apiVersion: v1
kind: Pod
metadata:
  annotations:
    prometheus.io/path: /metrics
    prometheus.io/port: '10080'
    prometheus.io/scrape: 'true'
  labels:
    zr-evicter.tidbcloud.com/ignored: 'true'
spec:
  tolerations:
  - key: cp9.tidbcloud.com/starter-role
    operator: Equal
    value: tidb-serving
    effect: NoSchedule
  nodeSelector:
    cp9.tidbcloud.com/starter-role: tidb-serving
  restartPolicy: Never
  terminationGracePeriodSeconds: 190
  containers:
  - command:
    - /bin/sh
    - /usr/local/bin/tidb_start_script.sh
    env:
    - name: TZ
      value: UTC
    - name: BINLOG_ENABLED
      value: 'false'
    - name: SLOW_LOG_FILE
      value: /var/log/tidb/slowlog
    - name: POD_NAME
      valueFrom:
        fieldRef:
          apiVersion: v1
          fieldPath: metadata.name
    - name: POD_IP
      valueFrom:
        fieldRef:
          apiVersion: v1
          fieldPath: status.podIP
    - name: NAMESPACE
      valueFrom:
        fieldRef:
          apiVersion: v1
          fieldPath: metadata.namespace
    - name: NODE_IP
      valueFrom:
        fieldRef:
          fieldPath: status.hostIP
    - name: GATEWAY_SECURECONN_ATTR_KEY
      value: TiDB-Gateway-Secure-Connection
    - name: KEYSPACE_DEBUG_INFO
      value: '1'
    - name: CLUSTER_CERT
      value: /server-cert/tls.crt
    - name: CLUSTER_KEY
      value: /server-cert/tls.key
    - name: CLUSTER_CA
      value: /server-cert/ca.crt
    - name: SQL_CERT
      value: /sql-cert/tls.crt
    - name: SQL_KEY
      value: /sql-cert/tls.key
    - name: SQL_CA
      value: /sql-cert/ca.crt
    imagePullPolicy: IfNotPresent
    name: tidb
    ports:
    - containerPort: 4000
      name: server
      protocol: TCP
    - containerPort: 10080
      name: status
      protocol: TCP
    readinessProbe:
      httpGet:
        path: /status
        port: 10080
        scheme: HTTPS
      failureThreshold: 2
      periodSeconds: 6
      successThreshold: 1
      timeoutSeconds: 1
    livenessProbe:
      httpGet:
        path: /status
        port: 10080
        scheme: HTTPS
      failureThreshold: 6
      periodSeconds: 15
      successThreshold: 1
      timeoutSeconds: 3
      initialDelaySeconds: 30
    securityContext:
      privileged: false
    volumeMounts:
    - mountPath: /etc/podinfo
      name: annotations
      readOnly: true
    - mountPath: /etc/tidb
      name: config
      readOnly: true
    - mountPath: /usr/local/bin
      name: startup-script
      readOnly: true
    - mountPath: /var/log/tidb
      name: tidblog
    - mountPath: /var/lib/tidb-auth-token
      name: tidb-auth-token
      readOnly: true
    - mountPath: /var/lib/tidb-session-cert
      name: tidb-session-cert
      readOnly: true
    - name: server-cert
      mountPath: /server-cert
      readOnly: true
    - name: sql-cert
      mountPath: /sql-cert
      readOnly: true
  - command:
    - sh
    - -c
    - trap 'exit' TERM; touch /var/log/tidb/slowlog; tail -n0 -F /var/log/tidb/slowlog
      2>/dev/null & wait;
    image: gcr.io/pingcap-public/dbaas/busybox:1.31.1
    imagePullPolicy: IfNotPresent
    name: slowlog
    resources:
      limits:
        cpu: 100m
        memory: 50Mi
      requests:
        cpu: 20m
        memory: 5Mi
    volumeMounts:
    - mountPath: /var/log/tidb
      name: tidblog
  - command:
    - sh
    - -c
    - trap 'exit' TERM; touch /var/log/tidb/statementlog; tail -n0 -F /var/log/tidb/statementlog
      2>/dev/null & wait;
    image: gcr.io/pingcap-public/dbaas/busybox:1.31.1
    imagePullPolicy: IfNotPresent
    name: statementlog
    resources:
      limits:
        cpu: 100m
        memory: 50Mi
      requests:
        cpu: 20m
        memory: 5Mi
    volumeMounts:
    - mountPath: /var/log/tidb
      name: tidblog
  - command:
    - sh
    - -c
    - trap 'exit' TERM; touch /var/log/tidb/tidb-audit.log.json; tail -n0 -F /var/log/tidb/tidb-audit.log.json
      2>/dev/null & wait;
    image: gcr.io/pingcap-public/dbaas/busybox:1.31.1
    imagePullPolicy: IfNotPresent
    name: auditlog
    resources:
      limits:
        cpu: 100m
        memory: 50Mi
      requests:
        cpu: 20m
        memory: 5Mi
    volumeMounts:
    - mountPath: /var/log/tidb
      name: tidblog
  dnsPolicy: ClusterFirst
  initContainers:
  - command:
    - sh
    - -c
    - sysctl -w net.core.somaxconn=32768 net.ipv4.tcp_keepalive_intvl=75 net.ipv4.tcp_keepalive_time=300
    image: gcr.io/pingcap-public/dbaas/busybox:1.31.1
    imagePullPolicy: IfNotPresent
    name: init
    securityContext:
      privileged: true
  securityContext:
    fsGroup: 2000
    runAsGroup: 2000
    runAsUser: 1000
  serviceAccountName: access-s3-sa
  volumes:
  - downwardAPI:
      defaultMode: 420
      items:
      - fieldRef:
          apiVersion: v1
          fieldPath: metadata.annotations
        path: annotations
    name: annotations
  - configMap:
      defaultMode: 420
      items:
      - key: config-file
        path: tidb.toml
      - key: sem-config
        path: sem-config.json
      name: serverless-tidb-config
    name: config
  - configMap:
      defaultMode: 420
      items:
      - key: startup-script
        path: tidb_start_script.sh
      name: serverless-tidb-config
    name: startup-script
  - emptyDir: {}
    name: tidblog
  - name: tidb-auth-token
    secret:
      defaultMode: 420
      secretName: db-tidb-auth-token-jwks-secret
  - name: tidb-session-cert
    secret:
      secretName: tidb-session-certificate-secret
      defaultMode: 288
  - name: server-cert
    secret:
      secretName: tidb-cluster-secret
      defaultMode: 440
  - name: sql-cert
    secret:
      secretName: sql-cluster-secret
      defaultMode: 440
  imagePullSecrets:
  - name: cp9-ecr-pull-385595570414