kind: StatefulSet
apiVersion: apps/v1
metadata:
  name: {{!ComponentGroup}}
  namespace: tidb{{!ClusterId}}
  labels:
    pingcap.com/group: {{!ComponentGroup}}
    pingcap.com/component: {{!ComponentType}}
    pingcap.com/cluster: db
    pingcap.com/managed-by: cluster-ng-server
    app.kubernetes.io/component: {{!ComponentType}}
    app.kubernetes.io/instance: {{!ComponentGroup}}
    app.kubernetes.io/managed-by: cluster-ng-server
    tags.tidbcloud.com/version: {{!Version}}
    tags.tidbcloud.com/node-spec: {{!NodeSpec}}
    tags.tidbcloud.com/shared-pool: '{{!SharedPoolId}}'
  annotations:
    tags.tidbcloud.com/node-min-count: "{{!MinNodeCount}}"
    tags.tidbcloud.com/node-max-count: "{{!MaxNodeCount}}"
spec:
  serviceName: {{!ComponentGroup}}-peer
  replicas: {{!Replicas}}
  persistentVolumeClaimRetentionPolicy:
    whenDeleted: Delete
    whenScaled: Delete
  selector:
    matchLabels:
      app.kubernetes.io/instance: {{!ComponentGroup}}
      app.kubernetes.io/component: {{!ComponentType}}
      pingcap.com/group: {{!ComponentGroup}}
      pingcap.com/component: {{!ComponentType}}
      pingcap.com/cluster: db
      pingcap.com/managed-by: cluster-ng-server
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: {{!ComponentGroup}}
        app.kubernetes.io/component: {{!ComponentType}}
        pingcap.com/group: {{!ComponentGroup}}
        pingcap.com/component: {{!ComponentType}}
        pingcap.com/cluster: db
        pingcap.com/managed-by: cluster-ng-server
        {{!exist begin!UserTenantId}}
        tags.tidbcloud.com/tenant: '{{!UserTenantId}}'
        {{!exist end!UserTenantId}}
        tags.tidbcloud.com/resource-pool: '{{!SharedPoolId}}'
        tags.tidbcloud.com/component: {{!ComponentType}}
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: 'yes'
        prometheus.io/path: /metrics
        prometheus.io/port: '{{!StatusPort}}'
        prometheus.io/scrape: 'true'
    spec:
      hostNetwork: true
      priorityClassName: tidb-ng-component-critical
      serviceAccountName: tidb-cluster
      volumes:
        - name: tici-worker-tls
          secret:
            defaultMode: 420
            secretName: {{!ComponentGroup}}-cluster-secret
        - name: config
          configMap:
            name: {{!ComponentGroup}}
        - name: tmp-volume
          emptyDir: {}
        - name: client-ssl
          secret:
            defaultMode: 420
            secretName: db-cluster-client-secret
      containers:
        - name: tici-worker
          image: {{!Image}}
          imagePullPolicy: {{!ImagePullPolicy}}
          command:
            - /bin/sh
            - -c
            - |
              set -ex
              sed "s/POD_NAME/${POD_NAME}/g" /etc/tici-worker/config.toml > /tmp/config.toml
              cat /tmp/config.toml
              exec /tici-server worker --config /tmp/config.toml --log-file=
          env:
          - name: NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: CLUSTER_NAME
            value: db
          - name: TZ
            value: UTC
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          ports:
          - containerPort: {{!ServerPort}}
            hostPort: {{!ServerPort}}
            name: server
            protocol: TCP
          - containerPort: {{!StatusPort}}
            hostPort: {{!StatusPort}}
            name: status
            protocol: TCP
          resources:
            {{!exist begin!SetResource}}
            requests:
              cpu: {{!CPU}}
              memory: {{!RequestMemory}}Mi
            limits:
              {{!exist begin!LimitCPU}}
              cpu: {{!LimitCPU}}
              {{!exist end!LimitCPU}}
              memory: {{!Memory}}Mi
            {{!exist end!SetResource}}
          volumeMounts:
            - mountPath: /var/lib/tici-worker-tls
              name: tici-worker-tls
              readOnly: true
            - mountPath: /etc/tici-worker
              name: config
              readOnly: true
            - mountPath: /tmp
              name: tmp-volume
            - mountPath: /var/lib/client-ssl
              name: client-ssl
            - mountPath: /var/lib/tici-worker
              name: data
          readinessProbe:
            tcpSocket:
              port: {{!StatusPort}}
            initialDelaySeconds: 10
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 3
          securityContext: 
            readOnlyRootFilesystem: false
            allowPrivilegeEscalation: true
            privileged: true
            capabilities:
              drop:
                - NET_RAW
      restartPolicy: Always
      dnsPolicy: ClusterFirstWithHostNet
      nodeSelector:
        node-spec: {{!NodeSpec}}
        tidbcloud.com/node-pool-k8s-version: "{{!NodeVersion}}"
      tolerations:
      - effect: NoSchedule
        key: dedicated
        operator: Equal
        value: worker
      - effect: NoExecute
        key: node.kubernetes.io/not-ready
        operator: Exists
        tolerationSeconds: 300
      - effect: NoExecute
        key: node.kubernetes.io/unreachable
        operator: Exists
        tolerationSeconds: 300
      schedulerName: default-scheduler
  volumeClaimTemplates:
  - metadata:
      name: data
      labels:
        {{!exist begin!UserTenantId}}
        tags.tidbcloud.com/tenant: '{{!UserTenantId}}'
        {{!exist end!UserTenantId}}
        tags.tidbcloud.com/resource-pool: '{{!SharedPoolId}}'
        tags.tidbcloud.com/component: {{!ComponentType}}
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: {{!StorageSize}}Gi
      storageClassName: {{!StorageClassName}}
      volumeAttributesClassName: {{!VolumeAttributesClassName}}