apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: tidb-http-gateway
  namespace: tidb-admin
  labels:
    control-plane: tidb-http-gateway
spec:
  replicas: 3
  selector:
    matchLabels:
      control-plane: tidb-http-gateway
  serviceName: "tidb-http-gateway"
  minReadySeconds: 10
  template:
    metadata:
      labels:
        control-plane: tidb-http-gateway
        app.kubernetes.io/component: tidb-http-gateway
        app.kubernetes.io/name: gateway
    spec:
      topologySpreadConstraints:
      - labelSelector:
          matchLabels:
            control-plane: tidb-http-gateway
        maxSkew: 1
        topologyKey: topology.kubernetes.io/zone
        whenUnsatisfiable: DoNotSchedule
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: serverless.tidbcloud.com/node
                operator: In
                values:
                - general
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                control-plane: tidb-http-gateway
            topologyKey: kubernetes.io/hostname
      containers:
        - name: tidb-http-gateway
          args:
            - --tls-cert=/http-gateway-tls/tls.crt
            - --tls-key=/http-gateway-tls/tls.key
          image: padding-image
          ports:
            - containerPort: 443
          livenessProbe:
            httpGet:
              path: /healthz
              port: 443
              scheme: HTTPS
            initialDelaySeconds: 5
          readinessProbe:
            httpGet:
              path: /healthz
              port: 443
              scheme: HTTPS
            initialDelaySeconds: 5
          resources:
            limits:
              cpu: "4"
              memory: 8Gi
            requests:
              cpu: "1"
              memory: 8Gi
          volumeMounts:
            - mountPath: /http-gateway-tls
              name: tls-certs
      volumes:
        - name: tls-certs
          secret:
            secretName: gateway-letsencrypt-secret
            defaultMode: 0440
      tolerations:
      - key: serverless.tidbcloud.com/node
        operator: Equal
        value: general
        effect: NoSchedule