provider: eks
regionConfig:
  name: us-west-2
  zones:
    - us-west-2a
    - us-west-2b
    - us-west-2c
  # ZONAL dataplanes consume regionConfig.nodeZones (a single zone). The
  # regional auto-fill no longer runs for ZONAL after PR #3 pre-validation;
  # callers that want ZONAL must pass node_zones explicitly. This default keeps
  # the historical "single AZ for zonal" behavior available for any caller
  # that hits the still-supported UNSPECIFIED auto-fill path.
  nodeZones:
    - us-west-2a
env: cp9
appBoxConfig:
  serviceRoleName: tidbcloud-eks-service-role
  nodeConfig:
    capacityType: SPOT
    adminNodesAMIType: BOTTLEROCKET_x86_64
    systemVolumeSize: 20
  k8sVersion: "1.35"
  enableK8sPublicAccess: true
  apiserverPublicAccessCidrs:
    - "127.0.0.1/32"
  authorizedSubjects:
    - arn:aws:iam::000000000000:role/cp9-session-placeholder
  adminNodeRoleConfig:
    trustPolicyFile: /etc/configs/admin-node-role-trust-policy.json
    policyTemplateFile: /etc/configs/admin-node-role-policy-template.json
    awsLBControllerPolicyFile: /etc/configs/aws-lb-controller-policy.json
    managedPolicies:
      - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
      - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
      - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
      - arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy
      - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
  tiCDCNodeRoleConfig:
    policyTemplateFile: /etc/configs/ticdc-node-role-policy-template.json
    managedPolicies:
      - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
      - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
      - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
      - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
componentPCAARN: arn:aws:acm-pca:us-west-2:000000000000:certificate-authority/cp9-session-placeholder
clusterControllerAssumeRoleName: cp9-dedicated-full-cluster-controller-assumed-role
readonlyClusterControllerAssumeRoleName: readonly-cp9-dedicated-full-cluster-controller-assumed-role
dpControllerAssumeRoleName: cp9-dedicated-full-dp-controller-assumed-role
ticdcControllerAssumeRoleName: cp9-dedicated-full-ticdc-controller-assumed-role
predicate:
  matchExpressions:
    - key: cloud.pingcap.com/reconciler
      operator: NotIn
      values:
        - e2e-test
    # cp9 runs the Dedicated and Premium regional control planes in one k3d
    # (in real staging the premium regional CP is upbound-only and has no
    # eks.aws.crossplane.io CRD, so premium never reaches this controller).
    # Every Premium resource — DataPlane (manage=dataplane-manager) AND its
    # AppBox/management cluster (manage=full) — carries servicetype=premium and
    # is owned by the Premium Upbound dataplane-manager. The Dedicated
    # regional-server (aws.crossplane.io) must not reconcile ANY of them, or it
    # builds a duplicate Premium stack (EKS+VPC+subnets+IGW+IAM) on the wrong
    # provider. Exclude on servicetype so every premium layer stays on upbound.
    - key: tags.tidbcloud.com/servicetype
      operator: NotIn
      values:
        - premium
resourceLabels:
  cloud.pingcap.com/bizType: dedicated
  tags.tidbcloud.com/environment: cp9
  tags.tidbcloud.com/servicetype: dedicated
  tags.tidbcloud.com/usedby: dbaas-control-plane-seed
  cp9-managed: "true"
gcConfig:
  checkIdleInterval: 5m
  idleTimeThreshold: 24h
  idleTimeRetention: 1h
clusterControlServiceEndpoint: http://cluster-control-server:8080
ticdcServiceEndpoint: http://ticdc-service-server:8080
o11yRegionalServiceEndpoint: http://o11y-agent-control-server:8082
o11yAgentNamespace: cp9-dedicated
o11yBizType: __CP9_SESSION_NAME__
o11yRegionalServerTestConfig:
  enable: false
globalCrossplaneProviderConfig: provider-aws-gr
publicHostedZoneDomain: cp9.local.invalid
publicHostedZoneID: cp9-local
dataPlaneAccountNamespace: cp9-dedicated
featureGates:
  allocate_more_nats:
    all: true
  allocate_shared_bucket:
    all: false
  deploy_tidb_operator_v2:
    all: true
  update_legacy_node_role_policy:
    all: true
  o11y_new_agent_controller:
    all: true