apiVersion: cp9.tidbcloud.com/v1alpha2
kind: Session

# Canonical cp9 Session config reference. Copy this file to cp9.yaml and edit
# the copy. The comments here are the single source of truth for every
# user-settable config field; skills point here instead of restating the schema.
#
# `dev-full` always provides the shared Account/UI/O11Y services and the
# Premium/Dedicated control-plane runtime. The copied Session Tiltfile owns the
# exact source/image/stub service graph; it is not another cp9.yaml block.
# Optional product capabilities are selected below:
# - dedicated.gcp: second GCP Dedicated regional runtime alongside AWS;
# - starter: Starter / Essential v1 regional substrate, AI/FTS, observability;
# - essential_v2: Essential V2 shared-pool substrate;
# - ui: browser identity and O11Y runtime overrides;
# - byoc: customer-account BYOC Region activation.
# Product API lookup lives in the retained Premium, Dedicated, and Starter
# operation maps, not in this config.

# Required DNS-safe session identity. New sessions are limited to 15 characters.
# cp9 derives cp9-session, the runtime AWS profile, state directory, and resource
# name prefixes from this value; use a fresh name for concurrent work.
name: cp9-cara-full

# Which persona this session runs. Required, and an explicit value: cp9 used to
# infer it from the `personas/<name>/` segment of the tilt.file path, which
# broke as soon as you copied the Tiltfile anywhere else.
# `dev-full` is the supported product runtime for Premium, Dedicated, Starter,
# Essential V2, UI, and BYOC capabilities in this reference.
persona: dev-full

# AWS Dedicated remains enabled on the primary remote-ec2-k3d host. This
# optional block adds one independent GCP regional GCE+k3d runtime; it never
# changes target.cloud or disables the existing AWS region. The first slice is
# intentionally limited to us-west1. Both projects are explicit even when they
# are the same so a later cross-project move cannot silently change ownership.
# Credentials are not accepted here: local provisioning uses gcloud Device
# Flow and the runtime uses a session-owned GCE-attached service account.
# dedicated:
#   gcp:
#     enabled: true
#     seed_project_id: pingcap-gardener
#     dataplane_project_id: pingcap-gardener
#     region: us-west1
#     zone: us-west1-a

# Starter activation is lazy by default: run `cp9 up`, then
# `cp9 starter activate`. Set `enabled: true` to run the same full activation
# engine eagerly during `cp9 up`. Enabling observability also implies eager
# activation because Prometheus and Grafana require the Starter EKS substrate.
# starter:
#   enabled: true
#   # Optional advanced search stack. Core Starter activation leaves hosted
#   # embedding, AI Gateway, and FTS disabled and requires no AI/FTS secrets.
#   # Enabling this capability also implies eager Starter activation and
#   # requires the documented CP9_STARTER_* AI/FTS environment inputs.
#   ai_fts:
#     enabled: true
#   activation:
#     # true (default): 1 root PD + 2 TSO + 1 resource-manager workload.
#     # false: 3 monolithic PD replicas and no standalone TSO/RM workloads.
#     # The selected mode is immutable for the session substrate.
#     pdms: {enabled: true}
#     topology:
#       pd: {instance_type: m8g.xlarge}
#       tikv: {instance_type: r8g.xlarge}
#       keyspace_etcd: {instance_type: m8g.large}
#       gateway: {instance_type: m8g.large}
#       regional_control_plane: {instance_type: m6g.2xlarge}
#       tidb_serving:
#         instance_type: m8g.xlarge
#         nodes: 0 # default physical serving-node count
#   observability:
#     enabled: true
#     prometheus_retention: 24h

# Essential V2 is opt-in because activation creates a billable shared-pool
# dataplane and can add substantial cp9-up time. Enable it here to activate the
# pool during `cp9 up`. When omitted/false, Dev full starts without the pool and
# it can be added later with `bin/cp9 essential-v2 activate config=cp9.yaml`.
# essential_v2:
#   enabled: true
#   # Defaults to both workers. Use [TIKV_WORKER] to prove online
#   # COPROCESSOR_WORKER enablement from a single-worker baseline.
#   enabled_tikv_remote_workers: [TIKV_WORKER, COPROCESSOR_WORKER]

# The built-in UI is always deployed for Remote Dev full. Leave `seed_identity`
# unset and cp9 falls back to the shared CP9 test identity -- the
# `defaultRemoteDevFullUISeedIdentity` constant in internal/config/session.go --
# and activates its matching Account user as an org owner in this session. That
# fallback applies only to host.mode remote-ec2-k3d with the dev-full persona,
# and setting the field under any other host mode or persona is rejected.
# Auth0 owns the public test password; it is not part of cp9.yaml. This field is
# therefore the single override for that hardcoded default -- use it only with
# an identity an Auth0 administrator has already prepared.
# ui:
#   seed_identity:
#     email: you@pingcap.com
#   # Optional non-secret observability runtime override. Remote Dev full
#   # defaults NextGen and Dedicated to the session name, Dev Tier to
#   # dev-devtier, and both GS origins to this session's public origin. The
#   # pinned UI matches staging: an existing
#   # Auth0 token selects Bearer, while an absent token selects cookie auth.
#   # Supplying this block changes mounted config.js only.
#   o11y:
#     gs_host: https://gs.example.com
#     gs_host_v2: https://gsv2.example.com
#     test_host_domain_suffix: example.com
#     nextgen_biz_type: nextgen
#     dedicated_biz_type: dedicated
#     devtier_biz_type: dev-devtier

host:
  mode: remote-ec2-k3d
  # Lifetime used for ownership tags and cleanup eligibility. Pick a duration
  # long enough for the task, then close normally with cp9 destroy.
  ttl: 8h
  ec2:
    # Fast-start staging-aligned images may be amd64-only. Use an amd64 host
    # for default fast-start proof; arm64/Graviton remains valid for source-build
    # proof when every selected image can run on arm64.
    instance_type: m7i.xlarge
    # cp9 derives and pins a compatible Amazon Linux 2023 AMI from this
    # instance type and the target AWS region.
    # The EC2 key pair name must already exist or be imported from your public
    # SSH key before cp9 up.
    key_pair: cp9-cara-full
    ssh_user: ec2-user
    # Absolute local private-key path. cp9 passes this directly to ssh -i, so
    # shell shortcuts such as "~" are not expanded. Never commit the key material.
    ssh_private_key: /Users/you/.ssh/id_ed25519
    # Replace with a subnet in the target account/region.
    subnet_id: subnet-0123456789abcdef0
    root_volume_size_gib: 160
    # Extra security groups to attach to the host, on top of the one cp9
    # creates for the session.
    # security_group_ids: []
    # Source range allowed to reach the host's SSH port. Left unset this
    # defaults to 0.0.0.0/0, so the session host accepts SSH from anywhere --
    # set your own range unless you specifically want that.
    # allowed_cidr: 203.0.113.0/24
  # Remote Dev full's mandatory UI uses this same session origin for both the
  # browser files and APIs. Values come from the account bootstrap
  # terraform/cp9-developer/SKILL.md DNS floor; there is no supported
  # localhost or exposure-disabled UI variant.
  exposure:
    enabled: true
    # All three values come from this runtime account's entry in
    # .github/cp9-cleanup-accounts.json. The zone is account bootstrap state,
    # not a per-session resource.
    zone_id: <runtime-account-dns-zone-id>
    zone_name: <runtime-account-id>.cp9.dev.aws.tidbcloud.com
    certificate_arn: arn:aws:acm:us-west-2:<runtime-account-id>:certificate/<runtime-certificate-id>

target:
  cloud: aws
  region: us-west-2
  aws:
    iam:
      # cp9 derives and persists the one effective account from this profile/role chain.
      # The runtime profile is named after the top-level Session.
      # Source profile used before cp9 exists; replace with your local SSO or
      # agent profile that can assume the cp9-developer role.
      source_profile: cp9-agent-local-source
      role_arn: arn:aws:iam::<runtime-account-id>:role/cp9-developer
    # Starter's regional EKS cluster. Both values are yours to choose: they
    # survive `cp9 starter activate` and are passed straight to Terraform.
    # Leave them unset to take the reviewed defaults.
    # remote_eks:
    #   cluster_name: cp9-cara-full-starter
    #   kubernetes_version: "1.31"

# Optional AK/SK or CI-only owner assertion path when AWS SSO is unavailable:
# Set CP9_OWNER to one of the allowlisted owners for the caller principal.
# ci:
#   owner_allowlist:
#     arn:aws:iam::<runtime-account-id>:user/cp9-agent-local:
#       - ci@example.com

terraform:
  # Temporary in-repo substrate location while the Dev full Terraform contract is proved.
  # Durable target: ../auto-deploy with the same terraform/aws/cp9-substrate path.
  repo: .
  ref: main
  path: terraform/aws/cp9-substrate
  var_file: terraform/aws/cp9-substrate/premium.tfvars

# Selects the immutable owner-artifact/image input set: `dev` or `staging`.
# Dev full defaults to `dev`; set `staging` only when that exact released input
# set is the task boundary. This selects source evidence, never a live staging
# runtime to mutate.
# artifacts:
#   environment: dev

tilt:
  # `up` owns the normal long-running dev loop. `ci` and `generate-only` are
  # explicit automation/render modes; do not use them as faster substitutes for
  # an interactive product session.
  mode: up
  # Copy this persona Tiltfile example to a session-owned file before editing
  # product graph details for a proof run.
  file: ./personas/dev-full/runtime/example.Tiltfile
  # Port for the Tilt API/UI on the remote host. Set it only when the default
  # collides with something else you are running on that host.
  # port: 10350

services:
  # Maximum simultaneous CPU-heavy source image builds. Omit for the safe
  # default of 1. Raise it only when the remote host has spare CPU and memory;
  # each selected source service is a full container image build.
  source_build_parallelism: 1

  # Public client ID of the approved CP9 GitHub App used for Device Flow.
  github_app_client_id: Iv23liKDo1S8LDZ07CZU

# Optional AWS BYOC Region capability. Uncomment the whole block only after the
# human onboarding guide is complete. CP9 validates but never creates or adopts
# the customer-owned DNS zones, PCA, CIDR, quota, or AZ mapping.
#
# `enabled: true` runs the resumable Region activation during cp9 up. Keep it
# false to use the same engine later with `cp9 byoc activate`; either path must
# finish with `cp9 byoc status` reporting ready. `cp9 destroy` removes only
# session-owned BYOC resources and retains the documented customer prerequisites
# and shared ECR cache.
# byoc:
#   enabled: true
#   customer:
#     # Omit tenant_id: cp9 uses the only accepted local UI organization,
#     # 1440002. Any explicit value must equal it.
#     account_id: "111122223333"
#     # At least two unique AZ names and physical AZ IDs from the customer
#     # account. Do not infer IDs from names across accounts.
#     availability_zones:
#       - name: us-west-2a
#         id: usw2-az2
#       - name: us-west-2b
#         id: usw2-az1
#     tidb:
#       cidr: 10.158.0.0/16
#       hosted_zone_name: tidb.111122223333.byoc.example.com
#       hosted_zone_id: Z0123456789EXAMPLE
#       # Active root/subordinate PCA in target.region. If its ARN names an
#       # account other than customer.account_id, the explicit opt-in below is
#       # required so a mistyped account cannot pass as an intentional share.
#       pca_arn: arn:aws:acm-pca:us-west-2:222233334444:certificate-authority/00000000-0000-0000-0000-000000000000
#       pca_shared_from_other_account: true
#     o11y:
#       # The first BYOC slice requires the customer O11Y DNS contract even
#       # though the O11Y runtime itself is not deployed by this capability.
#       hosted_zone_name: o11y.111122223333.byoc.example.com
#       hosted_zone_id: Z9876543210EXAMPLE
#     image_sync_region: us-west-2
#     # Set true only after DNS delegation, PCA, quotas, CIDR non-overlap, and
#     # AZ mapping have been verified. Strict config load fails while false.
#     quota_ready: true
#   account_setup:
#     # Local-only customer-account profile. It must resolve to
#     # customer.account_id and differ from both target AWS profiles.
#     profile: customer-sso
#     # Separate TiDB Cloud Clinic account used as a CloudFormation trust
#     # principal; it is not a credential profile or the customer account.
#     clinic_account_id: "444455556666"
#     # Reuse only compatible customer-owned setup stacks. CP9 retains reused
#     # stacks and validates their identity/critical parameters, not full bodies.
#     reuse_existing_stacks: false