apiVersion: apps/v1
kind: Deployment
metadata:
  name: pd-ctl-runner
  labels:
    app.kubernetes.io/name: pd-ctl-runner
    app.kubernetes.io/component: serverless-ops-helper
spec:
  replicas: 1
  # Recreate is fine: this is a helper pod for ops-service to exec into.
  # An occasional exec failure during restart is acceptable (ops-service retries).
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: pd-ctl-runner
  template:
    metadata:
      labels:
        app.kubernetes.io/name: pd-ctl-runner
        app.kubernetes.io/component: serverless-ops-helper
    spec:
      # Schedule on burstable (spot/mixed capacity) nodes. This is a stateless helper pod
      # used by ops-service for low-frequency SRE exec operations; spot preemption only
      # causes a brief retry window on the caller side, which is acceptable.
      # Same placement as cop-worker / tikv-worker / dm-cluster workers.
      nodeSelector:
        serverless.tidbcloud.com/node: burstable
      tolerations:
      - key: serverless.tidbcloud.com/node
        operator: Equal
        value: burstable
        effect: NoSchedule
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
      containers:
      - name: runner
        # Placeholder image; overridden at apply time by withDeploymentImage transformation
        # to ${pdBaseImage}:${pdServerImageTag}, so pd-ctl version always matches PD.
        image: "placeholder:latest"
        imagePullPolicy: IfNotPresent
        # The PD image's default entrypoint (/pd-server) would exit immediately.
        # Override with a long-running sleep loop that traps SIGTERM for clean shutdown.
        command:
        - /bin/sh
        - -c
        - "trap 'exit 0' TERM; while true; do sleep 3600 & wait $!; done"
        resources:
          requests:
            cpu: "10m"
            memory: "32Mi"
          limits:
            cpu: "200m"
            memory: "128Mi"
        securityContext:
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]
        volumeMounts:
        - name: pd-tls
          mountPath: /var/lib/pd-tls
          readOnly: true
        # emptyDir at /tmp so readOnlyRootFilesystem does not break pd-ctl's temp files.
        - name: tmp
          mountPath: /tmp
      volumes:
      - name: pd-tls
        secret:
          # Created and rotated by cert-manager via InstallTcClientCert (a Certificate
          # with spec.secretName: serverless-cluster-cluster-client-secret); contains
          # ca.crt / tls.crt / tls.key.
          secretName: serverless-cluster-cluster-client-secret
          defaultMode: 0400
      - name: tmp
        emptyDir: {}