apiVersion: pingcap.com/v1alpha1
kind: TidbCluster
metadata:
  name: serverless-cluster
spec:
  timezone: UTC
  version: v7.5.0
  pvReclaimPolicy: Retain
  pvReclaimAcrossCluster: true
  pvReclaimDelayDuration: 24h
  enablePVReclaim: true
  enableDynamicConfiguration: true
  configUpdateStrategy: RollingUpdate
  clusterDeletionProtection: true
  discovery: {}
  topologySpreadConstraints:
    - topologyKey: "kubernetes.io/hostname"
  helper:
    image: gcr.io/pingcap-public/dbaas/busybox:1.31.1
  blacklist:
    enableRollingUpdate: false
    keyspaceNames: []
    regionIDs: []
  pd:
    labels:
      zr-evicter.tidbcloud.com/ignored: "true"
    annotations:
      cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
    affinity:
      podAntiAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app.kubernetes.io/component: pd
            topologyKey: kubernetes.io/hostname
    nodeSelector:
      serverless.tidbcloud.com/node: critical-services
    tolerations:
    - key: serverless.tidbcloud.com/node
      operator: Equal
      value: critical-services
      effect: NoSchedule
    - key: status-taint.cluster-autoscaler.kubernetes.io/zr-evicter
      operator: Exists
      effect: NoSchedule
    maxFailoverCount: 0
    replicas: 3
    requests:
      storage: "10Gi"
      cpu: "1"
      memory: "8Gi"
    limits:
      cpu: "7"
      memory: "8Gi"
    storageClassName: ebs-sc
    canaryUpgrade:
      enabled: true
      clusterReadySeconds: 300
      coordinationSeconds: 180
      clusterPriority: ["serverless-cluster-witness", "serverless-cluster-standby", "serverless-cluster"]
    enableConfigRollback: false
    env:
    - name: PD_SERVICE_MODE
      value: MODE
    config: |
      [dashboard]
        enable-telemetry = false
        internal-proxy = true

      [replication]
        enable-placement-rules = true
        location-labels = ["topology.kubernetes.io/region", "topology.kubernetes.io/zone", "kubernetes.io/hostname", "serverless.tidbcloud.com/partition"]
        max-replicas = 3

      [schedule]
        patrol-region-interval = "100ms"
        merge-schedule-limit = 16
        hot-region-cache-hits-threshold = 1

      [security]
        enable-sem = true
        cacert-path = "{{CAPath}}"
        cert-path = "{{CertPath}}"
        key-path = "{{KeyPath}}"

      [keyspace]
        enable-global-safe-point-v2 = true
        disable-raw-kv-region-split = true
        wait-region-split = true
        wait-region-split-timeout = "120s"
        check-region-split-interval = "1s"

      [controller]
        push-metrics-address = "http://serverless-metering.serverless-metering:9091"
        push-metrics-interval = "10s"

      [controller.request-unit]
        write-base-cost = 0.5
        write-per-batch-base-cost = 0.5
        write-cost-per-byte = 0.00048828

      [pd-server]
        enable-grpc-client-metrics = {{EnableGrpcClientMetrics}}

  tikv:
    labels:
      zr-evicter.tidbcloud.com/ignored: "true"
    enableNamedStatusPort: true
    recoverFailover: true
    additionalContainers:
    - command:
      - sh
      - -c
      - touch /var/lib/tikv-ebs/tikv.log; tail -n0 -F /var/lib/tikv-ebs/tikv.log;
      image: gcr.io/pingcap-public/dbaas/busybox:1.31.1
      name: tikv-log
      volumeMounts:
      - mountPath: /var/lib/tikv-ebs
        name: tikv-raft-db
    affinity:
      podAntiAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app.kubernetes.io/component: tikv
            topologyKey: kubernetes.io/hostname
    nodeSelector:
      serverless.tidbcloud.com/node: tikv
    tolerations:
      - effect: NoSchedule
        key: serverless.tidbcloud.com/node
        operator: Equal
        value: tikv
      - effect: NoSchedule
        key: serverless.tidbcloud.com/tier
        operator: Equal
        value: standard
    storeLabels:
      - "serverless.tidbcloud.com/tier"
      - "serverless.tidbcloud.com/zone"
    podSecurityContext:
      sysctls:
        - name: net.core.somaxconn
          value: "32768"
    annotations:
      tidb.pingcap.com/sysctl-init: "true"
    maxFailoverCount: 3
    evictLeaderTimeout: 72h
    statefulSetUpdateStrategy: RollingUpdate
    replicas: 3
    limits:
      memory: 64Gi
    storageClassName: "local-storage"
    requests:
      storage: "10Gi"
    serviceAccount: backup-restore
    storageVolumes:
    - name: raft-db
      storageSize: "30Gi"
      storageClassName: "ebs-sc"
      mountPath: "/var/lib/tikv-ebs"
    - name: raft-wal
      storageSize: "5Gi"
      storageClassName: "io2-500"
      mountPath: "/var/lib/tikv-raft-wal"
    priorityClassName: tikv-critical-priority
    scalePolicy:
      scaleInParallelism: 128
      scaleOutParallelism: 1
    enableConfigRollback: false
    enablePVReclaim: true
    pvReclaimDelayDuration: 24h
    scaleInProtectionForNode: true
    groupName: ""
    failover:
      replicasPerFailureStore: 1
    canaryUpgrade:
      enabled: false
      clusterReadySeconds: 900
      coordinationSeconds: 300
      clusterPriority: ["witness", "standby", "primary", "p2", "p1", "p0", "p3"]
      stageReadySeconds: 300
      stagePercents: [10, 50, 100]
    autoScaling:
      enabled: false
      paused: false
      maxReplicas: 6
      cpu:
        maxThreshold: 0.8
        minThreshold: 0.4
        scaleInIntervalSeconds: 500
        scaleOutIntervalSeconds: 300
      storage:
        maxThreshold: 0.8
        minThreshold: 0.6
        scaleInIntervalSeconds: 500
        scaleOutIntervalSeconds: 1
    scaleInProtection:
      enabled: false
      storageThreshold: 0.8
      minReplicas: 1
    storeLimit:
      enabled: false
      unbalanceThreshold: 0.7
      normalRate: 15
      scalingInRate: 15
      scalingOutRate: 15
    upgradeDelayAfterEvictLeader: 10m
    endEvictLeaderDelayAfterReady: 10m
    env:
    - name: DFS_PREFIX
      value: S3_PREFIX
    - name: DFS_S3_BUCKET
      value: S3_BUCKET
    - name: DFS_S3_REGION
      value: S3_REGION
    - name: MALLOC_CONF
      value: prof:true,prof_active:true
    - name: DFS_ALLOW_FALLBACK_LOCAL
      value: "0"
    config: |
      enable-inner-key-offset = true

      [coprocessor]
        enable-region-bucket = true
        region-split-keys = 50000000
        region-split-size = "500MiB"

      [cdc]
        enable = {{CDCEnabled}}

      [dfs]
        remote-compactor-addr = "{{RemoteCompactor}}"

      [gc]
        disable-safe-point-fallback-v1 = {{DisableSafePointFallBackV1}}
        enable-safe-point-v2 = {{EnableSafePointV2}}

      [import]
        import-mode-timeout = "10m"
        num-threads = 1
        stream-channel-window = 128

      [kvengine]
        build-columnar = {{BuildColumnar}}
        build-fts-index = {{BuildFtsIndex}}
        gc-lock-extra-cf = true
        per-keyspace-configs = [{{PerKeyspaceConfigs}}]
        remote-coprocessor-addr = "{{RemoteCoprocessor}}"
        remote-worker-addr = "{{RemoteWorker}}"
        [kvengine.ia]
          mem-cap = "{{IAMemCap}}"
          disk-cap = "{{IADiskCap}}"

      [log]
        level = "info"
        [log.file]
          filename = "/var/lib/tikv-ebs/tikv.log"
          max-backups = 10
          max-days = 5
          max-size = 300

      [raft-engine]
        target-file-size = "512MiB"

      [raftstore]
        enable-kv-engine-meta-diff = true
        {{RaftBaseTickIntervalConfig}}
        {{RaftEntryMaxSizeConfig}}
        {{IAKvSizeDiscountConfig}}
        raftdb-path = "/var/lib/tikv-ebs/raft-db"

      [rfengine]
        lightweight-backup = true
        rlog-cache-size-threshold = "16KiB"
        wal-chunk-target-file-size = "64MiB"
        wal-secondary-dir = "{{WalSecondaryDir}}"
        wal-sync-dir = "{{WalSyncDir}}"

      [rocksdb]
        [rocksdb.defaultcf]
          bottommost-level-compression = "no"
        [rocksdb.writecf]
          bottommost-level-compression = "no"

      [security]
        ca-path = "{{CAPath}}"
        cert-path = "{{CertPath}}"
        key-path = "{{KeyPath}}"
        [security.master-key]
          cipher-text = "{{MasterKeyCipherText}}"
          key-id = "{{MasterKeyId}}"
          vendor = "{{MasterKeyVendor}}"

      [server]
        grpc-concurrent-stream = 10240
        push-metrics-addr = "{{PushMetricsAddr}}"
        push-metrics-interval = {{PushMetricsInterval}}
        status-thread-pool-size = 2

      [storage]
        api-version = 2
        enable-ttl = true
        reserve-space = "0KiB"
        scheduler-pending-write-threshold = "{{SchedulerPendingWriteThreshold}}"
        ttl-check-poll-interval = "24h"
        {{BlockCacheCapacityConfig}}
        [storage.flow-control]
          enable = true
          hard-region-mem-limit = "256MB"
          soft-region-mem-limit = "128MB"
  tidb:
    replicas: 1
    maxFailoverCount: 3
    requests:
      cpu: 1000m
      memory: 512Mi
    limits:
      cpu: 2000m
      memory: 2Gi
    env:
    - name: GOMEMLIMIT
      value: 1792MiB
    service:
      type: NodePort
      externalTrafficPolicy: Local
    config: |
      enable-telemetry = false
      max-server-connections = 0
      mem-quota-query = 67108864
      new_collations_enabled_on_first_bootstrap = true
      run-auto-analyze = false
      server-memory-quota = 268435456
      enable-safe-point-v2 = true

      [log]
        [log.file]
          max-backups = 3

      [performance]
        tcp-keep-alive = true

      [security]
        enable-sem = false
        cluster-ssl-ca = "{{CAPath}}"
        cluster-ssl-cert = "{{CertPath}}"
        cluster-ssl-key = "{{KeyPath}}"

  tiflash:
    labels:
      zr-evicter.tidbcloud.com/ignored: "true"
    recoverFailover: true
    affinity:
      podAntiAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app.kubernetes.io/component: tiflash
            topologyKey: "kubernetes.io/hostname"
    nodeSelector:
      serverless.tidbcloud.com/node: tiflash-wn
    tolerations:
      - effect: NoSchedule
        key: serverless.tidbcloud.com/node
        operator: Equal
        value: tiflash-wn
    replicas: 1
    maxFailoverCount: 3
    statefulSetUpdateStrategy: RollingUpdate
    requests:
      cpu: 100m
      memory: 1Gi
    storageClaims:
    - resources:
        requests:
          storage: 1000Gi
      storageClassName: tiflash-gp3-6000-600
    serviceAccount: backup-restore
    scalePolicy:
      scaleInParallelism: 128
      scaleOutParallelism: 1
    enableConfigRollback: false
    enablePVReclaim: true
    pvReclaimDelayDuration: 24h
    scaleInProtectionForNode: true
    groupName: ""
    failover:
      replicasPerFailureStore: 1
    canaryUpgrade:
      enabled: false
      clusterReadySeconds: 900
      stageReadySeconds: 300
      stagePercents: [10, 50, 100]
    autoScaling:
      enabled: false
      paused: false
      maxReplicas: 6
      cpu:
        maxThreshold: 0.8
        minThreshold: 0.4
        scaleInIntervalSeconds: 500
        scaleOutIntervalSeconds: 300
      storage:
        maxThreshold: 0.8
        minThreshold: 0.6
        scaleInIntervalSeconds: 500
        scaleOutIntervalSeconds: 1
    scaleInProtection:
      enabled: false
      storageThreshold: 0.8
      minReplicas: 1
    storeLimit:
      enabled: false
      unbalanceThreshold: 0.7
      normalRate: 15
      scalingInRate: 15
      scalingOutRate: 15
    env:
    - name: DFS_PREFIX
      value: S3_PREFIX
    - name: DFS_S3_BUCKET
      value: S3_BUCKET
    - name: DFS_S3_REGION
      value: S3_REGION
    - name: LD_LIBRARY_PATH
      value: /tiflash
    - name: CSE_MASTER_KEY_ID
      value: MASTER_KEY_ID_HOLDER
    - name: CSE_MASTER_KEY_CIPHER_TEXT
      value: MASTER_KEY_CIPHER_TEXT_HOLDER
    - name: CSE_MASTER_KEY_VENDOR
      value: MASTER_KEY_VENDOR_HOLDER
    config:
      config: |
        default_profile = "default"
        display_name = "TiFlash"
        http_port = "8123"
        listen_host = "0.0.0.0"
        tcp_port = "9000"
        enable_safe_point_v2 = true

        [flash]
          disaggregated_mode = "tiflash_write"
          service_addr = "0.0.0.0:3930"

        [flash.proxy]
          addr = "0.0.0.0:20170"
          config = "/data0/proxy.toml"
          data-dir = "/data0/proxy"
          log-level = "info"

        [logger]
          errorlog = "/data0/logs/error.log"
          level = "info"
          log = "/data0/logs/server.log"
          size = "2000M"

        # Allow larger number of rows in a segment to workaround for sparse table
        [profiles]
          [profiles.default]
            dt_segment_limit_rows = 5000000
            dt_segment_force_merge_delta_rows = 671088640
            dt_segment_stop_write_delta_rows = 1342177280
            remote_checkpoint_only_upload_manifest = false
            fap_handle_concurrency = 15
            fap_task_timeout_seconds = 150
            cpu_thread_count_scale = 5.0
            {{DDLGcIntervalConfig}}
        [raft]
          pd_addr = "serverless-cluster-pd.tidb-serverless.svc:2379"

        [storage]
          api_version = 2
          [storage.main]
            dir = ["/data0/db"]
          {{StorageS3Config}}

        [security]
          ca_path = "{{CAPath}}"
          cert_path = "{{CertPath}}"
          key_path = "{{KeyPath}}"
      proxy: |
        [raft-engine]
          enable = false
        [storage]
          reserve-space = "0"
        log-level = "info"
        [engine-store]
          enable-fast-add-peer = {{EnableFastAddPeer}}
        [security]
          ca-path = "{{CAPath}}"
          cert-path = "{{CertPath}}"
          key-path = "{{KeyPath}}"