encryptionsalt: v1:gF5orucaNGg=:v1:2NwbVvL+mer7DIpA:YtV3VLVMY2ofW3s6bcXsUqpDwFxA3g==
config:
  aws:region: us-west-2
  eks-freetier:admin-roles:
    - cicd-role
    - bastion-5fddc83
    - argocd-oidc-role
    - dbaas-prod-devops
  eks-freetier:auth0Audience: prod-proxy-service
  eks-freetier:auth0Domain: tidb.auth0.com
  eks-freetier:cidrBlock: 10.0.0.0/16
  # Single shared NAT gateway across the 3 AZ subnets (cost): lower egress HA + cross-AZ
  # egress, but no topology change. Unset elsewhere => awsx default of one NAT per AZ.
  eks-freetier:number-of-nat-gateways: 1
  eks-freetier:dbaas-proxy-image: 380838443567.dkr.ecr.us-west-2.amazonaws.com/dbaas/prod/cluster-proxy:v1.2.60
  eks-freetier:base-k8s-outbounds-cidrs:
    - "54.188.27.23/32"
    - "44.231.162.131/32"
    - "100.20.198.224/32"
  eks-freetier:env: prod
  eks-freetier:servicetype: serverless-canary
  # us-west-2 already provides regional infra (f01/f03); f04 reuses the existing
  # regional redis VPC endpoint service instead of creating its own (matches f03).
  eks-freetier:regional-infra: false
  eks-freetier:regionalRedisServiceName: com.amazonaws.vpce.us-west-2.vpce-svc-05dafb36d99f7072b
  # tiflash-wn (write node) S3 infra disabled (matches us-west-2-f03); tiflash compute
  # (tiflash-cn) is not deployed. The columnar read node IS enabled — see
  # tiflash-columnar-readnode-config below.
  eks-freetier:disable-tiflash-wn-infra: true
  # numberOfAvailabilityZones left at default (3): VPC reserves subnets in all of
  # us-west-2a/b/c so future multi-AZ expansion needs no VPC re-layout. Workloads
  # run only in primary for now (standby/witness replicas all 0).
  # create-region stage progression (eks -> kube-system -> etc-basic -> etc-full ->
  # tidb-admin -> kms -> tidb-serverless-base -> tidb-serverless).
  eks-freetier:stage: "tidb-serverless"
  eks-freetier:k8s-version: "1.35"
  eks-freetier:ca-image: "380838443567.dkr.ecr.us-east-1.amazonaws.com/dbaas/nightly/cluster-autoscaler"
  eks-freetier:ca-version: "0241dd5d0aa8fad250d24c8b822b206e406b289b"
  eks-freetier:eks-releases:
    35v260529:
      ami:
        amd64: ami-09edf71c5a5acbe5c # amazon-eks-node-al2023-x86_64-standard-1.35-v20260529 (us-west-2)
        arm64: ami-008d2277d5fc92f1e # amazon-eks-node-al2023-arm64-standard-1.35-v20260529 (us-west-2)
      releaseVersion: 1.35.5-20260529
  eks-freetier:ca-releaseTag: "35v260529"
  eks-freetier:ca-costOptimization: true
  eks-freetier:public-access-cidrs:
    # Bastion
    - 54.185.150.209/32
    # Jenkins
    - 104.196.246.224/32
    - 35.233.250.206/32
    # Argo CD
    - 34.69.36.199/32
    # Base us-west-2
    - 54.188.27.23/32
    - 44.231.162.131/32
    - 100.20.198.224/32
    # o11y
    - 52.72.84.40/32
    # Jump Service
    - 35.82.108.84/32
  eks-freetier:public-hosted-zone-domain: prod.aws.tidbcloud.com
  eks-freetier:public-hosted-zone-id: Z08648051F27XQI0DF51K
  eks-freetier:region: us-west-2
  eks-freetier:primary-zone: us-west-2b
  eks-freetier:standby-zone: us-west-2c # provisioned for future expansion; 0 nodes now
  eks-freetier:witness-zone: us-west-2a # provisioned for future expansion; 0 nodes now
  eks-freetier:suffix: f04
  eks-freetier:index: "04"
  eks-freetier:tidb-operator-tag: 74508dc5061419e57fb25ecc2f412d7d1df67cea
  eks-freetier:tidb-operator-image: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/serverless/tidb-operator
  eks-freetier:downThreshold: 0.7
  eks-freetier:pca-arn: arn:aws:acm-pca:us-west-2:380838443567:certificate-authority/ed5106d3-0890-4af9-bd60-b6df4f6299ca
  eks-freetier:pca-region: us-west-2
  eks-freetier:serverless-cse-master-key-id: "alias/prod-us-west-2-f04-key"
  eks-freetier:serverless-cse-master-key-cipher-text: "AQIDAHhXM/UsWFYC+8HHSrdGfuKh0ZTYifMdYX3drkfwfexdlgEpj1gGUn5Fy95l7dMl5poTAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM4kNDC1yJL7npDbEKAgEQgDuJ+veZKItKP2IDlGVGcl0ofSbrJjyw1j+YPioHvb9GCrrgEoPbyQxVzTJGS0bysPXVOT3j7/i4mVV/fQ==" # CSE master-key data key from alias/prod-us-west-2-f04-key (kms stage, key e5a24a79)
  eks-freetier:serverless-cse-master-key-vendor: "aws"
  eks-freetier:serverless-tikv-config:
    # multiAZ left enabled (default): serverless ASGs span all 3 AZs (empty in standby/witness).
    # tikv pods stay primary-only via the single primary tikv group below.
    walSyncDir: "/var/lib/tikv-raft-wal"
    enableSafePointV2: true
    disableSafePointFallBackV1: true
    pushMetricsAddr: "http://serverless-metering.serverless-metering:9091"
    pushMetricsInterval: 30
    buildColumnar: true # kept true per operator (columnar readnode disabled, TiKV still builds columnar)
    buildFtsIndex: true
    cdc: true
    pessimisticTxnInMemory: true
    storageVolumes:
      - storageClassName: "io2-500"
        storageSize: "10Gi"
        name: "raft-wal"
      - storageClassName: "ebs-sc"
        storageSize: "30Gi"
        name: "raft-db"
    blacklist:
      enableRollingUpdate: false
      keyspaceNames: []
      regionIDs: []
    failoverReplicasPerFailureStore: 2
    canaryUpgrade:
      enabled: true
      clusterReadySeconds: 900
      stageReadySeconds: 300
      stagePercents: [ 10, 67, 100 ]
    autoScaling:
      enabled: true
      paused: false
      maxReplicas: 9
      cpu:
        maxThreshold: 0.7
        minThreshold: 0.3
        scaleInIntervalSeconds: 900
        scaleOutIntervalSeconds: 600
      storage:
        maxThreshold: 0.8
        minThreshold: 0.6
        scaleInIntervalSeconds: 500
        scaleOutIntervalSeconds: 1
    scaleInProtection:
      enabled: true
      storageThreshold: 0.8
      minReplicas: 1
    storeLimit:
      enabled: true
      unbalanceThreshold: 0.7
      normalRate: 64
      scalingInRate: 128
      scalingOutRate: 128
    hotCluster: # kept as-is per operator (hot tikv tier removed; hot autoscaling config retained)
      enabled: true
      scaleToZero: true
      initialReplicas: 2
      cpuThreshold: 0.5
      hotDurationSeconds: 120
      hotRegionSeconds: 180
      coldRegionSeconds: 480
      autoScaling:
        cpu:
          maxThreshold: 0.6
          minThreshold: 0.2
          scaleInIntervalSeconds: 600
          scaleOutIntervalSeconds: 180
    workerReleaseTag: "35v260529"
    worker:
      replicas:
        min: 1
        max: 100
      resources:
        limits:
          cpu: 4000m
          memory: 7Gi
        requests:
          cpu: 1000m
          memory: 2Gi
    copWorker:
      replicas:
        min: 1
        max: 100
      resources:
        limits:
          cpu: 4000m
          memory: 31Gi
        requests:
          cpu: 1000m
          memory: 4Gi
          storage: 100Gi
    tikvApi:
      releaseTag: "35v260529"
      sharedPoolEnabled: true
    schemaManager:
      replicas: 1
    replicationWorker:
      replicas: 0
      version: 93887ebeb1b62a9dc24cbfc66a4d6ec5831c17b1
    runtimeConfig:
      - name: memoryLimit
        value: "Math.max(Math.round(${memory} * 0.8), ${memory} - 8) + 'Gi'"
      - name: storageSize
        value: "(${instanceStorage} ? ${instanceStorage} - 150 : 0) + 'Gi'"
  eks-freetier:serverless-cse-archive-config:
    suspend: false
  eks-freetier:serverless-cse-dfsgc-config:
    suspend: false
  eks-freetier:serverless-cop-worker-cache-size: 16GB
  eks-freetier:serverless-cop-worker-stateful-cache-size: 8GB
  eks-freetier:serverless-cop-worker-block-cache-size: 8GB
  eks-freetier:serverless-cop-worker-hpa-cpu-avg-util: 40
  eks-freetier:serverless-namespace: tidb-serverless

  # req#10: PD API mode + microservices OFF.
  #   pdMode "" -> PD_SERVICE_MODE="" (monolithic PD, not api/microservice mode).
  #   tso / sche / resource-manager servers are NOT created: their image tags are omitted, and
  #   serverless.ts now gates tso & sche creation on their imageTag (resource-manager was already gated).
  #   NOTE: pdMode="" is not yet runtime-verified; confirm it yields monolithic PD at the serverless stage.
  eks-freetier:pd-cluster:
    apiServerReleaseTag: "35v260529"
    pdBaseImage: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/serverless/pd
    pdMode: ""
    pdServerImageTag: 20260724-06b41f7979c8258ccc5c6c04f97724fd76a33b5e # image version from prod-eu-central-1-f01
    pdServerStorageSize: "50Gi"
    enableResourceManagerProxy: false
    # PD downsized to fit the critical-services xlarge pool (4 vCPU / 16Gi nodes).
    # Overrides the prod default of 6 vCPU / 16Gi requests.
    pdResourcesRequirements:
      primary:
        requests: { cpu: "2", memory: "8Gi", storage: "50Gi" }
        limits: { cpu: "3", memory: "12Gi", storage: "50Gi" }
    multiAZ:
      replicas: [3, 0, 0] # primary-only now (3 PD in primary AZ); change to [1,1,1] to go multi-AZ later
  # keyspace-etcd-group disabled until o11y infra is ready; enable at finalize per the
  # create-region skill (set count: 1 + keyspace-etcd-group-spec) unless operator says otherwise.
  eks-freetier:keyspace-etcd-group-count: 0
  # admin etcd right-sized for this low-traffic canary (manifest default is
  # 8Gi req==limit, so each etcd reserves a whole guaranteed-xl node). 3Gi keeps
  # headroom vs the etcd --quota-backend-bytes (8Gi). Node count is unchanged
  # (etcd is zone-pinned to 3 nodes) — this just frees room to co-locate gateways.
  eks-freetier:etcd:
    resources:
      requests: { cpu: "1", memory: "3Gi" }
      limits: { cpu: "2", memory: "3Gi" }

  eks-freetier:serverless-tikv-base-image: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/serverless/tikv
  eks-freetier:serverless-tikv-version: v26.3.11
  eks-freetier:serverless-tikv-worker-version: v26.3.11
  eks-freetier:serverless-tidb-base-image: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/serverless/tidb
  eks-freetier:serverless-tidb-version: d349efce65582e71bc46d9d4356c6eb426074a71 # image version from prod-eu-central-1-f01
  eks-freetier:general-guaranteed-fleet:
    - tier: "standard"
      name: "guaranteed-xl" # critical-services on xlarge (PD downsize)
      releaseTag: "35v260529"
      # cost: let CA reclaim guaranteed-xl nodes freed by the gateway right-sizing.
      # PD + admin etcd both carry safe-to-evict:false, so CA never drains them —
      # only genuinely empty/underused nodes get scaled in (graceful drain of
      # onDemand nodes, not a spot-style abrupt reclaim).
      instanceTypes: ["m6g.xlarge", "m7g.xlarge", "m6i.xlarge", "m7i.xlarge"]
      primary:
        min: 0 # NOTE: tune critical-services replica count for xl
      standby:
        min: 0 # provisioned, 0 nodes for now
      witness:
        min: 0 # provisioned, 0 nodes for now
    - tier: "standard"
      name: "guaranteed-2xl"
      releaseTag: "35v260529"
      instanceTypes: ["m6g.2xlarge", "m7g.2xlarge", "m8g.2xlarge", "m6a.2xlarge", "m6i.2xlarge", "m7i.2xlarge", "m7a.2xlarge"]
      primary:
        min: 0
      standby:
        min: 0
      witness:
        min: 0
    - tier: "standard"
      name: "guaranteed-4xl"
      releaseTag: "35v260529"
      instanceTypes: ["m6g.4xlarge", "m7g.4xlarge", "m8g.4xlarge", "m6a.4xlarge", "m6i.4xlarge", "m7i.4xlarge", "m7a.4xlarge"]
      primary:
        min: 0
      standby:
        min: 0
      witness:
        min: 0
  eks-freetier:general-guaranteed-nodegroup:
    category: "control-plane"
    component: "critical-services"
    zones: ["primary", "standby", "witness"]
  eks-freetier:memory-burstable-fleet:
    - tier: "standard"
      name: "memory-burstable"
      releaseTag: "35v260529"
      primary:
        min: 0
      standby:
        min: 0
  eks-freetier:memory-burstable-nodegroup:
    category: "control-plane"
    component: "burstable"
    instanceTypes: ["r6g.2xlarge", "r7g.2xlarge", "r6i.2xlarge", "r7i.2xlarge"]
    capacityType: "MIXED"
    mixedAsgOptions:
      alternativeAutoReplace: true
      alternativeParallelScaleUp: true
      alternativeScaleUpWait: "60s"
  eks-freetier:tidb-fleet:
    - tier: "standard"
      name: "tidb-x2xl" # req#12: tidb x2xl only, MIXED
      releaseTag: "35v260529"
      capacityType: "MIXED"
      mixedAsgOptions:
        alternativeAutoReplace: true
        alternativeParallelScaleUp: true
        alternativeScaleUpWait: "60s"
      spot:
        name: "tidb-tx2xl"
        instanceTypes: [ "t4g.2xlarge", "m6g.2xlarge" ]
        max: 100
        labels:
          nodedrainer.tidbcloud.com/capacityType: "SPOT"
      onDemand:
        name: "tidb-od-x2xl"
        instanceTypes: [ "m6g.2xlarge", "m7g.2xlarge", "m6i.2xlarge", "m7i.2xlarge" ]
        max: 100
        labels:
          nodedrainer.tidbcloud.com/capacityType: "ON_DEMAND"
  eks-freetier:tidb-nodegroup:
    category: "compute"
    component: "tidb"
    min: 0
  eks-freetier:tmp-worker-fleet:
    - tier: "standard"
      name: "tmp-worker-x4xl"
      releaseTag: "35v260529"
      instanceTypes:
        [ "m6g.4xlarge", "m7g.4xlarge" ]
  eks-freetier:tmp-worker-nodegroup:
    category: "control-plane"
    component: "tmp-worker"
    capacityType: "SPOT"
    min: 0
    max: 50
    spot:
      onDemandBaseCapacity: 1
  eks-freetier:dedicated-fleet:
    - tier: "standard"
      name: "dedicated-x12xl"
      releaseTag: "35v260529"
      instanceTypes: ["m6g.12xlarge", "m7g.12xlarge"]
      labels:
        dedicated-node-cpu-num: "48"
    - tier: "standard"
      name: "dedicated-x16xl"
      releaseTag: "35v260529"
      instanceTypes: ["m6g.16xlarge", "m7g.16xlarge"]
      labels:
        dedicated-node-cpu-num: "64"
    # NOTE: dedicated x24xl/x32xl/x48xl dropped to keep this region minimal (matches mx-central-1-f01 baseline)
  eks-freetier:dedicated-nodegroup:
    category: "control-plane"
    component: "dedicated"
    capacityType: "ON_DEMAND"
    min: 0
    max: 50
  eks-freetier:import-super-vip-fleet:
    - tier: "standard"
      name: "import-super-vip-x12xl"
      releaseTag: "35v260529"
      instanceTypes:
        ["m6g.16xlarge", "m7g.16xlarge"]
  eks-freetier:import-super-vip-nodegroup:
    category: "control-plane"
    component: "import-super-vip"
    min: 0
    max: 50
  eks-freetier:import-pool-fleet:
    - tier: "standard"
      releaseTag: "35v260529"
      name: "import-pool"
      instanceTypes: ["r6g.2xlarge", "r7g.2xlarge"]
  eks-freetier:import-pool-nodegroup:
    category: "control-plane"
    component: "import-pool"
    min: 0
    max: 50
  eks-freetier:export-vip-tidb-fleet:
    - tier: "standard"
      name: "export-vip-tidb-x2xl"
      releaseTag: "35v260529"
      instanceTypes: ["r6g.2xlarge", "r7g.2xlarge", "r6i.2xlarge"]
  eks-freetier:export-vip-tidb-nodegroup:
    category: "control-plane"
    component: "export-vip-tidb"
    capacityType: "ON_DEMAND"
    min: 0
    max: 50
  eks-freetier:export-super-vip-fleet:
    - tier: "standard"
      name: "export-super-vip-x8xl"
      releaseTag: "35v260529"
      instanceTypes: ["c6g.8xlarge", "c7g.8xlarge", "c6i.8xlarge"]
  eks-freetier:export-super-vip-nodegroup:
    category: "control-plane"
    component: "export-super-vip"
    capacityType: "ON_DEMAND"
    min: 0
    max: 50
  eks-freetier:export-super-vip-tidb-fleet:
    - tier: "standard"
      name: "export-super-vip-tidb-x8xl"
      releaseTag: "35v260529"
      instanceTypes: ["r6g.8xlarge", "r7g.8xlarge", "r6i.8xlarge"]
  eks-freetier:export-super-vip-tidb-nodegroup:
    category: "control-plane"
    component: "export-super-vip-tidb"
    capacityType: "ON_DEMAND"
    min: 0
    max: 50
  eks-freetier:adhoc-fleet:
    - tier: "standard"
      name: "adhoc-r2x"
      releaseTag: "35v260529"
      instanceTypes: ["r6g.2xlarge", "r7g.2xlarge", "r6i.2xlarge"]
      labels:
        adhoc-cpu: "8"
        adhoc-memory: "64"
      capacityType: "MIXED"
      mixedAsgOptions:
        alternativeAutoReplace: true
        alternativeParallelScaleUp: true
        alternativeScaleUpWait: "60s"
    - tier: "standard"
      name: "adhoc-r8x"
      releaseTag: "35v260529"
      instanceTypes: ["r6g.8xlarge", "r7g.8xlarge", "r6i.8xlarge"]
      labels:
        adhoc-cpu: "32"
        adhoc-memory: "256"
      capacityType: "MIXED"
      mixedAsgOptions:
        alternativeAutoReplace: true
        alternativeParallelScaleUp: true
        alternativeScaleUpWait: "60s"
    - tier: "standard"
      name: "adhoc-m4x"
      releaseTag: "35v260529"
      instanceTypes: ["m6g.4xlarge", "m7g.4xlarge", "m6a.4xlarge", "m5a.4xlarge"]
      labels:
        adhoc-cpu: "16"
        adhoc-memory: "64"
      capacityType: "MIXED"
      mixedAsgOptions:
        alternativeAutoReplace: true
        alternativeParallelScaleUp: true
        alternativeScaleUpWait: "60s"
    - tier: "standard"
      name: "adhoc-m8x"
      releaseTag: "35v260529"
      instanceTypes: ["m6g.8xlarge", "m7g.8xlarge"]
      labels:
        adhoc-cpu: "32"
        adhoc-memory: "128"
      capacityType: "MIXED"
      mixedAsgOptions:
        alternativeAutoReplace: true
        alternativeParallelScaleUp: true
        alternativeScaleUpWait: "60s"
    - tier: "standard"
      name: "adhoc-m16x"
      releaseTag: "35v260529"
      instanceTypes: ["m6g.16xlarge", "m7g.16xlarge"]
      labels:
        adhoc-cpu: "64"
        adhoc-memory: "256"
      capacityType: "MIXED"
      mixedAsgOptions:
        alternativeAutoReplace: true
        alternativeParallelScaleUp: true
        alternativeScaleUpWait: "60s"
  eks-freetier:adhoc-nodegroup:
    category: "control-plane"
    component: "adhoc"
    capacityType: "ON_DEMAND"
    min: 0
    max: 10
  # req#6: tiflash-cn-fleet / tiflash-cn-nodegroup removed (compute tiflash not needed;
  # asg.createFleetIfExists no-ops when the fleet config is absent, so no code change required)
  eks-freetier:o11y-fleet:
    - tier: "standard"
      name: "o11y-2x"
      releaseTag: "35v260529"
      instanceTypes: ["m6g.2xlarge", "m7g.2xlarge", "m6i.2xlarge", "m7i.2xlarge"]
    - tier: "standard"
      name: "o11y-4x"
      releaseTag: "35v260529"
      instanceTypes: ["m6g.4xlarge", "m7g.4xlarge", "m6i.4xlarge", "m7i.4xlarge"]
  eks-freetier:o11y-nodegroup:
    category: "control-plane"
    component: "o11y"
    min: 0
    max: 50
  eks-freetier:default-fleet:
    - tier: "standard"
      name: "default-burstable"
      releaseTag: "35v260529"
      instanceTypes: ["m6g.2xlarge", "m7g.2xlarge", "m6i.2xlarge", "m7i.2xlarge"]
      primary:
        min: 1
      standby:
        min: 0 # provisioned, 0 nodes for now
  eks-freetier:default-nodegroup:
    category: "control-plane"
    component: "general"
    min: 1
    max: 50
    exclusive: false
  # tiflash columnar read node enabled. Cost-optimized for this canary region: runs on the
  # shared "general" pool (like us-east-1-f02 — no dedicated nodegroup, so no releaseTag) with
  # lean requests so readnodes pack densely; scale requests/replicas up if columnar load grows.
  # eu image (2df2cbb82, matches the region's image-version source).
  eks-freetier:tiflash-columnar-readnode-config:
    image: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/tiflash:v26.3.10-nextgen
    storageClassName: "tiflash-gp3-6000-600"
    resourcePool: "general"
    podSpec:
      replicas:
        min: 1
        max: 4
      resources:
        limits:
          cpu: 4000m
          memory: 16Gi
        requests:
          cpu: 1000m
          memory: 8Gi
          storage: 100Gi
  eks-freetier:ssd-provisioner-image: 380838443567.dkr.ecr.us-west-2.amazonaws.com/dbaas/serverless/eks-nvme-ssd-provisioner:202304282235

  eks-freetier:datacleaner:
    image: 380838443567.dkr.ecr.us-east-1.amazonaws.com/dbaas/aws-shared-provider-datacleaner:b76c60bf9fb41996e40fbea1e85f3378b7256d03
    ops: dump_archive_ks,dump_pd_rules,dump_region_labels,archive_ks,archive_pd_rules,archive_region_labels,archive_etcd_path,keyspace2tombstone
    skipConfirm: -skip-confirm
    realRun: -isrun
    delay: 168h

  eks-freetier:o11y-infra:
    disable: false # o11y enabled; agent-controller fully owns the stack (newInfraStage: done)
    version: "1"
    auth0:
      audience: https://tidb-soc2.us.auth0.com/api/v2/
      clientId:
        secure: v1:3Hl8eAhn+flP1EFr:aLb1+Ac2OfC6yDq9P3TuAqRdCZvppYQ4g5M/bmlZ5M3ak6xPbdjHZPt/JdhWkiRI
      clientSecret:
        secure: v1:aiYY2w8YGD2GduP5:N7d9RrZuIRAMHRTDfqXCFlYq4pVrFJkpcybKHYyc82TOLB/7peYc3qJLEq24rxhuYv0dT79MAlfFizwAE5NGSE13FUjIfSdlbVMhehOE3Iw=
      getTokenUrl: https://tidb-soc2.us.auth0.com/oauth/token
    createO11yInfraPath: /api/v1/clusters
    deleteO11yInfraPath: /api/v1/clusters
    getO11yInfraPath: /api/v1/clusters
    openApiAddress: https://www.gs.us-west-2.aws.observability.tidbcloud.com
    roleArnPrefix: "arn:aws:iam::557537366020:role/*"
    globalShardCount: 2
    serverlessShardCount: 2
    enableAgentController: true
    namespaceImportId: observability
    newInfraStage: done

  eks-freetier:serverless-cluster:
    tikv:
      # single primary tikv group (r7g.xlarge). Downsized 2xlarge -> xlarge for cost on this
      # canary region (all of r7g/r8g/r6g.xlarge are available in every us-west-2 AZ). The
      # previous second group (r8g, gp3-1000mb-10000io/1800Gi) was dropped, along with this
      # group's `superseding` link that pointed at it.
      - instanceTypes: ["r7g.xlarge", "r8g.xlarge", "r6g.xlarge"] # tikv xlarge (4 vCPU / 32Gi)
        releaseTag: "35v260529"
        tier: "standard"
        zoneTypes: ["primary"] # primary-only now; add standby/witness groups to expand later
        replicas: 3
        storageClassName: "gp3-500"
        storageSize: 500Gi
  eks-freetier:probe-serverless-dsn: # NOTE: inherited from donor; regenerate for prod-us-west-2-f04 before prober stage
    secure: v1:oHZ2v9fA/U3IKk3w:9WD+6hf7VGswFGvhryratLLdh4dVz+ooc0ts3zOLbzzpaW8lCf1MB8yk111zOfmj/RfwwYYVdUZWyRtMbFE2/2CxXtkSHEy9AJrCmpSIMwY598TTq3pWLNjw6lzrYO7ZhmyfktSMbRCWZl20z4RWHyWToEZWKRvwgRRmVT2lGz99gis2zo7jFeVp2J5wkc4OgNf8lsCAtjR0f5M54ji1KdUSY1hOFb3wQqBixVHiGmxrQcRgc0wTRvFGPixImkSooofM7i/owOtR1VtwdMy83joK8YKEIkC7asd2355F2ETIY4M8L6GapGWhfjXGdfvpjjmccUIh8E3YjPoEazr1XnCmlyoj2DuF3+d3unIxxSUsogm/OIHc9RkMitpM1DyenkR5Nt0lShkC1kKKBVXUpCoeMjggITrIqGNTWDy4NozIPcdsZ2kJjS03gEkf4eujMsBQAUdwx4A6eg/+zF85DO+pl8/h4QT/O8e3WhaGBRW4+/d9zLFOB5Jt/TYFafve8fWN1LnVNJlL0rXvz5Nyi/+Zq83YwmMpUFS4Fbif7DaIGCIT11ecznivWH2B7xOGgTxunPc/JkElgLseWqUhJe575hqhKnMY/d6M1iHDR9nj/QaKw434YrkhkDip+6U0WvEyTXAetA+7jgPsu1eX5Pdhq7mGjKG4FCbZxpJ+CnWFhyfAVBpkDWWu8bFdaLxlXvNQLqv+g+c8x391MAzVigytzRb+FUjuwWJ/q33DTfGKIv4fkQ9i/TxW
  # req#9: istio block removed (istio disabled)
  eks-freetier:loggers:
    asg: debug
    o11y: info
    serverless: debug
  # rdsInstances omitted: the audit-log RDS is only created via InstallRDS, which runs
  # only when regional-infra is true. This region is regional-infra:false (reuses the
  # regional infra), so no RDS is created here (matches us-west-2-f03).
  # DM cluster config — presence of serverless-dm-config enables DM (no separate toggle).
  # Sized down for this region (default manifest master 7c/20-30Gi, worker 15c/50-62Gi — too
  # large). master and worker run on general nodes; worker replicas are managed externally.
  eks-freetier:serverless-dm-config:
    baseImage: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/dm
    version: v26.3.0-nextgen