apiVersion: apps/v1 kind: Deployment metadata: name: manager spec: strategy: type: Recreate template: spec: securityContext: fsGroup: 65532 runAsNonRoot: true serviceAccountName: cp9-starter-runtime priorityClassName: system-node-critical terminationGracePeriodSeconds: 10 containers: - name: manager command: - /manager args: - --enable-leader-election - --aws-account-id=__CP9_TARGET_ACCOUNT__ - --base-proxy=dbaas-proxy.tidb-admin.svc - --region=__CP9_TARGET_REGION__ - --cloud-provider-type=aws-free-tier - --kube-cluster-name=__CP9_REMOTE_CLUSTER_NAME__ - --keyspace-pool-ns=keyspace-pool - --encrypt-keyspace-pool-ns=encrypt-keyspace-pool - --tidb-pool-ns=tidb-pool,vip-tidb-pool,canary-tidb-pool,canary-vip-tidb-pool,export-tidb-pool,super-vip-tidb-pool,export-super-vip-tidb-pool,export-vip-tidb-pool,canary-super-vip-tidb-pool - --tidb-pool-gc-interval=30m,30m,30m,30m,30m,30m,30m,30m,30m - --tidb-version=v8.5.3,v8.5.3,v8.5.3,v8.5.3,v7.5.2,v7.5.2,v7.5.2,v7.5.2,v8.5.3 - --activate-tidb-image=385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/serverless/tidb:20260611-708aec11e3ceca7151e074acee2a4ea1b21d0331 - --serverless-lightning-image=385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/serverless/tidb:lightning-20260714-51af0abad085ce7d19510d0a9c03d3570bd804ac - --tidb-worker-ns=tidb-worker - --import-jobs-ns=import-jobs - --import-sa-name=serverless-import - --import-role-name=__CP9_RUNTIME_ROLE_NAME__ - --export-job-cm=export-job-template - --export-job-ns=export-job - --dumpling-image=385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/serverless/tidb:dumpling-20260714-51af0abad085ce7d19510d0a9c03d3570bd804ac - --export-stashing-area=s3://__CP9_SERVERLESS_STORAGE_BUCKET__/__CP9_SERVERLESS_STORAGE_PREFIX__/export - --export-debug-mode=false - --export-max-concurrent=10 - --export-use-configured-tidb-pool-replicas=false - --etcd-prefix=/tidbcloud/serverless/,/tidbcloud/vip-tidb-pool-serverless/,/tidbcloud/canary-tidb-pool-serverless/,/tidbcloud/canary-vip-tidb-pool-serverless/,/tidbcloud/export-tidb-pool-serverless/,/tidbcloud/super-vip-tidb-pool-serverless/,/tidbcloud/export-super-vip-tidb-pool-serverless/,/tidbcloud/export-vip-tidb-pool-serverless/,/tidbcloud/canary-super-vip-tidb-pool-serverless/ - --etcd-checkconn-prefix=/tidbcloud/checkconn/serverless/ - --etcd-endpoints=127.0.0.1:2379 - --infra-redis-addr=regional-redis.regional-infra:6380 - --infra-redis-client-cert-dir=/infra-redis-client-cert - --infra-cluster-table=__CP9_INFRA_CLUSTER_TABLE__ - --cluster-queue-url=__CP9_CLUSTER_QUEUE_URL__ - --import-enable-tls=true - --export-enable-tls=true - --keyspace-pool-enable-tls=true - --encrypt-keyspace-pool-enable-tls=true - --cluster-ca-path=/cluster-cert/ca.crt - --cluster-cert-path=/cluster-cert/tls.crt - --cluster-key-path=/cluster-cert/tls.key - --rds-secret-arn=__CP9_STARTER_RDS_SECRET_ARN__ - --rds-secret-region=__CP9_TARGET_REGION__ - --enable-infra-mysql-client=true - --enable-double-write=true - --cache-server-addr=http://meta-store.tidb-admin.svc:9088 - --infra-rds-secret-arn=__CP9_STARTER_INFRA_RDS_SECRET_ARN__ - --audit-log-kms-alias-arn=__CP9_STARTER_AUDIT_KMS_ALIAS_ARN__ - --audit-log-encrypt-key-ciphertext=__CP9_STARTER_AUDIT_KEY_CIPHERTEXT__ - --disable-audit-log=false - --disable-node-drainer=false - --disable-node-rebalance=false - --disable-node-recover=false - --disable-tidb-pod-evicter=false - --disable-tidb-reschedule=false - --disable-zr-evicter=true - --o11y-enable=false - --o11y-openapi-address=https://__CP9_PUBLIC_HOST__/o11y/control - --o11y-create-path=/api/v1/clusters - --o11y-delete-path=/api/v1/clusters - --o11y-get-path=/api/v1/clusters - --o11y-auth0-token-url=https://tidb-soc2.us.auth0.com/oauth/token - --o11y-auth0-audience=https://tidb-soc2.us.auth0.com/api/v2/ - --o11y-agent-access-arn=__CP9_RUNTIME_ROLE_ARN__ - --o11y-env=dev - --o11y-version=1 - --enable-version-updater=false env: - name: NAMESPACE value: tidb-admin - name: CONNECTION_IDLE_DELAY value: 3s - name: O11Y_AUTH0_CLIENT_ID valueFrom: secretKeyRef: name: o11y-auth0-client key: Auth0ClientID - name: O11Y_AUTH0_CLIENT_SECRET valueFrom: secretKeyRef: name: o11y-auth0-client key: Auth0ClientSecret - name: O11Y_GLOBAL_READ_URL value: http://starter-o11y-stub.tidb-admin.svc:9090 - name: AWS_REGION value: __CP9_TARGET_REGION__ - name: AWS_EC2_METADATA_DISABLED value: "true" securityContext: allowPrivilegeEscalation: false resources: limits: cpu: 2000m memory: 4Gi requests: cpu: 400m memory: 2Gi livenessProbe: httpGet: path: /healthz port: 8000 scheme: HTTPS initialDelaySeconds: 10 timeoutSeconds: 2 periodSeconds: 20 readinessProbe: httpGet: path: /readyz port: 8000 scheme: HTTPS initialDelaySeconds: 10 timeoutSeconds: 2 periodSeconds: 5 volumeMounts: - name: infra-api-kubeconfig mountPath: /infra readOnly: true - name: manager-server-cert mountPath: /certs readOnly: true - name: cluster-cert mountPath: /cluster-cert readOnly: true - name: regional-redis-tls mountPath: /infra-redis-client-cert readOnly: true - name: cp9-etcd image: registry.k8s.io/etcd:3.5.17-0 securityContext: allowPrivilegeEscalation: false runAsNonRoot: true runAsUser: 65532 command: - /usr/local/bin/etcd args: - --data-dir=/var/lib/cp9-etcd - --listen-client-urls=http://127.0.0.1:2379 - --advertise-client-urls=http://127.0.0.1:2379 ports: - name: etcd-client containerPort: 2379 volumeMounts: - name: cp9-etcd-data mountPath: /var/lib/cp9-etcd volumes: - name: infra-api-kubeconfig secret: secretName: infra-api-kubeconfig - name: manager-server-cert secret: secretName: manager-server-cert - name: cluster-cert secret: secretName: manager-cluster-client-secret - name: regional-redis-tls secret: secretName: regional-redis-tls - name: cp9-etcd-data persistentVolumeClaim: claimName: __CP9_SESSION_NAME__-manager-etcd-data topologySpreadConstraints: - labelSelector: matchLabels: app.kubernetes.io/name: manager maxSkew: 1 topologyKey: topology.kubernetes.io/zone whenUnsatisfiable: DoNotSchedule