# controlplane9: Project Landing Page

**Date:** 2026-04-17 | **Author:** @yifan | **Status:** APPROVED

> Replace the entire TiDB Cloud dev environment (112+ nodes, 6 clusters, 73 services) with local ephemeral environments on each developer's Mac.

See [20260417-design-cp9-expanded-scope.md](20260417-design-cp9-expanded-scope.md) for the full design and [20260413-design-cp9-stakeholder-guide.md](20260413-design-cp9-stakeholder-guide.md) for per-team migration detail.

---

## Why

- **Waste.** 112+ nodes across 6+ EKS clusters run 24/7; most compute is idle most of the time.
- **Slowness.** Features like CMEK M2 take 2+ weeks to E2E. Shared environments mean flakiness, collisions, cross-team blocking.
- **Agent ceiling.** AI coding agents write the code; manual deployment and manual E2E block agent-driven delivery.

cp9 gives each developer (and each agent) an isolated, disposable control plane. Infrastructure cost drops once dev clusters are decommissioned.

---

## How cp9 Works

```
+------------------- Developer Mac -------------------+
|  local k3d                                          |
|    L1 REAL  feature-path services + self-defined    |
|             CRD controllers (appbox, approute, …)   |
|    L1 STUB  off-path deps (proto / swagger)         |
|    crossplane (real) + per-cloud dev credentials    |
+---------------------------|-------------------------+
                            |  tunnel (VPN / SSM)
                            v
+-------- AWS Control Plane VPC A (real, dev) -------+
|  L2 real network + IAM via crossplane + cloud SDK   |
|     tagged cp9-owner / cp9-session                  |
|  NAT gateway — single cp9 dev egress EIP            |
+------|---------------------------|------------------+
       |                           |
       | prod createcluster        | public internet
       v                           v
+-------- Dataplane -------+  +---- Non-AWS clouds ----+
|  L3 per-session in       |  |  GCP / Azure /         |
|  target cloud            |  |  Alicloud public APIs  |
|  EKS / GKE / AKS / ACK   |  |  Auth0, dataplane APIs |
|  + tidb-operator +       |  +-------------------------+
|  real TiDB               |
+--------------------------+

cp9 destroy:
  stage 1 — local cleanup (k3d delete + Zero delete + session dir)
  stage 2 — tag-scoped force-purge across all clouds (exit 0 only
            if zero cp9-owner / cp9-session resources survive)
```

- **L1 runs locally in k3d.** Feature-path services build from source. Off-path deps are proto/swagger stubs. Self-defined CRD controllers run REAL.
- **L2/L3 use real cloud, no stubs.** Crossplane runs REAL in local k3d with per-cloud dev credentials. The tunnel reaches the AWS dev Control Plane VPC A; NAT egress from VPC A reaches GCP / Azure / Alicloud public APIs. The production `createcluster` path stands up a per-session dataplane in the target cloud.
- **`cp9 destroy` is a two-stage guarantee.** Local cleanup (k3d delete + Zero delete) then tag-scoped force-purge across clouds (authoritative). Exits 0 only when no tagged resource survives.
- **Per-developer, per-session.** Nothing shared across developers — no pool, no namespace-prefix scheme.
- **Staging data mirrored** for realistic test state.

### Coverage by Layer

| Layer | Approach |
|---|---|
| **L1** Microservice & controller | Feature-path REAL in local k3d; off-path deps as stubs; self-defined CRD controllers always REAL |
| **L2** Cloud infrastructure | Real cloud via crossplane + cloud SDK from local k3d; AWS resources in VPC A, non-AWS reached via NAT egress; all tagged + reaped |
| **L3** TiDB kernel | Real cloud via the prod `createcluster` path — per-session EKS / GKE / AKS / ACK + tidb-operator + real TiDB in the target cloud |

---

## What Changes for Each Team

| Before (shared dev env) | After (cp9) |
|---|---|
| Deploy to shared EKS, wait for other teams | `cp9 up` — isolated env on your Mac |
| All services running 24/7, most irrelevant | Only feature-path services run; rest stubbed or skipped |
| Shared state, test pollution, cost | Per-session, torn down on `cp9 destroy` |

Staging (PM/QA validation), production, your repos, CI/CD, and code review are unchanged.

---

## Phases

```
Phase 1  Global Control
         Teams: Global control, Billing, Account, Auth.
         O1 in progress.

Phase 2  Core Product Lines + Core Ecosystem + Kernel
         One capability set serves everyone who needs real cloud;
         kernel uses the same path.
         Teams: Starter/Essential @yuqing, Premium @tennix,
                Dedicated @cwen, BR/Import @jianyuan,
                CDC/Dataflow @wangbing, Kernel @wangcong.

Phase 3  Peripheral + New Region
         Teams: Frontend @bosn, Clinic @zheming, OPS portal @charles,
                O11Y @xinglu, New Region @alexquan.

Phase 4  All domains confirmed → dev env decommission begins.
```

Per-team capabilities and the C1–C5 capability index are documented in [20260417-design-cp9-expanded-scope.md](20260417-design-cp9-expanded-scope.md).