apiVersion: apps/v1
kind: Deployment
metadata:
  name: tidb-gateway-inner
  labels:
    control-plane: tidb-gateway-inner
spec:
  replicas: 1
  selector:
    matchLabels:
      control-plane: tidb-gateway-inner
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        control-plane: tidb-gateway-inner
        app.kubernetes.io/instance: serverless-cluster
        app.kubernetes.io/component: tidb-gateway
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
    spec:
      serviceAccountName: cp9-starter-runtime
      containers:
        - name: tidb-gateway-inner
          image: cp9.local/tidb-gateway-inner:placeholder
          command:
            - /tidb-gateway
          args:
            - --infra-kubeconfig=/infra/kubeconfig
            - --tls-ca=/gateway-tls/ca.crt
            - --tls-cert=/gateway-tls/tls.crt
            - --tls-key=/gateway-tls/tls.key
            - --gateway-mode=inner
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          ports:
            - name: mysql
              containerPort: 3306
            - name: probe
              containerPort: 8081
          securityContext:
            runAsNonRoot: true
          livenessProbe:
            httpGet:
              path: /healthz
              port: probe
            initialDelaySeconds: 12
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /readyz
              port: probe
            initialDelaySeconds: 12
            periodSeconds: 10
          resources:
            limits:
              cpu: 900m
              memory: 1900Mi
            requests:
              cpu: 300m
              memory: 500Mi
          volumeMounts:
            - name: gateway-tls
              mountPath: /gateway-tls
              readOnly: true
            - name: infra-api-kubeconfig
              mountPath: /infra
              readOnly: true
      volumes:
        - name: gateway-tls
          secret:
            secretName: gateway-cert-inner-secret
            defaultMode: 0440
        - name: infra-api-kubeconfig
          configMap:
            name: tidb-gateway-inner-infra-kubeconfig
---
apiVersion: v1
kind: Secret
metadata:
  name: probe-serverless-secret
type: Opaque
stringData:
  # The release deployment injects a secret stack output. Starter has no
  # shared probe tenant, so it preserves the environment contract with an
  # empty session-local fixture instead of borrowing staging credentials.
  probeDsn: ""