repositorySets:
  commonRepositories:
    ## =============================================================================== tidbcloud images
    - source: gcr.io/pingcap-public/dbaas/gotty
      name: tidbcloud/gotty
      tags:
        allow:
          - "20211103"

    - source: gcr.io/pingcap-public/third-party/aws-pca-issuer
      name: tidbcloud/aws-pca-issuer
      tags:
        allow:
          - "latest"

    # - source: public.ecr.aws/k1n1h4h4/cert-manager-aws-privateca-issuer
    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/third-party/k1n1h4h4/cert-manager-aws-privateca-issuer
      name: third-party/k1n1h4h4/cert-manager-aws-privateca-issuer
      tags:
        allow:
          - "v1.6.0"
          - "v1.7.0"

    - source: gcr.io/pingcap-public/third-party/tnir/mysqlclient
      name: tidbcloud/mysqlclient
      tags:
        allow:
          - "20201014"

    - source: gcr.io/pingcap-public/audit
      name: tidbcloud/audit
      tags:
        allow:
          - "33184a9560803164b7707098ed9952277c06aee9"
          - "81dc098e2ad54c6918e7c5aac80b052f532bc39f"

    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/audit
      name: tidbcloud/audit

    - source: gcr.io/pingcap-public/dbaas/advanced-statefulset
      name: tidbcloud/advanced-statefulset
      deny:
        - ".*_linux_amd64$" # single arch image
        - ".*_linux_arm64$" # single arch image

    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/dbaas/dev/sli-reporter
      name: tidbcloud/sli-reporter

    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/dbaas/dev/cluster-proxy
      name: tidbcloud/cluster-proxy

    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/service-proxy
      name: tidbcloud/service-proxy

    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/cluster-agent
      name: tidbcloud/cluster-agent

    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/cluster-agent-ng
      name: tidbcloud/cluster-agent-ng

    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/dataflow-agent
      name: tidbcloud/dataflow-agent

    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/eks-provider
      name: tidbcloud/eks-provider
      tags:
        allow:
          - "f8b4413ee75e34997c65ac23c62b1c7d826ba066"
          - "0e96c56607613f0a5419e1b1c09b9184103ce945"
          - "0ec24729d711ed8e2c4e91dd5dfa44fb8afcd797"
          - "3c4265c774a6989b8da42ff58e8d878ded950ae1"

    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/cluster-control-server
      name: tidbcloud/cluster-control-server
      tags:
        allow:
          - "f8b4413ee75e34997c65ac23c62b1c7d826ba066"
          - "0e96c56607613f0a5419e1b1c09b9184103ce945"
          - "0ec24729d711ed8e2c4e91dd5dfa44fb8afcd797"
          - "3c4265c774a6989b8da42ff58e8d878ded950ae1"

    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/dataflow-agent-ng
      name: tidbcloud/dataflow-agent-ng

    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/network-policy-controller
      name: tidbcloud/network-policy-controller

    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/e2e/end-user-proxy
      name: tidbcloud/e2e/end-user-proxy

    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/mysql-readiness-probe
      name: tidbcloud/mysql-readiness-probe

    - source: 646528577659.dkr.ecr.us-east-2.amazonaws.com/tiflash-autoscale-supervisor
      name: tidbcloud/tiflash-autoscale-supervisor

    - source: 646528577659.dkr.ecr.us-east-2.amazonaws.com/tiflash-autoscaler
      name: tidbcloud/tiflash-autoscaler

    - source: 385595570414.dkr.ecr.us-east-1.amazonaws.com/dbaas/nightly/cluster-autoscaler
      name: dbaas/nightly/cluster-autoscaler

    - source: gcr.io/pingcap-public/dbaas/pd
      name: tidbcloud/pd
      tags:
        allow:
          - master
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v\\d+\\.\\d+\\.\\d+-\\d{8}-[a-zA-Z0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-pre$"
          - "^v\\d+\\.\\d+\\.\\d+-(beta|rc)\\.\\d+(\\.pre)?$"
          - "master-c53f203" # Used to fetch pd-patrol-ctl for OPS
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/tikv
      name: tidbcloud/tikv
      tags:
        allow:
          - master
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v\\d+\\.\\d+\\.\\d+-\\d{8}-[a-zA-Z0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-pre$"
          - "^v\\d+\\.\\d+\\.\\d+-(beta|rc)\\.\\d+(\\.pre)?$"
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/tidb
      name: tidbcloud/tidb
      tags:
        allow:
          - ^master-enterprise$
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v\\d+\\.\\d+\\.\\d+-\\d{8}-[a-zA-Z0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-pre$"
          - "^v\\d+\\.\\d+\\.\\d+-(beta|rc)\\.\\d+(\\.pre)?$"
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/tiflash
      name: tidbcloud/tiflash
      tags:
        allow:
          - master
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v\\d+\\.\\d+\\.\\d+-\\d{8}-[a-zA-Z0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-pre$"
          - "^v\\d+\\.\\d+\\.\\d+-(beta|rc)\\.\\d+(\\.pre)?$"
          - "v8.5.4-9876-dev"
          - "v8.5.4-10000-dev"
          - "v8.5.4-10006-dev"
          - "v8.5.4-10053-dev"
          - "v8.5.4-10249-dev"

    - source: gcr.io/pingcap-public/dbaas/tiproxy
      name: tidbcloud/tiproxy
      tags:
        allow:
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^v\\d+\\.\\d+\\.\\d+-\\d{8}-[a-zA-Z0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-pre$"
          - "^v\\d+\\.\\d+\\.\\d+-(beta|rc)\\.\\d+(\\.pre)?$"
          - "main"
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/tiproxy-replayer
      name: tidbcloud/tiproxy-replayer

    - source: gcr.io/pingcap-public/dbaas/tidb-lightning
      name: tidbcloud/tidb-lightning
      tags:
        allow:
          - ^master-enterprise$
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v\\d+\\.\\d+\\.\\d+-\\d{8}-[a-zA-Z0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-pre$"
          - "^v\\d+\\.\\d+\\.\\d+-(beta|rc)\\.\\d+(\\.pre)?$"
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/ticdc
      name: tidbcloud/ticdc
      tags:
        allow:
          - master
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-enterprise$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-[0-9]{8}-[a-f0-9]+$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-pre$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-release[.][0-9]+$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-release[.][0-9]+-[0-9]{8,10}-[a-f0-9]+$" # classic hotfix tags
          - "^v[0-9]+[.][0-9]+[.][0-9]+-(beta|rc)[.][0-9]+([.]pre)?$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-(beta|rc)[.][0-9]+(([.]pre)?(-.+)?)?$"
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/br
      name: tidbcloud/br
      tags:
        allow:
          - ^master-enterprise$
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v\\d+\\.\\d+\\.\\d+-\\d{8}-[a-zA-Z0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-pre$"
          - "^v\\d+\\.\\d+\\.\\d+-(beta|rc)\\.\\d+(\\.pre)?$"
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/tidb-monitor-initializer
      name: tidbcloud/tidb-monitor-initializer
      tags:
        allow:
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v\\d+\\.\\d+\\.\\d+-\\d{8}-[a-zA-Z0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-pre$"
          - "^v\\d+\\.\\d+\\.\\d+-(beta|rc)\\.\\d+(\\.pre)?$"
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/tidb-operator
      name: tidbcloud/tidb-operator
      tags:
        allow:
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)(-.+)?$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-pre$"
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/tidb-operator-prestop-checker
      name: tidbcloud/tidb-operator-prestop-checker

    - source: gcr.io/pingcap-public/dbaas/tidb-operator-prestop-hook
      name: tidbcloud/tidb-operator-prestop-hook

    - source: gcr.io/pingcap-public/dbaas/tidb-backup-manager
      name: tidbcloud/tidb-backup-manager
      tags:
        allow:
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)(-.+)?$"
          - "^master-[0-9a-f]+$"
          - "^master$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-pre$"
          - "^v\\d+\\.\\d+\\.\\d+-(beta|rc)\\.\\d+(\\.pre)?$"
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/tidb-monitor-reloader
      name: tidbcloud/tidb-monitor-reloader

    - source: gcr.io/pingcap-public/tidbcloud/tiflow
      name: tidbcloud/tiflow
      tags:
        allow:
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v\\d+\\.\\d+\\.\\d+-\\d{8}-[a-zA-Z0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-pre$"
          - "^v\\d+\\.\\d+\\.\\d+-(beta|rc)\\.\\d+(\\.pre)?$"
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/tidbcloud/tiflow-operator
      name: tidbcloud/tiflow-operator
      tags:
        allow:
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)(-.+)?$"
          - "^master-[0-9a-f]+$"
          - "^master$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-pre$"
          - "^v\\d+\\.\\d+\\.\\d+-(beta|rc)\\.\\d+(\\.pre)?$"
        deny:
          - ".*-dev$"

    - source: ghcr.io/chaos-mesh/chaos-mesh
      name: tidbcloud/chaos-mesh

    - source: ghcr.io/chaos-mesh/chaos-daemon
      name: tidbcloud/chaos-daemon

    ## =============================================================================== thrid-party images
    - source: docker.io/busybox
      name: third-party/busybox
      tags:
        allow:
          - "1.31.1"
          - "1.34.1"

    - source: docker.io/fatedier/frps
      name: third-party/fatedier/frps
      tags:
        allow:
          - "0.39.1"
          - "v0.44.0"

    - source: docker.io/fatedier/frpc
      name: third-party/fatedier/frpc
      tags:
        allow:
          - "v0.39.1"

    - source: docker.io/rancher/local-path-provisioner
      name: third-party/rancher/local-path-provisioner
      tags:
        allow:
          - "v0.0.32"

    - source: docker.io/prom/node-exporter
      name: third-party/prom/node-exporter
      tags:
        allow:
          - "v1.6.1"
          - "v1.3.1"

    - source: docker.io/bloomberg/goldpinger
      name: third-party/bloomberg/goldpinger
      tags:
        allow:
          - "3.10.3"

    - source: ghcr.io/tennix/node-pinger
      name: third-party/tennix/node-pinger
      tags:
        allow:
          - "v0.1.1"
          - "v0.1.2"

    - source: quay.io/prometheus/node-exporter
      name: third-party/prometheus/node-exporter
      tags:
        allow:
          - "v1.9.1"
          - "v1.11.1"

    - source: docker.io/prom/prometheus
      name: third-party/prom/prometheus
      tags:
        allow:
          - "v2.38.0"
          - "v2.11.1"
          - "v2.40.7"

    - source: docker.io/prom/pushgateway
      name: third-party/prom/pushgateway
      tags:
        allow:
          - "v1.4.3"

    - source: docker.io/grafana/grafana
      name: third-party/grafana/grafana
      tags:
        allow:
          - "6.0.1"

    - source: quay.io/jetstack/cert-manager-controller
      name: third-party/jetstack/cert-manager-controller
      tags:
        allow:
          - "v1.6.1"
          - "v1.9.1"
          - "v1.10.0"
          - "v1.18.2"

    - source: quay.io/jetstack/cert-manager-webhook
      name: third-party/jetstack/cert-manager-webhook
      tags:
        allow:
          - "v1.6.1"
          - "v1.9.1"
          - "v1.10.0"
          - "v1.18.2"

    - source: quay.io/jetstack/cert-manager-cainjector
      name: third-party/jetstack/cert-manager-cainjector
      tags:
        allow:
          - "v1.6.1"
          - "v1.9.1"
          - "v1.10.0"
          - "v1.18.2"

    - source: registry.k8s.io/dns/k8s-dns-node-cache
      name: third-party/dns/k8s-dns-node-cache
      tags:
        allow:
          - "1.23.1"
          - "1.26.5"

    - source: registry.k8s.io/external-dns/external-dns
      name: third-party/external-dns/external-dns
      tags:
        allow:
          - "v0.20.0"

    - source: registry.k8s.io/sig-storage/csi-attacher
      name: third-party/sig-storage/csi-attacher
      tags:
        allow:
          - "v3.1.0"

    - source: registry.k8s.io/sig-storage/csi-snapshotter
      name: third-party/sig-storage/csi-snapshotter
      tags:
        allow:
          - "v3.0.3"

    - source: registry.k8s.io/metrics-server/metrics-server
      name: third-party/metrics-server/metrics-server
      tags:
        allow:
          - "v0.8.0"

    - source: registry.k8s.io/kube-state-metrics/kube-state-metrics
      name: third-party/kube-state-metrics/kube-state-metrics
      tags:
        allow:
          - "v2.3.0"
          - "v2.10.0"
          - "v2.16.0"

    - source: registry.k8s.io/sig-storage/livenessprobe
      name: third-party/sig-storage/livenessprobe
      tags:
        allow:
          - "v2.4.0"

    - source: registry.k8s.io/sig-storage/csi-node-driver-registrar
      name: third-party/sig-storage/csi-node-driver-registrar
      tags:
        allow:
          - "v2.3.0"

    - source: registry.k8s.io/sig-storage/csi-provisioner
      name: third-party/sig-storage/csi-provisioner
      tags:
        allow:
          - "v2.2.2"

    - source: registry.k8s.io/sig-storage/csi-resizer
      name: third-party/sig-storage/csi-resizer
      tags:
        allow:
          - "v1.1.0"

    - source: registry.k8s.io/autoscaling/cluster-autoscaler
      name: third-party/autoscaling/cluster-autoscaler
      tags:
        allow:
          - "v1.21.1"
          - "v1.25.0"
          - "v1.27.0"
          - "v1.33.0"

    # - source: public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver
    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/third-party/ebs-csi-driver/aws-ebs-csi-driver
      name: third-party/ebs-csi-driver/aws-ebs-csi-driver
      tags:
        allow:
          - "v1.6.1"
          - "v1.26.0"

    - source: 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller
      name: third-party/amazon/aws-load-balancer-controller
      tags:
        allow:
          - "v2.4.2"
          - "v2.6.2"
          - "v2.11.0"
          - "v2.13.4"

    - source: amazon/amazon-eks-pod-identity-webhook
      name: third-party/amazon/amazon-eks-pod-identity-webhook
      tags:
        allow:
          - "v0.4.0"

    - source: docker.io/openkruise/kruise-manager
      name: third-party/openkruise/kruise-manager
      tags:
        allow:
          - "v1.3.0"

    - source: docker.io/calico/kube-controllers
      name: third-party/calico/kube-controllers
      tags:
        allow:
          - "v3.25.1"
    - source: docker.io/calico/node
      name: third-party/calico/node
      tags:
        allow:
          - "v3.25.1"
    - source: docker.io/calico/pod2daemon-flexvol
      name: third-party/calico/pod2daemon-flexvol
      tags:
        allow:
          - "v3.25.1"
    - source: docker.io/calico/typha
      name: third-party/calico/typha
      tags:
        allow:
          - "v3.25.1"
    - source: docker.io/calico/csi
      name: third-party/calico/csi
      tags:
        allow:
          - "v3.25.1"
    - source: docker.io/calico/node-driver-registrar
      name: third-party/calico/node-driver-registrar
      tags:
        allow:
          - "v3.25.1"
    - source: docker.io/calico/apiserver
      name: third-party/calico/apiserver
      tags:
        allow:
          - "v3.25.1"
    - source: quay.io/tigera/operator
      name: third-party/tigera/operator
      tags:
        allow:
          - "v1.29.3"

    - source: registry.k8s.io/pause
      name: third-party/pause
      tags:
        allow:
          - "3.9"

    - source: docker.io/istio/install-cni
      name: third-party/istio/install-cni
      tags:
        allow:
          - "1.20.0"
          - "1.20.8"

    - source: docker.io/istio/operator
      name: third-party/istio/operator
      tags:
        allow:
          - "1.20.0"
          - "1.20.8"

    - source: docker.io/istio/pilot
      name: third-party/istio/pilot
      tags:
        allow:
          - "1.20.0"
          - "1.20.8"

    - source: docker.io/istio/proxyv2
      name: third-party/istio/proxyv2
      tags:
        allow:
          - "1.20.0"
          - "1.20.8"

    ## =============================================================================== o11y team images
    - source: gcr.io/pingcap-public/dbaas/vector
      name: tidbcloud/vector
      tags:
        allow:
          - "0.37.1-2d79df-debian"
          - "0.37.1-nextgen-505e5a-debian"

    - source: slggamer/vectorextension049
      name: tidbcloud/vector
      tags:
        allow:
          - "0.49-1124-ng-conprof-debian"

    - source: slggamer/vector
      name: tidbcloud/vector
      tags:
        allow:
          - "0.49-0331-feec02b"
          - "0.49-0331-feec02b-ng"
          - "0.49-0605-6865bfc"
          - "0.49-0605-6865bfc-ng"
          - "0.49-0720-4c68515"
          - "0.49-0720-4c68515-ng"
          - "0.49-0820-c465793"
          - "0.49-0820-c465793-ng"

    - source: nolouch/vector
      name: tidbcloud/vector
      tags:
        allow:
          - "0.49-copr-1120-4-st-ng-debian"

    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/vmagent
      name: tidbcloud/vmagent
      tags:
        allow:
          - "v1.122.2-cluster"

    - source: gcr.io/pingcap-public/elastic/filebeat-oss-tidb-module
      name: third-party/elastic/filebeat-oss-tidb-module
      tags:
        allow:
          - "7.12.2"

    - source: docker.io/victoriametrics/vmagent
      name: third-party/victoriametrics/vmagent
      tags:
        allow:
          - "v1.78.0"
          - "v1.79.13"
          - "v1.87.6"
          - "v1.87.7"
          - "v1.97.1"

    - source: quay.io/prometheus-operator/prometheus-config-reloader
      name: third-party/prometheus-operator/prometheus-config-reloader
      tags:
        allow:
          - "v0.84.1"

    - source: docker.io/victoriametrics/operator
      name: third-party/victoriametrics/operator
      tags:
        allow:
          - "v0.29.2"
          - "v0.34.1"
          - "v0.62.0"

    - source: docker.io/kaasops/vector-operator
      name: third-party/kaasops/vector-operator
      tags:
        allow:
          - "v0.3.0"

    - source: docker.io/timberio/vector
      name: third-party/timberio/vector
      tags:
        allow:
          - "0.22.X-debian"

    - source: gcr.io/pingcap-public/third-party/timberio/vector
      name: third-party/timberio/vector
      tags:
        allow:
          - "0.23.X-1-debian"

    - source: gcr.io/pingcap-public/fluent-bit-plugin-loki
      name: third-party/grafana/fluent-bit-plugin-loki
      tags:
        allow:
          - "main-8c1095a55-1.8.15-final-multi-arch"

    - source: ghcr.io/resmoio/kubernetes-event-exporter
      name: third-party/resmoio/kubernetes-event-exporter
      tags:
        allow:
          - "v1.0"
          - "v1.7"

    - name: third-party/crossplanecontrib/provider-aws
      source: docker.io/crossplanecontrib/provider-aws
      tags:
        allow:
          - "v0.36.0"
          - "v0.38.0"
          - "v0.39.0"
          - "v0.40.0"
          - "v0.47.0" # deprecate
          - "v0.45.0"
          - "v0.45.2"

    - source: docker.io/kong/kubernetes-ingress-controller
      name: third-party/kong/kubernetes-ingress-controller
      tags:
        allow:
          - "3.1"

    - source: docker.io/library/kong
      name: third-party/kong/kong
      tags:
        allow:
          - "3.6"
          - "3.9.3"

    - name: tidbcloud/infra-webhook
      source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/infra-webhook

    - name: tidbcloud/infra-exporter
      source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/infra-exporter

    - name: tidbcloud/tidb-operator-v2
      source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/tidb-operator-v2

    - name: tidbcloud/ng-autoscaler
      source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/ng-autoscaler

    - name: tidbcloud/audit-ng
      source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/audit-ng

    - name: tidbcloud/tidb-fivetran-deployer
      source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/tidb-fivetran-deployer

    - name: dbaas/aws-shared-provider-datacleaner
      source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/dbaas/aws-shared-provider-datacleaner
      tags:
        allow:
          - "6c829a363e2a1d395985b1fac66022ff9d217c28"

  autoDeployRepositories:
    ## =============================================================================== auto deploy job images
    - source: us-docker.pkg.dev/pingcap-dbaas-build/auto-deploy/deploy-job-runner
      name: auto-deploy/deploy-job-runner

  globalControlPlaneRepositores:
    - name: test-temp/busybox
      source: docker.io/busybox
      tags:
        allow:
          - "1.33.1"
    # - name: third-party/bitnami/etcd # infra-api etcd, only us-west-2 needed
    #   source: docker.io/bitnami/etcd
    #   tags:
    #     allow:
    #       - "3.4.16-debian-10-r14"
    - name: third-party/kube-apiserver # infra-apiserver
      source: registry.k8s.io/kube-apiserver
      tags:
        allow:
          - "v1.21.1"
    - name: third-party/kube-controller-manager # infra-apiserver
      source: registry.k8s.io/kube-controller-manager
      tags:
        allow:
          - "v1.21.1"
    - name: third-party/mysql
      source: docker.io/mysql
      tags:
        allow:
          - "5.6"
          - "5.7"
          - "8.0"
    - name: third-party/snail007/goproxy
      source: docker.io/snail007/goproxy
      tags:
        allow:
          - "latest"

    ## =============================================================================== test related images
  tiworkload:
    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tiworkload/agent
      name: tiworkload/agent
      tags:
        allow:
          - "latest.*"
          - "test.*"
    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tiworkload/worker
      name: tiworkload/worker
      tags:
        allow:
          - "latest.*"
          - "test.*"
    - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/perf_testing/bench-toolset
      name: perf_testing/bench-toolset
      tags:
        allow:
          - "latest"
          - "latest-test"

  fts:
    - name: tidbcloud/tidb
      source: us-docker.pkg.dev/pingcap-testing-account/hub/pingcap/tidb/images/tidb-server
      tags:
        allow:
          - feature-fts
          - "feature-fts-[a-f0-9]{6,10}$" # exact tags
          - "^release-fts-[0-9]{6}(-[a-f0-9]+)?$"
        deny:
          - ".*-dev$"
    - name: tidbcloud/tiflash
      source: us-docker.pkg.dev/pingcap-testing-account/hub/pingcap/tiflash/image
      tags:
        allow:
          - feature-fts
          - "feature-fts-[a-f0-9]{6,10}$" # exact tags
          - "^release-fts-[0-9]{6}(-[a-f0-9]+)?$"
        deny:
          - ".*-dev$"
    - name: tidbcloud/tikv
      source: us-docker.pkg.dev/pingcap-testing-account/hub/tikv/tikv/image
      tags:
        allow:
          - feature-fts
          - "feature-fts-[a-f0-9]{6,10}$" # exact tags
          - "^release-fts-[0-9]{6}(-[a-f0-9]+)?$"
        deny:
          - ".*-dev$"
    - name: tidbcloud/tici
      source: us-docker.pkg.dev/pingcap-testing-account/hub/pingcap/tici/image
      tags:
        allow:
          - "master"
          - "^release-fts-[0-9]{6}(-[a-f0-9]+)?$"

targetRegistries:
  - name: 385595570414.dkr.ecr.us-west-2.amazonaws.com
    type: ECR
    includeRepositorySets:
      - commonRepositories
      - autoDeployRepositories
      - globalControlPlaneRepositores
      - fts

  - name: tidbclouddev.azurecr.io
    type: ACR
    includeRepositorySets:
      - commonRepositories
      - tiworkload
  - name: gcr.io
    project: pingcap-public
    type: GCR
    repositories:
      - name: third-party/baseimage/golang
        source: docker.io/library/golang
        tags:
          allow:
            - "^1[.]25[.][0-9]+$"
          deny:
            - 1\.22\.\d+
      - name: test-temp/busybox
        source: docker.io/busybox
        tags:
          allow:
            - "1.33.1"
            - "1.34.1"
      - name: third-party/pause
        source: registry.k8s.io/pause
        tags:
          allow:
            - "3.9"
      - name: third-party/kube-state-metrics/kube-state-metrics
        source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/third-party/kube-state-metrics/kube-state-metrics
        tags:
          allow:
            - "v2.16.0"
            - "v2.10.0"
            - "v2.3.0"
      - name: third-party/crossplanecontrib/provider-aws
        source: docker.io/crossplanecontrib/provider-aws
        tags:
          allow:
            - "v0.47.0" # deprecate
            - "v0.45.0"
            - "v0.45.2"
      # https://github.com/crossplane-contrib/provider-gcp/releases
      # the DockerHub location is changed
      - name: third-party/crossplanecontrib/provider-gcp
        source: docker.io/crossplanecontrib/provider-gcp
        tags:
          allow:
            - "v0.23.0-rc.0.25.g01437a11"
            - "v0.22.0-stable"
      ## deprecated: test-infra old used
      # - name: serverless/tiflash
      #   source: docker.io/xexplorersun/tiflash
      #   tags:
      #     allow:
      #       - "v6.6.0"
      # - name: serverless/tiflash-compute
      #   source: docker.io/xexplorersun/tiflash-compute
      #   tags:
      #     allow:
      #       - "v6.6.0"
      # - name: serverless/tikv-cse
      #   source: docker.io/xexplorersun/tikv-cse
      #   tags:
      #     allow:
      #       - "v6.6.0"
      #       - "cse-.*"
      - name: dbaas/tiproxy
        source: docker.io/pingcap/tiproxy
      - source: docker.io/victoriametrics/vmagent
        name: third-party/victoriametrics/vmagent
        tags:
          allow:
            - "v1.78.0"
            - "v1.79.13"
            - "v1.87.6"
            - "v1.87.7"
            - "v1.97.1"

      - source: docker.io/victoriametrics/operator
        name: third-party/victoriametrics/operator
        tags:
          allow:
            - "v0.29.2"
            - "v0.34.1"

  - name: gcr.io
    project: pingcap-dbaas-build
    type: GCR
    repositories:
      - name: test-temp/busybox
        source: docker.io/busybox
        tags:
          allow:
            - "1.33.1"
  - name: gcr.io
    project: pingcap-gardener
    type: GCR
    repositories:
      - name: test-temp/busybox
        source: docker.io/busybox
        tags:
          allow:
            - "1.34.1"
      - name: tidbcloud/infra-webhook
        source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/infra-webhook
      - name: tidbcloud/infra-exporter
        source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/infra-exporter
      - name: tidbcloud/vector
        source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/vector
        tags:
          allow:
            - "0.49-0605-6865bfc"
            - "0.49-0605-6865bfc-ng"
            - "0.49-0720-4c68515"
            - "0.49-0720-4c68515-ng"
            - "0.49-0820-c465793"
            - "0.49-0820-c465793-ng"
      - name: tidbcloud/vmagent
        source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/vmagent
        tags:
          allow:
            - "v1.122.2-cluster"

  - name: us-west1-docker.pkg.dev
    project: qa-infra-dev
    type: GCR
    repositories:
      - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tiworkload/agent
        name: qa/tiworkload/agent
        tags:
          allow:
            - "latest.*"
            - "test.*"
      - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tiworkload/worker
        name: qa/tiworkload/worker
        tags:
          allow:
            - "latest.*"
            - "test.*"
      - source: 385595570414.dkr.ecr.us-west-2.amazonaws.com/perf_testing/bench-toolset
        name: qa/perf_testing/bench-toolset
        tags:
          allow:
            - "latest"
            - "latest-test"
  - name: tidbcloud-dev-registry.ap-southeast-1.cr.aliyuncs.com
    type: ACR
    includeRepositorySets:
      - commonRepositories

defaults:
  ratelimit:
    min: 100
    retry: 15m
  parallel: 5