apiVersion: v1
kind: ConfigMap
metadata:
  name: cluster-controller-root-config
data:
  root-config.yaml: |
    provider: eks
    controlplaneAWSProviderConfig: provider-aws-gr
    amiConfig:
      supportedVersions:
        - "1.29"
        - "1.30"
        - "1.31"
        - "1.32"
        - "1.33"
        - "1.34"
        - "1.35"
    clusterController:
      tikvPreStopImage: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/tidb-operator-prestop-checker:v2.0.0-beta.9
      aws:
        enableBatchOpsExport: false
        nodeRolePolicyFile: /etc/cluster-controller/extra/node-policy-config.json
        nodeUserdataSystemConfigurationFile: /etc/cluster-controller/extra/node-userdata-system-configuration.toml
        nodeRoleManagedPolicies:
          - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
          - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
          - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
          - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      configChange:
        accountEnv: cp9
        activity:
          enabled: false
      clusterAgent:
        chartPath: /etc/helm/cluster-agent
        agentImage:
          repo: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/cluster-agent
          tag: 197182692dbeeb74be9416573760215dd39d1545
        pdPatrolImage:
          tag: master-c53f203
      mysqlProtocolProbe:
        image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/mysql-readiness-probe:latest
        binaryName: mysql-readiness-probe
        timeoutSeconds: 2
        periodSeconds: 10
        failureThreshold: 900
      audit:
        sidecarImage: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/audit:81dc098e2ad54c6918e7c5aac80b052f532bc39f
        sidecarCommand:
          - /audit
          - server
          - --config
          - /etc/audit/audit.yaml
        defaultTag: v1.0.3
    network:
      k8sVersion: "1.35"
      ignoreDelete:
        - Bucket
      proxy:
        auth0Audience: dev-proxy-service
        auth0Domain: tidb-dev.us.auth0.com
        enableDevMode: true
      region: us-west-2
      zones:
        - us-west-2a
        - us-west-2b
        - us-west-2c
      o11yConfig:
        env: cp9
        infraTenantID: infra-cp9
        openAPIAddress: http://o11y-agent-control-server:8082
    override:
      overrideHelperImage: 385595570414.dkr.ecr.us-west-2.amazonaws.com/third-party/busybox:1.34.1
      overrideRegistry: 385595570414.dkr.ecr.us-west-2.amazonaws.com
      overrideRepoPrefix: tidbcloud
      overrideThirdPartyRepoPrefix: third-party
    featureGates:
      set_priority_class:
        all: true
      use_tidb_operator_v2:
        all: false
    configServiceEndpoint: http://config-center.cp9-global.svc.cluster.local:8080
    regionalServerServiceEndpoint: regional-server:8080
    importConfig:
      instanceType: c5.9xlarge
    storageClassConfigFile: /etc/cluster-controller/extra/storageclass-config.yaml
    instanceTypeConfigFile: /etc/cluster-controller/extra/instancetype-config.yaml
    predicate:
      matchLabels:
        cloud.pingcap.com/provider-type: eks
        cloud.pingcap.com/region: us-west-2
      matchExpressions:
        - key: cloud.pingcap.com/reconciler
          operator: DoesNotExist
    fullManage:
      project: cp9
      publicHostedZoneDomain: cp9.local.invalid
      publicHostedZoneID: cp9-local
      serviceRoleARN: arn:aws:iam::000000000000:role/cp9-local-eks-service
      serviceRoleName: tidbcloud-eks-service-role
      assumeRoleName: cp9-dedicated-full-cluster-controller-assumed-role
      awsClusterServerRoleARN: arn:aws:iam::000000000000:role/cp9-developer
      assumeRoleExternalID: "123"
      readonlyAssumeRoleName: readonly-cp9-dedicated-full-cluster-controller-assumed-role
      componentPCAARN: arn:aws:acm-pca:us-west-2:000000000000:certificate-authority/cp9-session-placeholder
    maxConcurrentReconciles:
      cluster: 10
      import: 10
      dm: 10
    dmConfig:
      masterInstance:
        repo: gcr.io/pingcap-public/dbaas/dm
        tag: v8.5.0-alpha
        specCode: master-share-2c2g
      workerInstance:
        repo: gcr.io/pingcap-public/dbaas/dm
        tag: v8.5.0-alpha
        specCode: exclusive-2c2g
    hibernation:
      enabled: false
    ticdcServiceEndpoint: http://ticdc-service-server:8080
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: cluster-controller-extra-config
data:
  node-policy-config.json: |
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "ec2:AttachVolume",
            "ec2:DetachVolume",
            "ec2:ModifyVolume",
            "ec2:CreateVolume",
            "ec2:DeleteVolume",
            "ec2:DescribeAvailabilityZones",
            "ec2:DescribeInstances",
            "ec2:DescribeTags",
            "ec2:DescribeVolumes",
            "ec2:DescribeVolumesModifications",
            "ec2:DescribeSnapshots",
            "ec2:CreateTags"
          ],
          "Resource": "*"
        }
      ]
    }
  node-userdata-system-configuration.toml: |
    [settings.oci-defaults.resource-limits.max-open-files]
    "hard-limit" = 1048576
    "soft-limit" = 1048576

    [settings.kernel]
    lockdown = "none"
  storageclass-config.yaml: |
    apiVersion: storage.k8s.io/v1
    kind: StorageClass
    metadata:
      name: index-acceleration
    mountOptions:
      - nodelalloc,noatime
    parameters:
      csi.storage.k8s.io/fstype: ext4
      iops: "3000"
      throughput: "125"
      type: gp3
      encrypted: "true"
      tagSpecification: Vendor=PingCAP
    provisioner: ebs.csi.aws.com
    allowVolumeExpansion: true
    reclaimPolicy: Delete
    volumeBindingMode: WaitForFirstConsumer
    ---
    apiVersion: storage.k8s.io/v1
    kind: StorageClass
    metadata:
      name: auditlog
    parameters:
      csi.storage.k8s.io/fstype: ext4
      iops: "3000"
      throughput: "125"
      type: gp3
      encrypted: "true"
      tagSpecification: Vendor=PingCAP
    provisioner: ebs.csi.aws.com
    allowVolumeExpansion: true
    reclaimPolicy: Delete
    volumeBindingMode: WaitForFirstConsumer