schemaVersion: 1 kind: StarterRegionalSourceEvidence metadata: capturedAt: "2026-07-27T15:00:00+08:00" target: staging-us-east-1-f01 purpose: audit_evidence automation: none trackingIssue: null note: >- This is a frozen evidence snapshot. It does not implement refresh, render, drift detection, or cross-product staging synchronization. authorities: - repository: tidbcloud/aws-shared-provider branch: release-0.78 revision: e49dba3de19c3461a6dc01eba4cdce3475c8de37 owns: - manager deployment and config - TiDB gateway and gateway-controller deployment and config - TiDB HTTP gateway deployment and config - provider service source code evidencePaths: - cd/src/manager.ts - cd/src/tidb-gateway.ts - cd/src/tidb-http-gateway.ts - cd/projects/manager/Pulumi.staging.yaml - cd/projects/tidb-gateway/Pulumi.staging.yaml - cd/projects/tidb-http-gateway/Pulumi.staging.yaml - cd/manifests/tidb-worker/envs/staging-us-east-1-f01 - repository: tidbcloud/aws-shared-cd branch: release-0.62 revision: 57fa96f337548ce1b5c61834a33b38ef1c0ed4c0 owns: - regional AWS and EKS opening topology - PD, TiKV, keyspace ETCD, and shared TiDB pool contracts - regional Redis, audit RDS, and infra RDS contracts evidencePaths: - pool/eks-freetier/Pulumi.staging-us-east-1-f01.yaml - pool/eks-freetier/index.ts - pool/eks-freetier/serverless.ts - pool/eks-freetier/regional-infra.ts - repository: tidbcloud/app-delivery branch: main revision: d4a4cb968a34bda2ef25af9ca9ffe67702422344 owns: - Argo CD ApplicationSets selected below - their environment overlays, images, arguments, config, and resources targetRevisionInApplicationSets: HEAD caution: >- HEAD proves repository intent only. The live Argo Application status.sync.revision was not readable in this audit. appDeliveryApplications: - applicationSet: vpa-agent registryPath: app-registry/vpa-agent.yaml environmentPath: vpa-agent/envs/staging-us-east-1-f01 destinationNamespace: tidb-vpa primaryObjects: - apps/v1/DaemonSet/vpa-agent image: 385595570414.dkr.ecr.us-east-1.amazonaws.com/dbaas/aws-shared-provider-vpa-agent:b004fee264939848560f153a6ff89cc8332d07be starterDisposition: retained - applicationSet: tidb-worker registryPath: app-registry/tidb-worker.yaml environmentPath: tidb-worker/envs/staging-us-east-1-f01 destinationNamespace: tidb-worker primaryObjects: - apps/v1/Deployment/scaler - v1/ConfigMap/scaler-config - v1/Service/scaler-metrics - v1/Service/scaler-svc image: 385595570414.dkr.ecr.us-east-1.amazonaws.com/dbaas/aws-shared-provider-tidb-worker:release-0.78-73aaddeadc4754841ec373c2b01cc18f6161abf0 starterDisposition: retained - applicationSet: serverless-meta-service registryPath: app-registry/serverless-meta-service.yaml environmentPath: serverless-meta-service/envs/staging-us-east-1-f01 destinationNamespace: tidb-admin primaryObjects: - apps/v1/Deployment/serverless-meta-server - v1/Service/meta-service image: 385595570414.dkr.ecr.us-east-1.amazonaws.com/dbaas/staging/serverless-metering:c2397ccb0ce2320eeb80bd8a4c63fc99d49239e2 starterDisposition: retained - applicationSet: serverless-meta-store registryPath: app-registry/serverless-meta-store.yaml environmentPath: serverless-meta-store/envs/staging-us-east-1-f01 destinationNamespace: tidb-admin primaryObjects: - apps/v1/Deployment/meta-store - v1/Service/meta-store image: 385595570414.dkr.ecr.us-east-1.amazonaws.com/dbaas/aws-shared-provider-meta-server:e228f97d45e6f0b60470e33dc71ebda732f9d076 starterDisposition: retained - applicationSet: serverless-ops-service registryPath: app-registry/serverless-ops-service.yaml environmentPath: serverless-ops-service/envs/staging-us-east-1-f01 destinationNamespace: tidb-admin primaryObjects: - apps/v1/Deployment/ops-service - v1/Service/ops-service-svc image: 385595570414.dkr.ecr.us-east-1.amazonaws.com/dbaas/aws-shared-provider-ops-service:f97d83cb1a4989e62114293d8a292b6eb32da2db starterDisposition: retained - applicationSet: serverless-regional-service registryPath: app-registry/serverless-regional-service.yaml environmentPath: serverless-regional-service/envs/staging-aws-us-east-1 destinationNamespace: tidb-management-service primaryObjects: - apps/v1/Deployment/new-serverless-regional-service - v1/Service/new-serverless-regional-service image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/tidb-management-service:serverless-staging-32a858e696ce822fc8e2e6edd01cf34ed4c8952c starterDisposition: retained_with_session_namespace_equivalent - applicationSet: serverless-metering registryPath: app-registry/serverless-metering.yaml environmentPath: serverless-metering/envs/staging-us-east-1-f01 destinationNamespace: serverless-metering primaryObjects: - apps/v1/StatefulSet/serverless-metering-server - apps/v1/StatefulSet/serverless-metering-worker - apps/v1/StatefulSet/rcu-controller image: 385595570414.dkr.ecr.us-east-1.amazonaws.com/dbaas/staging/serverless-metering:c2397ccb0ce2320eeb80bd8a4c63fc99d49239e2 starterDisposition: excluded_replaced_by_contract_stub - applicationSet: o11y-agent-control-server-ng registryPath: staging/nextgen-regional-control-plane/app-registry/o11y-agent-control-server.yaml environmentPath: staging/nextgen-regional-control-plane/o11y-agent-control-server/envs/staging-aws-us-east-1-f01 destinationNamespace: observability primaryObjects: - apps/v1/Deployment/o11y-agent-control-server - apiextensions.k8s.io/v1/CustomResourceDefinition - v1/ConfigMap/templates-serverless-k8s - v1/ConfigMap/templates-serverless-sharedpool image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/agent-control-server:1586581ab2bbd9d131e6c812e355b6e9797863ce starterDisposition: retained_with_session_backend_and_direct_secret_delivery releaseContracts: gateway: sourcePath: cd/src/tidb-gateway.ts required: maxIdleSeconds: 30 enableInfraMysqlClient: true tidbServerVersion: 8.0.11-TiDB-v7.5.6-serverless kubeletVersion: 1.31.7-20250627 tlsOnlySkipUserPrefixes: - 49rwYo5GD1uYirW - 2q2mMkMcePK79JX paths: - infra RDS and DynamoDB - regional Redis TLS - SQL and backend cluster TLS - meta-store cache - metering writer - O11y reader httpGateway: sourcePaths: - cd/manifests/tidb-http-gateway/tidb-http-gateway.yaml - cd/src/tidb-http-gateway.ts requiredArgs: - --tls-cert=/http-gateway-tls/tls.crt - --tls-key=/http-gateway-tls/tls.key - --component-name=tidb-http-gateway - --log-level=DEBUG - session-owned secret equivalent deploymentImages: - component: manager status: not_pinned_in_checked_repository reason: cd/src/manager.ts requires the image from Pulumi stack configuration starterSourceBuildFallback: retained - component: tidb-gateway-inner status: not_pinned_in_checked_repository reason: cd/src/tidb-gateway.ts requires the image from Pulumi stack configuration starterSourceBuildFallback: retained - component: gateway-controller status: derived_from_tidb_gateway_stack_image reason: cd/src/tidb-gateway.ts replaces tidb-gateway in the configured repository name starterSourceBuildFallback: retained - component: tidb-http-gateway status: not_pinned_in_checked_repository reason: cd/src/tidb-http-gateway.ts reads the image from Pulumi stack configuration starterSourceBuildFallback: retained allowedDifferences: - real metering is replaced by the reviewed fail-closed contract stub - released O11y ACS, templates, and two Starter agent CRDs are retained; the backend is the session-owned shared metrics platform and logs remain not deployed - released O11y image tags are additionally pinned to the exact source-ECR digests observed on 2026-07-27 - O11y agent PVCs reuse the immutable-at-creation session-tagged ebs-sc - Kubernetes and EKS version selectors are ignored - session names, addresses, credentials, certificates, and cloud IDs are session-owned equivalents - microservice replicas and requests or limits may be reduced without changing binary, config, protocol, feature, or readiness paths - cert-manager, AWS PCA issuer, external-secrets, and kubed delivery is replaced by direct session certificate and Secret delivery - Starter uses the shared Dev Full premium-metadb deployment with separate serverless_rds and serverless_infra databases instead of regional RDS instances - Starter uses the regional AWS SDK endpoint directly where the release deployment uses its regional DynamoDB proxy endpoint - the ops-service Feishu notifier is disabled so Starter cannot emit messages into the staging communication surface - Starter adds fail-closed workload readiness probes where an ApplicationSet workload has no source probe liveVerification: status: read_only_partial attemptedAt: "2026-07-27" cluster: staging-us-east-1-f01 verified: - released ACS image and serverless root config - KubernetesAgent and SharedPoolAgent Normal status - VMAgent, Vector, and operator workloads notClaimed: - Argo ownership annotations or labels on live objects - managedFields manager identity - Argo Application status.sync.revision - full live drift from the deployment-code snapshots futureReadOnlyEvidence: - argocd.argoproj.io/tracking-id - app.kubernetes.io/instance - argocd.argoproj.io/instance - managedFields manager - Argo Application status.sync.revision