apiVersion: apps/v1
kind: Deployment
metadata:
  name: gateway-controller
  labels:
    control-plane: gateway-controller
spec:
  replicas: 1
  selector:
    matchLabels:
      control-plane: gateway-controller
  template:
    metadata:
      labels:
        control-plane: gateway-controller
    spec:
      serviceAccountName: gateway-controller
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: gateway-controller
          image: cp9.local/gateway-controller:placeholder
          command:
            - /gateway-controller
          args:
            - --leader-elect
            - --health-probe-bind-address=:8081
          env:
            - name: O11Y_GLOBAL_READ_URL
              value: http://starter-o11y-stub.tidb-admin.svc:9090
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 15
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /readyz
              port: 8081
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            limits:
              cpu: "1"
              memory: 2Gi
            requests:
              cpu: 100m
              memory: 256Mi
          volumeMounts:
            - name: gateway-controller-config
              mountPath: /etc/gateway-controller
              readOnly: true
      volumes:
        - name: gateway-controller-config
          configMap:
            name: gateway-controller-config
      terminationGracePeriodSeconds: 10
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: gateway-controller
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cp9-starter-gateway-controller
rules:
  - apiGroups: [""]
    resources: ["configmaps", "services", "events", "pods"]
    verbs: ["*"]
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["*"]
  - apiGroups: ["gateway.serverless.pingcap.com", "ingress.v1.haproxy.org", "autoscaling", "monitoring.coreos.com"]
    resources: ["*"]
    verbs: ["*"]
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cp9-starter-gateway-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cp9-starter-gateway-controller
subjects:
  - kind: ServiceAccount
    name: gateway-controller
    namespace: tidb-admin
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tidb-gateway
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cp9-starter-tidb-gateway
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["cloud.pingcap.com"]
    resources: ["*"]
    verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cp9-starter-tidb-gateway
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cp9-starter-tidb-gateway
subjects:
  - kind: ServiceAccount
    name: tidb-gateway
    namespace: tidb-admin
---
apiVersion: v1
kind: Secret
metadata:
  name: infra-api-kubeconfig
stringData:
  kubeconfig: |
    apiVersion: v1
    kind: Config
    clusters:
      - name: in-cluster
        cluster:
          server: https://kubernetes.default.svc
          certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    users:
      - name: service-account
        user:
          tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
    contexts:
      - name: in-cluster
        context:
          cluster: in-cluster
          user: service-account
    current-context: in-cluster
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: tidb-gateway-dynamic-config
data:
  config.yaml: |
    conn_limit:
      enable: false
      free_starter: 400
      paid_starter: 5000
      cluster_specific: {}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: gateway-controller-config
data:
  config.yaml: |
    namespace: tidb-admin
    env: staging
    cloudProvider: aws
    region: __CP9_TARGET_REGION__
    clusterName: __CP9_REMOTE_CLUSTER_NAME__
    imageRepo: __CP9_STARTER_TIDB_GATEWAY_IMAGE_REPOSITORY__
    pushTrafficMetricsAddr: http://starter-metering-stub.tidb-admin.svc:9091
    pushTrafficMetricsInterval: 30
    tidbServerVersion: 8.0.11-TiDB-v7.5.6-serverless
    infraRedisAddr: regional-redis.regional-infra
    infraRegion: ""
    dynamodbEndpoint: ""
    infraRegionRole: ""
    enableInfraMysqlClient: "true"
    infraRdsSecretArn: __CP9_STARTER_INFRA_RDS_SECRET_ARN__
    cacheServerAddr: http://meta-store.tidb-admin.svc:9088
    e2eEnv: false
    kubeletVersion: 1.31.7-20250627
    frontendReadTimeout: 28700
    tlsOnlySkipUserPrefixes:
      - 49rwYo5GD1uYirW
      - 2q2mMkMcePK79JX
    zoneAffinity: {}