# Dedicated Full AWS Staging Inventory

This inventory supports issue #401. It captures the real Dedicated staging
deployment shape before implementing the cp9 Dedicated full persona.

Source-of-truth clusters:

- Global control plane: `staging-base-us-west-2`
- Regional control plane: `staging-seed-us-west-2`

Security boundary: this document records workload names, images, commands, port
surfaces, env var names, Kubernetes object references, app-delivery paths, and
source repository paths. It intentionally does not record credential values,
kubeconfig contents, Secret data, database URLs, Auth0 secrets, or AWS secret
payloads. Secret object names are listed only when they are part of the runtime
shape.

cp9 role vocabulary follows the env-creation design:

- `source`: service built from local source in the developer loop.
- `live`: real dependency deployed from app-delivery manifests/images.
- `stub`: generated or recording replacement for an off-path dependency.

## Global CP Inventory

Observed in namespace `tidb-management-service` on `staging-base-us-west-2`.

| Workload | Image | Command / args | Ports | Env / config refs | App-delivery path | Source repo / binary | Proposed cp9 role |
| --- | --- | --- | --- | --- | --- | --- | --- |
| `Deployment/tidb-mgmt-portal` | `385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/tidb-management-service:release-v0.84-9021df668aff067a52e3cd2fb87fbfc639b77e72` | `/command/tidb-mgmt-portal/tidb-mgmt-portal --config=/etc/tidb-mgmt-portal/config.yaml` | container `8080` service, `9090` metrics; service `dedicated-tidb-mgmt-portal:80 -> 8080`, `tidb-mgmt-portal-metrics:9090` | env names `GIN_MODE`, `TIINF_POD_NAME`; ConfigMap `tidb-mgmt-portal-9f8cb9bfgm`; `pprof-dumps` emptyDir | `tidb-mgmt-portal/envs/staging` | `tidbcloud/tidb-management-service`, `tidb-mgmt-portal/cmd/tidb-mgmt-portal` | `source` for OpenAPI entrypoint tests |
| `StatefulSet/tidb-mgmt-service-sts` | same tidb-management-service release image | `/command/tidb-mgmt-service/tidb-mgmt-service -config=/etc/tidb-mgmt-service/config.yaml` | container/service `8080` http, `10001` grpc, `9090` metrics | env names `TIINF_POD_NAME`, `POD_NAME`, `POD_IP`; ConfigMap `tidb-mgmt-service-8725h84gh9`; `pprof-dumps` emptyDir | `tidb-mgmt-service/envs/staging` | `tidbcloud/tidb-management-service`, `tidb-mgmt-service/cmd/tidb-mgmt-service` | `source` when the OpenAPI/internal API path changes; otherwise `live` |
| `StatefulSet/dedicated-global-service` | same tidb-management-service release image | `/command/dedicated-global-service/dedicated-global-service serve --config=/etc/dedicated-global-service/config.yaml` | service `10000` grpc, `8080` http, `9090` metrics | env names `TIINF_POD_NAME`, `POD_NAME`, `POD_IP`; ConfigMap `dedicated-global-service-dm2dkc2g7g`; jaeger sidecar | `dedicated-global-service/envs/staging` | `tidbcloud/tidb-management-service`, `dedicated-global-service/cmd/dedicated-global-service` | `source` for Dedicated global business logic |
| `StatefulSet/nextgen-global-service` | same tidb-management-service release image | `/command/nextgen-global-service/nextgen-global-service serve --config=/etc/nextgen-global-service/config.yaml` | service `10000` grpc, `8080` http, `9090` metrics | env names `TIINF_POD_NAME`, `POD_NAME`, `POD_IP`; ConfigMap `nextgen-global-service-k9k969f4t2`; jaeger sidecar | `nextgen-global-service/envs/staging` | `tidbcloud/tidb-management-service`, `nextgen-global-service/cmd/nextgen-global-service` | `live` unless a Dedicated scenario explicitly enters nextgen workflows |

Global CP notes:

- `tidb-mgmt-portal` is the OpenAPI HTTP entrypoint; the Dedicated portal
  service points to the generic `tidb-mgmt-portal` pods.
- `tidb-mgmt-service` routes Dedicated requests to `dedicated-global-service`
  over grpc. Both are needed for OpenAPI-driven cp9 acceptance proof.
- `nextgen-global-service` is present in the same namespace and shares the
  release image, but it should not be treated as Dedicated-specific without a
  concrete Dedicated API path that uses it.

### Global Infra Support

Observed in namespace `infra` on `staging-base-us-west-2`. These objects are
part of the global staging physical shape, but all three currently have desired
replicas `0`. That means they are deployment evidence, not proof that they are
active runtime dependencies for the first cp9 Dedicated full slice.

| Workload | Image | Command / args | Ports | Env / config refs | App-delivery path | Source repo / binary | Proposed cp9 role |
| --- | --- | --- | --- | --- | --- | --- | --- |
| `Deployment/infra/dedicated-api-server` | `385595570414.dkr.ecr.us-west-2.amazonaws.com/third-party/kube-apiserver:v1.21.1` plus `kube-controller-manager:v1.21.1` sidecar | `kube-apiserver` and `kube-controller-manager` with TLS, etcd, RBAC, service-account, requestheader, and service CIDR flags | container `443` https | Secret refs `api-server-ca`, `dedicated-api-server`, `api-server-service-account-key`, `api-server-kube-controller-manager`, `api-server-aggregator-ca`, `api-server-aggregator`, `etcd-ca`, `etcd-client`; emptyDir generated kubeconfig/token volumes | `dedicated-infra-apiserver` app-delivery tree | Kubernetes control-plane binaries from third-party images | `live` only if a later issue proves this virtual apiserver is required; not a source service |
| `Deployment/infra/infra-exporter` | `385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/infra-exporter:f993b0894159af176c95f9c41ee8b9fcd7f2fcdc` | `--infra-kubeconfig=/.kube/config` | container `8090` metrics | Secret `infra-exporter-infra-kubeconfig` | `infra-exporter/envs/staging-base-us-west-2` | `tidbcloud/infra-provider`, `infra-exporter/main.go` | `live` only if metrics evidence is needed; otherwise omit from minimal proof |
| `Deployment/infra/infra-webhook` | `385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/infra-webhook:808216badc7177fac8a548f42f58b680263758d4` | `/webhook -zap-devel=false -compat-mode=true -compat-env staging` | container `9443` webhook | env names `COMPAT_XREGION_AUTH_KEY`, `KUBECONFIG`, `AWS_DEFAULT_REGION`, `AWS_REGION`; Secret refs `infra-webhook-infra-kubeconfig`, `infra-webhook-cert-v2` | `infra-webhook/envs/staging` | `tidbcloud/infra-provider`, `infra-webhook/main.go` | `live` only if webhook validation is required by an active path |

## Regional CP Inventory

Observed in namespaces `regional-server-system`, `infra`, `tcidm`, and
`cluster-service` on `staging-seed-us-west-2`.

### Dedicated Regional Server

| Workload | Image | Command / args | Ports | Env / config refs | App-delivery path | Source repo / binary | Proposed cp9 role |
| --- | --- | --- | --- | --- | --- | --- | --- |
| `Deployment/regional-server-system/regional-server` | `385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/dedicated-regional-server:2b77cce73d53ae5dbf6b340852fdfa6614133ae3` | args `--port=8080`, `--log-level=debug`, `--client-mode=true`, `--leader-elect=true`, `--root-config=/etc/configs/root-config.yaml`, `--addon-template-config=/etc/configs/k8s-addon-templates.yaml`, `--infra-template-config=/etc/configs/k8s-infra-templates.yaml`, `--dedicated-template-config=/etc/configs/k8s-dedicated-templates.yaml`, `--dp-template-config=/etc/configs/k8s-dp-templates.yaml` | container `8080`; service `regional-server:80 -> 8080`, `8082` metrics | service account `dedicated-regional-server-manager`; ConfigMaps `regional-server-root-config-4g2bkgc474`, `regional-server-addon-template-config-42599h7ght`, `regional-server-infra-template-config-888g5k57hh`, `regional-server-dedicated-template-config-f8kkt2f899`, `regional-server-dp-template-config-hk5df58d9d`, plus policy/template ConfigMaps | registry `dedicated-regional-server/app-registry/regional-server.yaml`; env `dedicated-regional-server/regional-server/envs/aws-staging-us-west-2` | `tidbcloud/infra-provider`, `regional-server/main.go` | `source` for Dedicated regional orchestration |
| `Deployment/regional-server-system/o11y-agent-control-server` | `385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/agent-control-server:12eb0aca76d5264f5d4376a2ca4a9e50df8a1f7e` | args `--root-config=/etc/root-configs/config.yaml`, `--agent-config-templates-dir=/templates` | service `o11y-agent-control-server:8082` | env names `CONCURRENT_RECONCILES`, `O11Y_AUTH0_CLIENT_ID`, `O11Y_AUTH0_CLIENT_SECRET`; ConfigMap `o11y-agent-control-server-root-config-4c4hkcdfc4`; template ConfigMaps `templates-dedicated-k8s-*`, `templates-dedicated-k8s-jobs-*`, `templates-dedicated-tidbcluster-*` | registry `app-registry/o11y-agent-control-server.yaml`; env `o11y-agent-control-server/envs/aws-staging-us-west-2` | external source `tidbcloud/observability/agent-control-server` | `live` or `stub`; first Dedicated full slice should avoid source-building observability unless the tested feature needs it |

### infra-provider / eks-provider

The staging evidence shows the confusing `infra-provider` surface is one source
repo and one main binary family with different subcommands/flags. Do not infer
separate services from directory names alone.

All seven `infra` namespace provider deployments listed below currently have
desired replicas `0` in `staging-seed-us-west-2`. They are still important
because app-delivery owns the manifests and commands, but cp9 should not assume
they are active seed-cluster dependencies without a later dataplane/materializer
proof.

Source repository: `tidbcloud/infra-provider`.

- Main EKS provider binary: `cluster-controller/main.go`, deployed as
  `/eks-provider`.
- Subcommands are registered under `cluster-controller/internal/cmd`, including
  `run-dm-controller`, `run-import-controller`, `run-br-controller`,
  `run-cdc-controller`, `run-dumpling-controller`, and
  `run-dwworker-controller`.
- Infra exporter binary: `infra-exporter/main.go`.
- Infra webhook binary: `infra-webhook/main.go`, deployed as `/webhook`.

| Workload | Image | Command / args | Ports | Env / config refs | App-delivery path | Source binary | Proposed cp9 role |
| --- | --- | --- | --- | --- | --- | --- | --- |
| `Deployment/infra/eks-infra-provider` | `385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/eks-provider:551a4eb0d83373b354f882e5ff3a9c9ec0296f4e` | `/eks-provider --namespace=infra --root-config=/etc/infra-api/config.yaml --enable-cm-controllers=true --enable-dp-controllers=false --leader-elect=true` | metric service `eks-infra-provider-metric:8080` | env names include `ACCOUNT_XREGION_AUTH_KEY`, `CLINIC_ACTIVITY_TOKEN`, `KUBECONFIG`, Auth0 client env names; ConfigMaps `eks-provider-root-config-kh5kctt89f`, `extra-storageclass`, `instancetype`, `nodepolicy`, `node-userdata-system-configuration`; Secret `eks-provider-infra-kubeconfig` | `eks-provider/envs/stg-us-west-2` | `cluster-controller/main.go` | `live/deferred`; source only if a cp9 issue changes controller code |
| `Deployment/infra/dp-eks-infra-provider` | same eks-provider tag | `/eks-provider --namespace=infra --root-config=/etc/infra-api/config.yaml --enable-cm-controllers=false --enable-dp-controllers=true --leader-elect=true` | metric service `dp-eks-infra-provider-metric:8080` | env names include `COMPAT_XREGION_AUTH_KEY`, `KUBECONFIG`, Auth0 client env names; ConfigMap `eks-provider-root-config-kh5kctt89f`; Secret `eks-provider-infra-kubeconfig` | `eks-provider/envs/stg-us-west-2/dp-deployment.yaml` | `cluster-controller/main.go` | `live/deferred` until dataplane materialization proof |
| `Deployment/infra/dp-eks-infra-provider-br` | same eks-provider tag | `/eks-provider run-br-controller --namespace=infra --root-config=/etc/infra-api/config-br.yaml --leader-elect=true` | metric service `dp-eks-infra-provider-br-metric:8080` | same Auth0/kubeconfig env-name pattern; ConfigMaps `eks-provider-br-config-b6f7t89dt4`, `instancetype`; Secret `eks-provider-infra-kubeconfig` | `eks-provider/envs/stg-us-west-2/dp-deployment.yaml` plus BR config overlays | `cluster-controller/internal/cmd/br.go` | `live/deferred` when backup/restore is in scope |
| `Deployment/infra/dp-eks-infra-provider-cdc` | same eks-provider tag | `/eks-provider run-cdc-controller --namespace=infra --root-config=/etc/infra-api/config-cdc.yaml --leader-elect=true` | metric service `dp-eks-infra-provider-cdc-metric:8080` | same Auth0/kubeconfig env-name pattern; ConfigMap `eks-provider-cdc-config-hhf6d98hd8`; Secret `eks-provider-infra-kubeconfig` | `eks-provider/envs/stg-us-west-2/dp-deployment.yaml` plus CDC config overlays | `cluster-controller/internal/cmd/cdc.go` | `live/deferred` only when CDC is in scope |
| `Deployment/infra/dw-eks-infra-provider-dumpling` | same eks-provider tag | `/eks-provider run-dumpling-controller --namespace=infra --root-config=/etc/infra-api/config.yaml` | no service observed | ConfigMap `eks-provider-root-config-kh5kctt89f`; Secret `eks-provider-infra-kubeconfig` | `eks-provider/envs/stg-us-west-2/dw-deployment.yaml` | `cluster-controller/internal/cmd/dumpling.go` | `live/deferred` only when data work/export path is in scope |
| `Deployment/infra/dw-eks-infra-provider-dwworker` | same eks-provider tag | `/eks-provider run-dwworker-controller --namespace=infra --root-config=/etc/infra-api/config.yaml` | no service observed | ConfigMap `eks-provider-root-config-kh5kctt89f`; Secret `eks-provider-infra-kubeconfig` | `eks-provider/envs/stg-us-west-2/dw-deployment.yaml` | `cluster-controller/internal/cmd/dwworker.go` | `live/deferred` only when data work/export path is in scope |
| `Deployment/infra/k8s-version-controller` | `385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/eks-provider:fff83cb66897e471b51a5ec80b233287ad078bc5` | `/eks-provider --root-config=/etc/infra-api/config.yaml --enable-cm-controllers=true --enable-k8s-version-controller=true --enable-dp-controllers=false` | no service observed | env name `KUBECONFIG`; ConfigMaps `eks-provider-root-config-kh5kctt89f`, `instancetype`, `node-userdata-system-configuration`; Secret `eks-provider-infra-kubeconfig` | `eks-provider/envs/stg-us-west-2/k8s-version-controller-deployment.yaml` | `cluster-controller/main.go` | `live/deferred` only for Kubernetes upgrade scenarios |

### tcidm

Runtime placement: `tcidm` is regional seed control-plane runtime on
`staging-seed-us-west-2`, not a global CP service. Its app-delivery registry
deploys per cloud/region to seed/control-plane clusters, for example
`aws-staging-us-west-2 -> staging-seed-us-west-2`.

Purpose from staging/source evidence:

- `regional-tcidm-service` exposes the Regional Control Import Service API under
  `/api/v1/tcidm` and loads `/etc/dbaas/config.yaml`.
- `dm-controller` and `import-controller` are controllers built from the
  infra-provider EKS provider binary and run controller subcommands.

| Workload | Image | Command / args | Ports | Env / config refs | App-delivery path | Source repo / binary | Proposed cp9 role |
| --- | --- | --- | --- | --- | --- | --- | --- |
| `Deployment/tcidm/dm-controller` | `385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/dm-controller:ae47c204d76f755753a933a405cb72ac9085713f` | `/eks-provider run-dm-controller --infra-kubeconfig= --root-config=/etc/dm-controller/main/root-config.yaml --leader-elect=true` | metric service `dm-controller-metric:8080` | ConfigMap `dm-controller-root-config-k6t8d5h2km`; service account `dm-controller` | registry `tcidm/app-registry/dm-controller.yaml`; env `tcidm/dm-controller/envs/aws-staging-us-west-2` | `tidbcloud/infra-provider`, `cluster-controller/internal/cmd/dm.go` | `live` only when migrate-from-MySQL data product is in scope |
| `Deployment/tcidm/import-controller` | `385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/import-controller:94776a48717748e85e68f3632016ec0c6c6084c0` | `/eks-provider run-import-controller --infra-kubeconfig= --root-config=/etc/import-controller/main/root-config.yaml --leader-elect=true` | metric service `import-controller-metric:8080` | ConfigMap `import-controller-root-config-dt784dt7cf`; service account `import-controller` | registry `tcidm/app-registry/import-controller.yaml`; env `tcidm/import-controller/envs/aws-staging-us-west-2` | `tidbcloud/infra-provider`, `cluster-controller/internal/cmd/import.go` | `live` only when import data product is in scope |
| `Deployment/tcidm/regional-tcidm-service` | `385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/regional-tcidm-service:16191a5eecc8ba7a3e0c9343e7c6a52f6588716a` | `regional_tcidm_service` | service `regional-tcidm-service-service:8080` http, `9090` metrics | env name `TIINF_POD_NAME`; ConfigMap `regional-tcidm-service-conf`; service account `regional-tcidm-service` | registry `tcidm/app-registry/regional-tcidm-service.yaml`; env `tcidm/regional-tcidm-service/envs/aws-staging-us-west-2` | `tidbcloud/tcidm`, `cmd/regional_tcidm_service/main.go` | `stub` or `live` depending data-product dimension; omit from core Dedicated-only persona |

### Legacy cluster-service namespace

The seed cluster also runs older `cluster-service` workloads. They are relevant
evidence because Dedicated staging still has them, but they should not be copied
into cp9 Dedicated full unless the specific product path requires them.

| Workload | Image | Command / args | Ports | Env / config refs | App-delivery path | Source repo / binary | Proposed cp9 role |
| --- | --- | --- | --- | --- | --- | --- | --- |
| `Deployment/cluster-service/cluster-control-server` | `385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/cluster-control-server:808216badc7177fac8a548f42f58b680263758d4` | `/server` with AWS region/provider/auth/ns-prefix flags | service `cluster-control-service:80 -> 8080` | env names `PROXY_AUTH0_CLIENT_ID`, `PROXY_AUTH0_CLIENT_SECRET` | registry `dedicated-cluster-service/app-registry/cluster-server.yaml`; env `dedicated-cluster-service/cluster-server/envs/staging-us-west-2` for seed placement | `tidbcloud/infra-provider`, `cluster-server/main.go` | `live` only for legacy cluster-service paths |
| `Deployment/cluster-service/cluster-controller` | `385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/eks-provider:347de91ddfe637df88f23aff7ac94ef669becdb6` | `/eks-provider --infra-kubeconfig= --root-config=/etc/cluster-controller/main/root-config.yaml --enable-cm-controllers=true --enable-dp-controllers=false --leader-elect=true`, plus `--enable-uo-controller=true`, `--enable-network-controllers=false`, `--enabled-controllers=cluster,configchange,workflow,backup,restore,compactbackup,upgradeoperation,replay` | metric service `cluster-controller-metric:8080` | ConfigMaps `cluster-controller-root-config-bb74cf8k7k`, `cluster-controller-extra-config-fh9h698d88`; Auth0/account/clinic env names | registry `dedicated-cluster-service/app-registry/cluster-controller.yaml`; env `dedicated-cluster-service/cluster-controller/envs/staging-us-west-2` | `tidbcloud/infra-provider`, `cluster-controller/main.go` | `live` only for legacy cluster-service paths |
| `Deployment/cluster-service/infra-exporter` | `385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/infra-exporter:25760f8efc98c07a5a812d89f0721d23cb467d93` | `--infra-kubeconfig= --provider=eks` | service `infra-exporter:8090` metrics | no config volume observed | registry `dedicated-cluster-service/app-registry/cluster-exporter.yaml`; env `dedicated-cluster-service/cluster-exporter/envs/staging-us-west-2`; app-delivery app is named `cluster-exporter` while the workload is `infra-exporter` | `tidbcloud/infra-provider`, `infra-exporter/main.go` | `live` only if legacy metrics needed |
| `Deployment/cluster-service/webhook-server` | `385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/infra-webhook:808216badc7177fac8a548f42f58b680263758d4` | `/webhook --zap-devel false` | service `webhook-server:443 -> 9443`, metric service `8080` | env names `AWS_DEFAULT_REGION`, `AWS_REGION`; Secret `webhook-server-cert` | registry `dedicated-cluster-service/app-registry/webhook-server.yaml`; env `dedicated-cluster-service/webhook-server/envs/staging-us-west-2` | `tidbcloud/infra-provider`, `infra-webhook/main.go` | `live` only for legacy cluster-service CR validation |

## Initial cp9 Service Graph Recommendation

For the first Dedicated full AWS path, use this graph as the implementation
starting point:

- `source`: `tidb-mgmt-portal`, `tidb-mgmt-service`,
  `dedicated-global-service`, `regional-server`.
- `live/deferred`: infra-provider CRDs/webhooks and EKS provider controller
  manifests should be carried forward as source-of-truth, but the current
  staging seed deployments are scaled to zero, so later issues must prove which
  controllers need to be active for cp9.
- `stub`: account, billing, o11y, dataflow/tcidm data-product APIs unless the
  current issue explicitly covers those dimensions.
- `optional live`: `tcidm` controllers/services only for the data-product
  dimension; not for the first Dedicated core-cluster proof.
- `avoid by default`: legacy `cluster-service` namespace workloads until a
  traced Dedicated API path proves they are still on the critical path.

## Evidence Commands

The inventory came from read-only Kubernetes and repository inspection:

- `kubectl --context staging-base-us-west-2 -n tidb-management-service get deploy,statefulset,svc -o json`
- `kubectl --context staging-seed-us-west-2 -n regional-server-system get deploy,svc -o json`
- `kubectl --context staging-seed-us-west-2 -n infra get deploy,svc -o json`
- `kubectl --context staging-seed-us-west-2 -n tcidm get deploy,svc -o json`
- `kubectl --context staging-seed-us-west-2 -n cluster-service get deploy,svc -o json`
- `rg`/`find` over `tidbcloud/app-delivery`, `tidbcloud/tidb-management-service`,
  `tidbcloud/infra-provider`, and `tidbcloud/tcidm`.