replicaCount: 1

image:
  repository: service-proxy
  pullPolicy: IfNotPresent
  tag: ""

env:
  []

podSecurityContext:
  runAsNonRoot: true
  fsGroup: 2000

securityContext:
  runAsUser: 1000
  runAsGroup: 2000
  # allowPrivilegeEscalation: false
  # seccompProfile:
  #   type: RuntimeDefault
  # capabilities:
  #   drop: ["ALL"]
  # readOnlyRootFilesystem: true

serviceAccount:
  create: true
  annotations: {}
  name: "service-proxy"

service:
  type: ClusterIP
  annotations: {}
  port: 8080
  metricsPort: 8081

ingress:
  enabled: true
  protocols: http
  regexPrefix: "/@"
  annotations:
    kubernetes.io/ingress.class: kong
  paths:
    - path: /@/proxy/cluster/\d+/(pd|tibr|ticdc|dm|tidb-worker)(/.*)?
      pathType: ImplementationSpecific
  auditCheckRewrite:
    enabled: true

resources:
  limits:
    memory: 256Mi
  requests:
    cpu: 10m
    memory: 10Mi

auditSidecar:
  enabled: false
  image: "tidbcloud/audit-ng:latest"
  config:
    mode: agent                      # Enable Agent mode (not TiDB mode)
    rotationStrategy: copytruncate   # Use copytruncate for apps that don't support log reopening
    subPath: "service-proxy"
    pushTrigger:
      checkInterval: 5s
      cleanInterval: 60s
      filesPerPush: 5
      maxSize: 10 # trigger a rotation when file size >= 10 MiB
    logDir: /var/log
    auditLogFileName: ops-audit.log
    bucketURL: ""
    region: ""

config:
  audit:
    enabled: false
    filePath: /var/log/ops-audit.log
    bufferSize: 4096             # Write buffer size in bytes (default: 4096, max: 1048576)
    channelSize: 1000            # Async channel size (default: 1000, max: 100000)
    flushInterval: 10s           # Flush interval (default: 5s, min: 100ms, max: 1m)
    includeGetRequests: false    # Default: false, exclude GET requests from audit logs
    maxBodySize: 256             # Maximum request body size to log; <= 0 disables request body logging.
  server:
    addr: "0.0.0.0"
    port: 8080
  metrics:
    enabled: true
    port: 8081
    path: /metrics
  clusterRoutes:
  - name: pd-api
    match:
      prefix: /pd
    backend:
      serviceNamePattern: "^db-[a-z0-9]+-pd$"
      scheme: https
      port: 2379
    tls:
      enabled: true
      secretRef:
        name: "db-cluster-client-secret"
    timeout: 30s

  - name: tibr-api
    match:
      prefix: /tibr/{name}
    backend:
      serviceNameTemplate: "{name}-tibr-headless"
      scheme: https
      port: 19500
    tls:
      enabled: true
      insecureSkipVerify: true
    timeout: 30s

  - name: ticdc-api
    match:
      prefix: /ticdc/{name}
    backend:
      serviceNameTemplate: "{name}-ticdc-peer"
      scheme: https
      port: 8300
    tls:
      enabled: true
      secretRef:
        name: "db-cluster-client-secret"
    timeout: 30s

  - name: dm-api
    match:
      prefix: /dm/{id}
    backend:
      serviceNameTemplate: "dbcluster-{id}-dm-master"
      scheme: https
      port: 8261
    tls:
      enabled: true
      secretRef:
        name: "db-cluster-client-secret"
    timeout: 30s

  - name: tiflash-compute-api
    match:
      prefix: /tiflash-compute
    backend:
      serviceNamePattern: "^db-[a-z0-9]+-compute-tiflash-peer$"
      scheme: https
      port: 20292
    tls:
      enabled: true
      secretRef:
        name: "db-cluster-client-secret"
    timeout: 30s

  - name: tiflash-write-api
    match:
      prefix: /tiflash-write
    backend:
      serviceNamePattern: "^db-[a-z0-9]+-write-tiflash-peer$"
      scheme: https
      port: 20292
    tls:
      enabled: true
      secretRef:
        name: "db-cluster-client-secret"
    timeout: 30s

  - name: tidb-worker-api
    match:
      prefix: /tidb-worker
    backend:
      serviceNamePattern: "^db-[a-z0-9]+-worker-tidb$"
      scheme: https
      port: 10080
    tls:
      enabled: true
      secretRef:
        name: "db-cluster-client-secret"
    timeout: 30s
  serviceRoutes: []

nodeSelector: {}

tolerations: []

affinity: {}