apiVersion: apps/v1
kind: Deployment
metadata:
  name: cluster-control-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: cluster-control-server
  template:
    metadata:
      labels:
        app.kubernetes.io/name: cluster-control-server
    spec:
      serviceAccountName: dedicated-cluster-control-server
      containers:
        - name: server
          image: cp9.local/cluster-control-server:placeholder
          command:
            - /server
          args:
            - --region=us-west-2
            - --auth0-domain=tidb-dev.us.auth0.com
            - --auth0-audience=dev-proxy-service
            - --ns-prefix=staging-
            - --use-self-signed-cert-for-tidb-components=true
            # cp9's Dedicated component PCA runs in SHORT_LIVED_CERTIFICATE mode
            # (terraform/aws/cp9-substrate/session_product_pca.tf, 7-day CA),
            # which rejects the operator's default 10-year tidb-server/tidb-client
            # certs ("validity exceeds CA validity"), stalling every Dedicated
            # create. Enable the short-lived-component-cert feature so cluster-server
            # requests those PCA-issued certs short-lived (144h) — same AWSPCAIssuer,
            # so the CA a MySQL client verifies is unchanged.
            - --short-lived-component-cert=true
            - --provider=aws
            - -L=debug
          env:
            - name: PROXY_AUTH0_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: dedicated-proxy-auth0-client
                  key: Auth0ClientID
            - name: PROXY_AUTH0_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: dedicated-proxy-auth0-client
                  key: Auth0ClientSecret
          ports:
            - name: http
              containerPort: 8080