provider: eks
regionConfig:
  name: us-west-2
  zones:
    - us-west-2a
    - us-west-2b
    - us-west-2c
env: dev
internetConfig:
  enableECRInterfaceEndpoints: false
  ecrServiceRegion: ""
appBoxConfig:
  serviceRoleName: full-manager-eks-role
  nodeConfig:
    capacityType: SPOT
    adminNodesAMIType: BOTTLEROCKET_x86_64
    systemVolumeSize: 20
  K8sVersion: "1.27"
  enableK8sPublicAccess: true
  apiserverPublicAccessCidrs:
    - "0.0.0.0/0"
  authorizedSubjects:
  - arn:aws:iam::552185537300:role/regional-server-role-edf68ba
  - arn:aws:iam::385595570414:role/full-manager-service-role
  adminNodeRoleConfig:
    trustPolicyFile: /etc/configs/admin-node-role-trust-policy.json
    policyTemplateFile: /etc/configs/admin-node-role-policy-template.json
    awsLBControllerPolicyFile: /etc/configs/aws-lb-controller-policy.json
    externalDNSPolicyTemplateFile: /etc/configs/external-dns-policy.json
    managedPolicies:
    - "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
    - "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
    - "arn:aws:iam::aws:policy/AWSDirectConnectFullAccess"
    - "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
    - "arn:aws:iam::aws:policy/AmazonRoute53ResolverFullAccess"
    # See https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started.html for more detail.
    - "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
predicate:
  matchExpressions:
    - key: "cloud.pingcap.com/reconciler"
      operator: "NotIn"
      values:
        - e2e-test
resourceLabels:
  cloud.pingcap.com/bizType: dedicated
  tags.tidbcloud.com/environment: dev
  tags.tidbcloud.com/usedby: dbaas-control-plane-shoot
gcConfig:
  checkIdleInterval: 5m
  idleTimeThreshold: 1h
  idleTimeRetention: 1h
clusterControlServiceEndpoint: "http://a49e2578f482545afbc7e9cf275fa37d-3d653dfa61fdd283.elb.us-west-2.amazonaws.com"
o11yRegionalServiceEndpoint: "http://www.rs.us-west-2.aws.observability-staging.pingcap.cloud"
globalCrossplaneProviderConfig: provider-aws # used to provision global resources such as route53 recordset and pca certificate
publicHostedZoneDomain: clusters.dev.tidb-cloud.com
publicHostedZoneID: Z001609810TV4E79YOP22
accountListPath: /etc/configs/account-list.yaml