc-fleet:
    - tier: "standard"
      name: "adhoc-r2x"
      releaseTag: "34v260527"
      instanceTypes: ["r6g.2xlarge", "r7g.2xlarge", "r6i.2xlarge"]
      labels:
        adhoc-cpu: "8"
        adhoc-memory: "64"
      capacityType: "MIXED"
      mixedAsgOptions:
        alternativeAutoReplace: true
        alternativeParallelScaleUp: true
        alternativeScaleUpWait: "60s"
    - tier: "standard"
      name: "adhoc-r8x"
      releaseTag: "34v260527"
      instanceTypes: ["r6g.8xlarge", "r7g.8xlarge", "r6i.8xlarge"]
      labels:
        adhoc-cpu: "32"
        adhoc-memory: "256"
      capacityType: "MIXED"
      mixedAsgOptions:
        alternativeAutoReplace: true
        alternativeParallelScaleUp: true
        alternativeScaleUpWait: "60s"
    - tier: "standard"
      name: "adhoc-m4x"
      releaseTag: "34v260527"
      instanceTypes: ["m6g.4xlarge", "m7g.4xlarge"]
      labels:
        adhoc-cpu: "16"
        adhoc-memory: "64"
      capacityType: "MIXED"
      mixedAsgOptions:
        alternativeAutoReplace: true
        alternativeParallelScaleUp: true
        alternativeScaleUpWait: "60s"
    - tier: "standard"
      name: "adhoc-m8x"
      releaseTag: "34v260527"
      instanceTypes: ["m6g.8xlarge", "m7g.8xlarge"]
      labels:
        adhoc-cpu: "32"
        adhoc-memory: "128"
      capacityType: "MIXED"
      mixedAsgOptions:
        alternativeAutoReplace: true
        alternativeParallelScaleUp: true
        alternativeScaleUpWait: "60s"
    - tier: "standard"
      name: "adhoc-m16x"
      releaseTag: "34v260527"
      instanceTypes: ["m6g.16xlarge", "m7g.16xlarge"]
      labels:
        adhoc-cpu: "64"
        adhoc-memory: "256"
      capacityType: "MIXED"
      mixedAsgOptions:
        alternativeAutoReplace: true
        alternativeParallelScaleUp: true
        alternativeScaleUpWait: "60s"
  eks-freetier:adhoc-nodegroup:
    category: "control-plane"
    component: "adhoc"
    capacityType: "ON_DEMAND"
    min: 0
    max: 10
  # req#6: tiflash-cn-fleet / tiflash-cn-nodegroup removed (compute tiflash not needed;
  # asg.createFleetIfExists no-ops when the fleet config is absent, so no code change required)
  eks-freetier:o11y-fleet:
    - tier: "standard"
      name: "o11y-2x"
      releaseTag: "34v260527"
      instanceTypes: ["m6g.2xlarge", "m7g.2xlarge", "m6i.2xlarge", "m7i.2xlarge"]
    - tier: "standard"
      name: "o11y-4x"
      releaseTag: "34v260527"
      instanceTypes: ["m6g.4xlarge", "m7g.4xlarge", "m6i.4xlarge", "m7i.4xlarge"]
  eks-freetier:o11y-nodegroup:
    category: "control-plane"
    component: "o11y"
    min: 0
    max: 50
  eks-freetier:default-fleet:
    - tier: "standard"
      name: "default-burstable"
      releaseTag: "34v260527"
      instanceTypes: ["m6g.2xlarge", "m7g.2xlarge", "m6i.2xlarge", "m7i.2xlarge"]
      primary:
        min: 1
      standby:
        min: 0 # provisioned, 0 nodes for now
  eks-freetier:default-nodegroup:
    category: "control-plane"
    component: "general"
    min: 1
    max: 50
    exclusive: false
  # req#5: tiflash-columnar-readnode-config removed (columnar readnode disabled)
  eks-freetier:ssd-provisioner-image: 380838443567.dkr.ecr.us-west-2.amazonaws.com/dbaas/serverless/eks-nvme-ssd-provisioner:202304282235

  eks-freetier:datacleaner:
    image: 380838443567.dkr.ecr.us-east-1.amazonaws.com/dbaas/aws-shared-provider-datacleaner:b76c60bf9fb41996e40fbea1e85f3378b7256d03
    ops: dump_archive_ks,dump_pd_rules,dump_region_labels,archive_ks,archive_pd_rules,archive_region_labels,archive_etcd_path,keyspace2tombstone
    skipConfirm: -skip-confirm
    realRun: -isrun
    delay: 168h

  eks-freetier:o11y-infra:
    disable: false # o11y enabled via new-infra agent-controller (newInfraStage: done)
    version: "1"
    auth0:
      audience: https://tidb-soc2.us.auth0.com/api/v2/
      clientId:
        secure: v1:3Hl8eAhn+flP1EFr:aLb1+Ac2OfC6yDq9P3TuAqRdCZvppYQ4g5M/bmlZ5M3ak6xPbdjHZPt/JdhWkiRI
      clientSecret:
        secure: v1:aiYY2w8YGD2GduP5:N7d9RrZuIRAMHRTDfqXCFlYq4pVrFJkpcybKHYyc82TOLB/7peYc3qJLEq24rxhuYv0dT79MAlfFizwAE5NGSE13FUjIfSdlbVMhehOE3Iw=
      getTokenUrl: https://tidb-soc2.us.auth0.com/oauth/token
    createO11yInfraPath: /api/v1/clusters
    deleteO11yInfraPath: /api/v1/clusters
    getO11yInfraPath: /api/v1/clusters
    openApiAddress: https://www.gs.us-west-2.aws.observability.tidbcloud.com
    roleArnPrefix: "arn:aws:iam::557537366020:role/*"
    globalShardCount: 2
    serverlessShardCount: 2
    enableAgentController: true
    newInfraStage: done

  eks-freetier:serverless-cluster:
    tikv:
      - instanceTypes: ["r7g.2xlarge", "r8g.2xlarge", "r6g.2xlarge"] # req#11: tikv 2xlarge
        releaseTag: "34v260527"
        tier: "standard"
        zoneTypes: ["primary"] # primary-only now; add standby/witness groups to expand later
        replicas: 3
        storageClassName: "gp3-500"
        storageSize: 500Gi
        superseding:
          instanceType: "r8g.2xlarge"
          releaseTag: "34v260527"
      - instanceTypes: ["r8g.2xlarge", "r6g.2xlarge", "r7g.2xlarge"] # req#11: tikv 2xlarge
        releaseTag: "34v260527"
        tier: "standard"
        zoneTypes: ["primary"] # primary-only now; add standby/witness groups to expand later
        replicas: 3
        storageClassName: "gp3-1000mb-10000io"
        storageSize: 1800Gi # req#11: 1.8Ti -> 1800Gi (confirm exact value)
  eks-freetier:probe-serverless-dsn: # NOTE: inherited from donor; regenerate for mx-central-1 before prober stage
    secure: v1:oHZ2v9fA/U3IKk3w:9WD+6hf7VGswFGvhryratLLdh4dVz+ooc0ts3zOLbzzpaW8lCf1MB8yk111zOfmj/RfwwYYVdUZWyRtMbFE2/2CxXtkSHEy9AJrCmpSIMwY598TTq3pWLNjw6lzrYO7ZhmyfktSMbRCWZl20z4RWHyWToEZWKRvwgRRmVT2lGz99gis2zo7jFeVp2J5wkc4OgNf8lsCAtjR0f5M54ji1KdUSY1hOFb3wQqBixVHiGmxrQcRgc0wTRvFGPixImkSooofM7i/owOtR1VtwdMy83joK8YKEIkC7asd2355F2ETIY4M8L6GapGWhfjXGdfvpjjmccUIh8E3YjPoEazr1XnCmlyoj2DuF3+d3unIxxSUsogm/OIHc9RkMitpM1DyenkR5Nt0lShkC1kKKBVXUpCoeMjggITrIqGNTWDy4NozIPcdsZ2kJjS03gEkf4eujMsBQAUdwx4A6eg/+zF85DO+pl8/h4QT/O8e3WhaGBRW4+/d9zLFOB5Jt/TYFafve8fWN1LnVNJlL0rXvz5Nyi/+Zq83YwmMpUFS4Fbif7DaIGCIT11ecznivWH2B7xOGgTxunPc/JkElgLseWqUhJe575hqhKnMY/d6M1iHDR9nj/QaKw434YrkhkDip+6U0WvEyTXAetA+7jgPsu1eX5Pdhq7mGjKG4FCbZxpJ+CnWFhyfAVBpkDWWu8bFdaLxlXvNQLqv+g+c8x391MAzVigytzRb+FUjuwWJ/q33DTfGKIv4fkQ9i/TxW
  # req#9: istio block removed (istio disabled)
  eks-freetier:loggers:
    asg: debug
    o11y: info
    serverless: debug
  eks-freetier:rdsInstances:
    serverless: # used by audit-log
      instanceClass: "db.t4g.micro"
      databaseName: "serverless_rds"
      username: "serverless_rds"
      backupRetentionPeriod: 2
      allocatedStorage: 20 # gp2/gp3 mysql minimum; mx-central-1 defaults storageType to gp2 (donor relied on grandfathered magnetic 10GB)
  # DM cluster config — presence of serverless-dm-config enables DM (no separate toggle).
  # Sized down for this region (default manifest master 7c/20-30Gi, worker 15c/50-62Gi — too
  # large). master and worker run on general nodes; worker replicas are managed externally.
  eks-freetier:serverless-dm-config:
    baseImage: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/dm
    version: v26.3.0-nextgen