apiVersion: v1
kind: Service
metadata:
  name: tidb-gateway-new
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags: __CP9_LB_TAGS__
    service.beta.kubernetes.io/aws-load-balancer-name: __CP9_SQL_GATEWAY_LB_NAME__
    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
    service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
    service.beta.kubernetes.io/aws-load-balancer-type: external
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tidb-gateway-inner
spec:
  template:
    spec:
      serviceAccountName: cp9-starter-runtime
      containers:
        - name: tidb-gateway-inner
          args:
            - --infra-kubeconfig=/infra/kubeconfig
            - --tls-ca=/gateway-tls/ca.crt
            - --tls-cert=/gateway-tls/tls.crt
            - --tls-key=/gateway-tls/tls.key
            - --gateway-mode=inner
            - --region=__CP9_TARGET_REGION__
            - --infra-redis-addr=regional-redis.regional-infra:6380
            - --infra-cluster-table=__CP9_INFRA_CLUSTER_TABLE__
            - --cloud-provider-type=aws-free-tier
            - --kube-cluster-name=__CP9_REMOTE_CLUSTER_NAME__
            - --max-idle-seconds=30
            - --enable-infra-mysql-client=true
            - --infra-rds-secret-arn=__CP9_STARTER_INFRA_RDS_SECRET_ARN__
            - --cache-server-addr=http://meta-store.tidb-admin.svc:9088
            - --sql-tls-ca=/sql-cert/ca.crt
            - --sql-tls-cert=/sql-cert/tls.crt
            - --sql-tls-key=/sql-cert/tls.key
            - --cluster-tls-ca=/cluster-cert/ca.crt
            - --cluster-tls-cert=/cluster-cert/tls.crt
            - --cluster-tls-key=/cluster-cert/tls.key
            - --require-backend-tls=true
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: PROBE_SERVERLESS_DSN_SECRET
              valueFrom:
                secretKeyRef:
                  name: probe-serverless-secret
                  key: probeDsn
            - name: AWS_REGION
              value: __CP9_TARGET_REGION__
            - name: AWS_EC2_METADATA_DISABLED
              value: "true"
          volumeMounts:
            - name: infra-api-kubeconfig
              mountPath: /infra
              readOnly: true
            - name: regional-redis-tls
              mountPath: /infra-redis-client-cert
              readOnly: true
            - name: sql-tls
              mountPath: /sql-cert
              readOnly: true
            - name: cluster-tls
              mountPath: /cluster-cert
              readOnly: true
            - name: dynamic-config
              mountPath: /etc/gateway
              readOnly: true
      volumes:
        - name: infra-api-kubeconfig
          configMap:
            name: tidb-gateway-inner-infra-kubeconfig
        - name: regional-redis-tls
          secret:
            secretName: regional-redis-tls
        - name: sql-tls
          secret:
            secretName: tidb-gateway-cluster-secret
        - name: cluster-tls
          secret:
            secretName: tidb-gateway-cluster-secret
        - name: dynamic-config
          configMap:
            name: tidb-gateway-dynamic-config