apiVersion: apps/v1
kind: Deployment
metadata:
  name: tidb-gateway-inner
  labels:
    control-plane: tidb-gateway-inner
spec:
  selector:
    matchLabels:
      control-plane: tidb-gateway-inner
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        control-plane: tidb-gateway-inner
        app.kubernetes.io/instance: serverless-cluster
        app.kubernetes.io/component: tidb-gateway
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
    spec:
      nodeSelector:
        serverless.tidbcloud.com/node: "burstable"
      topologySpreadConstraints:
      - labelSelector:
          matchLabels:
            control-plane: tidb-gateway-inner
        maxSkew: 1
        topologyKey: topology.kubernetes.io/zone
        whenUnsatisfiable: ScheduleAnyway
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchLabels:
                  control-plane: tidb-gateway-inner
              topologyKey: kubernetes.io/hostname
      containers:
      - command:
        - /tidb-gateway
        args:
        - --infra-kubeconfig=/infra/kubeconfig
        - --tls-ca=/gateway-tls/ca.crt
        - --tls-cert=/gateway-tls/tls.crt
        - --tls-key=/gateway-tls/tls.key
        - --gateway-mode=inner
        image: aws-shared-provider-tidb-gateway:latest
        imagePullPolicy: IfNotPresent
        name: tidb-gateway
        env:
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
        ports:
          - containerPort: 3306
        securityContext:
          runAsNonRoot: true
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8081
          initialDelaySeconds: 12
          periodSeconds: 20
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8081
          initialDelaySeconds: 12
          periodSeconds: 10
        resources:
          limits:
            cpu: 900m
            memory: 1900Mi
          requests:
            cpu: 300m
            memory: 500Mi
        volumeMounts:
          - mountPath: /gateway-tls
            name: tls-certs
          - mountPath: /infra
            name: infra-api-kubeconfig
      volumes:
        - name: tls-certs
          secret:
            secretName: gateway-cert-inner-secret
            defaultMode: 0440
        - name: infra-api-kubeconfig
          secret:
            secretName: infra-api-kubeconfig
      serviceAccountName: tidb-gateway
      tolerations:
      - key: "serverless.tidbcloud.com/node"
        operator: "Equal"
        value: "burstable"
        effect: "NoSchedule"