repositorySets:
  commonRepositories:
    ## =============================================================================== tidbcloud images
    - source: gcr.io/pingcap-public/dbaas/gotty
      name: tidbcloud/gotty
      tags:
        allow:
          - "20211103"

    - source: gcr.io/pingcap-public/third-party/aws-pca-issuer
      name: tidbcloud/aws-pca-issuer
      tags:
        allow:
          - "latest"

    - source: gcr.io/pingcap-public/third-party/tnir/mysqlclient
      name: tidbcloud/mysqlclient
      tags:
        allow:
          - "20201014"

    - source: gcr.io/pingcap-public/audit
      name: tidbcloud/audit
      tags:
        allow:
          - "33184a9560803164b7707098ed9952277c06aee9"
          - "81dc098e2ad54c6918e7c5aac80b052f532bc39f"

    - source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/audit
      name: tidbcloud/audit
      tags:
        allow:
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/advanced-statefulset
      name: tidbcloud/advanced-statefulset
      deny:
        - ".*_linux_amd64$" # single arch image
        - ".*_linux_arm64$" # single arch image

    - source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/dbaas/prod/sli-reporter
      name: tidbcloud/sli-reporter

    - source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/dbaas/prod/cluster-proxy
      name: tidbcloud/cluster-proxy

    - source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/service-proxy
      name: tidbcloud/service-proxy

    - source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/eks-provider
      name: tidbcloud/eks-provider

    - source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/cluster-control-server
      name: tidbcloud/cluster-control-server

    - source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/infra-webhook
      name: tidbcloud/infra-webhook

    - source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/infra-exporter
      name: tidbcloud/infra-exporter

    - source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/cluster-agent
      name: tidbcloud/cluster-agent

    - source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/dataflow-agent
      name: tidbcloud/dataflow-agent

    - source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/dataflow-agent-ng
      name: tidbcloud/dataflow-agent-ng

    - source: 646528577659.dkr.ecr.us-east-2.amazonaws.com/tiflash-autoscale-supervisor
      name: tidbcloud/tiflash-autoscale-supervisor

    - source: 646528577659.dkr.ecr.us-east-2.amazonaws.com/tiflash-autoscaler
      name: tidbcloud/tiflash-autoscaler

    - source: 380838443567.dkr.ecr.us-east-1.amazonaws.com/dbaas/nightly/cluster-autoscaler
      name: dbaas/nightly/cluster-autoscaler

    - source: gcr.io/pingcap-public/dbaas/pd
      name: tidbcloud/pd
      tags:
        allow:
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-[0-9]{8}-[a-zA-Z0-9]+$"
          - "master-c53f203" # Used to fetch pd-patrol-ctl for OPS

    - source: gcr.io/pingcap-public/dbaas/tikv
      name: tidbcloud/tikv
      tags:
        allow:
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-[0-9]{8}-[a-zA-Z0-9]+$"

    - source: gcr.io/pingcap-public/dbaas/tidb
      name: tidbcloud/tidb
      tags:
        allow:
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-[0-9]{8}-[a-zA-Z0-9]+$"

    - source: gcr.io/pingcap-public/dbaas/tiflash
      name: tidbcloud/tiflash
      tags:
        allow:
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-[0-9]{8}-[a-zA-Z0-9]+$"
          - "^v8[.]5[.]4-pre$" # For temporary use by customers, it can be safely deleted on 2025-11
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/tiproxy
      name: tidbcloud/tiproxy
      tags:
        allow:
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-[0-9]{8}-[a-zA-Z0-9]+$"
          - "main"
          - "main-4be7f7c"
          - "v1.4.0-beta.1-69-g11637aa"
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/tiproxy-replayer
      name: tidbcloud/tiproxy-replayer

    - source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/tiproxy
      name: tidbcloud/tiproxy

    - source: gcr.io/pingcap-public/dbaas/tidb-lightning
      name: tidbcloud/tidb-lightning
      tags:
        allow:
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-[0-9]{8}-[a-zA-Z0-9]+$"
          - "^v8[.]5[.]4-pre$" # For temporary use by customers, it can be safely deleted on 2025-11
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/ticdc
      name: tidbcloud/ticdc
      tags:
        allow:
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-[0-9]{8}-[a-zA-Z0-9]+$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-release[.][0-9]+$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-release[.][0-9]+-[0-9]{8,10}-[a-f0-9]+$" # classic hotfix tags
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/br
      name: tidbcloud/br
      tags:
        allow:
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-[0-9]{8}-[a-zA-Z0-9]+$"
          - "^v8[.]5[.]4-pre$" # For temporary use by customers, it can be safely deleted on 2025-11
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/tidb-monitor-initializer
      name: tidbcloud/tidb-monitor-initializer
      tags:
        allow:
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-[0-9]{8}-[a-zA-Z0-9]+$"
          - "^v8[.]5[.]4-pre$" # For temporary use by customers, it can be safely deleted on 2025-11
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/tidb-operator
      name: tidbcloud/tidb-operator
      tags:
        allow:
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)(-.+)?$"
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/tidb-operator-prestop-checker
      name: tidbcloud/tidb-operator-prestop-checker
      tags:
        allow:
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)(-.+)?$"
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/tidb-backup-manager
      name: tidbcloud/tidb-backup-manager
      tags:
        allow:
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)(-.+)?$"
          - "^master-[0-9a-f]+$"
          - "^master$"
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/dbaas/tidb-monitor-reloader
      name: tidbcloud/tidb-monitor-reloader

    - source: gcr.io/pingcap-public/tidbcloud/tiflow
      name: tidbcloud/tiflow
      tags:
        allow:
          - "^v[0-9]+[.][0-9]+[.][0-9]+$"
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)-enterprise$"
          - "^v[0-9]+[.][0-9]+[.][0-9]+-[0-9]{8}-[a-zA-Z0-9]+$"
          - "^v8[.]5[.]4-pre$" # For temporary use by customers, it can be safely deleted on 2025-11
        deny:
          - ".*-dev$"

    - source: gcr.io/pingcap-public/tidbcloud/tiflow-operator
      name: tidbcloud/tiflow-operator
      tags:
        allow:
          - "^(v[0-9]+[.][0-9]+[.][0-9]+)(-.+)?$"
          - "^master-[0-9a-f]+$"
          - "^master$"
        deny:
          - ".*-dev$"

    - source: ghcr.io/chaos-mesh/chaos-mesh
      name: tidbcloud/chaos-mesh

    - source: ghcr.io/chaos-mesh/chaos-daemon
      name: tidbcloud/chaos-daemon

    ## =============================================================================== thrid-party images
    - source: docker.io/falcosecurity/falco
      name: third-party/falcosecurity/falco
      tags:
        allow:
          - "0.44.1"

    - source: docker.io/falcosecurity/falco-driver-loader
      name: third-party/falcosecurity/falco-driver-loader
      tags:
        allow:
          - "0.44.1"

    - source: docker.io/falcosecurity/falcoctl
      name: third-party/falcosecurity/falcoctl
      tags:
        allow:
          - "0.13.0"

    - source: docker.io/falcosecurity/falcosidekick
      name: third-party/falcosecurity/falcosidekick
      tags:
        allow:
          - "2.31.0"

    - source: docker.io/library/python
      name: third-party/baseimage/python
      tags:
        allow:
          - "3.12-alpine"

    - source: docker.io/busybox
      name: third-party/busybox
      tags:
        allow:
          - "1.31.1"
          - "1.34.1"

    - source: docker.io/fatedier/frps
      name: third-party/fatedier/frps
      tags:
        allow:
          - "0.39.1"
          - "v0.44.0"

    - source: docker.io/bloomberg/goldpinger
      name: third-party/bloomberg/goldpinger
      tags:
        allow:
          - "3.10.3"

    - source: ghcr.io/tennix/node-pinger
      name: third-party/tennix/node-pinger
      tags:
        allow:
          - "v0.1.1"
          - "v0.1.2"

    - source: docker.io/fatedier/frpc
      name: third-party/fatedier/frpc
      tags:
        allow:
          - "v0.39.1"

    - source: docker.io/rancher/local-path-provisioner
      name: third-party/rancher/local-path-provisioner
      tags:
        allow:
          - "v0.0.32"

    - source: docker.io/prom/node-exporter
      name: third-party/prom/node-exporter
      tags:
        allow:
          - "v1.6.1"
          - "v1.3.1"

    - source: quay.io/prometheus/node-exporter
      name: third-party/prometheus/node-exporter
      tags:
        allow:
          - "v1.9.1"
          - "v1.11.1"

    - source: docker.io/prom/prometheus
      name: third-party/prom/prometheus
      tags:
        allow:
          - "v2.38.0"
          - "v2.11.1"
          - "v2.40.7"

    - source: docker.io/grafana/grafana
      name: third-party/grafana/grafana
      tags:
        allow:
          - "6.0.1"

    - source: quay.io/jetstack/cert-manager-controller
      name: third-party/jetstack/cert-manager-controller
      tags:
        allow:
          - "v1.6.1"
          - "v1.9.1"
          - "v1.10.0"
          - "v1.18.2"

    - source: quay.io/jetstack/cert-manager-webhook
      name: third-party/jetstack/cert-manager-webhook
      tags:
        allow:
          - "v1.6.1"
          - "v1.9.1"
          - "v1.10.0"
          - "v1.18.2"

    - source: quay.io/jetstack/cert-manager-cainjector
      name: third-party/jetstack/cert-manager-cainjector
      tags:
        allow:
          - "v1.6.1"
          - "v1.9.1"
          - "v1.10.0"
          - "v1.18.2"

    # - source: public.ecr.aws/k1n1h4h4/cert-manager-aws-privateca-issuer
    - source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/third-party/k1n1h4h4/cert-manager-aws-privateca-issuer
      name: third-party/k1n1h4h4/cert-manager-aws-privateca-issuer
      tags:
        allow:
          - "v1.6.0"
          - "v1.7.0"

    - source: registry.k8s.io/dns/k8s-dns-node-cache
      name: third-party/dns/k8s-dns-node-cache
      tags:
        allow:
          - "1.23.1"
          - "1.26.5"

    - source: registry.k8s.io/external-dns/external-dns
      name: third-party/external-dns/external-dns
      tags:
        allow:
          - "v0.20.0"

    - source: registry.k8s.io/sig-storage/csi-attacher
      name: third-party/sig-storage/csi-attacher
      tags:
        allow:
          - "v3.1.0"

    - source: registry.k8s.io/sig-storage/csi-snapshotter
      name: third-party/sig-storage/csi-snapshotter
      tags:
        allow:
          - "v3.0.3"

    - source: registry.k8s.io/metrics-server/metrics-server
      name: third-party/metrics-server/metrics-server
      tags:
        allow:
          - "v0.8.0"

    - source: registry.k8s.io/kube-state-metrics/kube-state-metrics
      name: third-party/kube-state-metrics/kube-state-metrics
      tags:
        allow:
          - "v2.16.0"
          - "v2.10.0"
          - "v2.3.0"

    - source: registry.k8s.io/sig-storage/livenessprobe
      name: third-party/sig-storage/livenessprobe
      tags:
        allow:
          - "v2.4.0"

    - source: registry.k8s.io/sig-storage/csi-node-driver-registrar
      name: third-party/sig-storage/csi-node-driver-registrar
      tags:
        allow:
          - "v2.3.0"

    - source: registry.k8s.io/sig-storage/csi-provisioner
      name: third-party/sig-storage/csi-provisioner
      tags:
        allow:
          - "v2.2.2"

    - source: registry.k8s.io/sig-storage/csi-resizer
      name: third-party/sig-storage/csi-resizer
      tags:
        allow:
          - "v1.1.0"

    - source: registry.k8s.io/autoscaling/cluster-autoscaler
      name: third-party/autoscaling/cluster-autoscaler
      tags:
        allow:
          - "v1.21.1"
          - "v1.25.0"
          - "v1.27.0"
          - "v1.33.0"
    # - source: public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver
    - source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/third-party/ebs-csi-driver/aws-ebs-csi-driver
      name: third-party/ebs-csi-driver/aws-ebs-csi-driver
      tags:
        allow:
          - "v1.6.1"
          - "v1.26.0"

    - source: 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-load-balancer-controller
      name: third-party/amazon/aws-load-balancer-controller
      tags:
        allow:
          - "v2.4.2"
          - "v2.6.2"
          - "v2.11.0"
          - "v2.13.4"

    - source: docker.io/openkruise/kruise-manager
      name: third-party/openkruise/kruise-manager
      tags:
        allow:
          - "v1.3.0"

    - source: registry.k8s.io/pause
      name: third-party/pause
      tags:
        allow:
          - "3.9"

    - name: tidbcloud/ng-autoscaler
      source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/ng-autoscaler

    - name: dbaas/aws-shared-provider-datacleaner
      source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/dbaas/aws-shared-provider-datacleaner

    - name: tidbcloud/cluster-agent-ng
      source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/cluster-agent-ng
    - name: tidbcloud/audit-ng
      source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/audit-ng

    - name: tidbcloud/tidb-fivetran-deployer
      source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/tidb-fivetran-deployer

    ## =============================================================================== o11y team images
    - source: gcr.io/pingcap-public/dbaas/vector
      name: tidbcloud/vector
      tags:
        allow:
          - "0.37.1-2d79df-debian"
          - "0.37.1-nextgen-505e5a-debian"

    - source: slggamer/vectorextension049
      name: tidbcloud/vector
      tags:
        allow:
          - "0.49-1124-ng-conprof-debian"

    - source: slggamer/vector
      name: tidbcloud/vector
      tags:
        allow:
          - "0.49-0331-feec02b-ng"
          - "0.49-0331-feec02b"
          - "0.49-0605-6865bfc"
          - "0.49-0605-6865bfc-ng"
          - "0.49-0720-4c68515"
          - "0.49-0720-4c68515-ng"
          - "0.49-0820-c465793"
          - "0.49-0820-c465793-ng"
    - source: nolouch/vector
      name: tidbcloud/vector
      tags:
        allow:
          - "0.49-copr-1120-4-st-ng-debian"

    - source: nolouch/vector
      name: tidbcloud/vector
      tags:
        allow:
          - "0.49-copr-1120-4-st-ng-debian"

    - source: gcr.io/pingcap-public/elastic/filebeat-oss-tidb-module
      name: third-party/elastic/filebeat-oss-tidb-module
      tags:
        allow:
          - "7.12.2"

    - source: docker.io/victoriametrics/vmagent
      name: third-party/victoriametrics/vmagent
      tags:
        allow:
          - "v1.78.0"
          - "v1.79.13"
          - "v1.87.6"
          - "v1.87.7"
          - "v1.97.1"

    - source: docker.io/victoriametrics/operator
      name: third-party/victoriametrics/operator
      tags:
        allow:
          - "v0.29.2"
          - "v0.34.1"
          - "v0.62.0"

    - source: quay.io/prometheus-operator/prometheus-config-reloader
      name: third-party/prometheus-operator/prometheus-config-reloader
      tags:
        allow:
          - "v0.84.1"

    - source: docker.io/timberio/vector
      name: third-party/timberio/vector
      tags:
        allow:
          - "0.22.X-debian"

    - source: gcr.io/pingcap-public/third-party/timberio/vector
      name: third-party/timberio/vector
      tags:
        allow:
          - "0.23.X-1-debian"

    - source: gcr.io/pingcap-public/fluent-bit-plugin-loki
      name: third-party/grafana/fluent-bit-plugin-loki
      tags:
        allow:
          - "main-8c1095a55-1.8.15-final-multi-arch"

    - source: ghcr.io/resmoio/kubernetes-event-exporter
      name: third-party/resmoio/kubernetes-event-exporter
      tags:
        allow:
          - "v1.7"

    - source: docker.io/kong/kubernetes-ingress-controller
      name: third-party/kong/kubernetes-ingress-controller
      tags:
        allow:
          - "3.1"

    - source: docker.io/library/kong
      name: third-party/kong/kong
      tags:
        allow:
          - "3.6"
          - "3.9.3"

    - source: docker.io/istio/install-cni
      name: third-party/istio/install-cni
      tags:
        allow:
          - "1.20.0"
          - "1.20.8"

    - source: docker.io/istio/operator
      name: third-party/istio/operator
      tags:
        allow:
          - "1.20.0"
          - "1.20.8"

    - source: docker.io/istio/pilot
      name: third-party/istio/pilot
      tags:
        allow:
          - "1.20.0"
          - "1.20.8"

    - source: docker.io/istio/proxyv2
      name: third-party/istio/proxyv2
      tags:
        allow:
          - "1.20.0"
          - "1.20.8"

    - name: third-party/kiwigrid/k8s-sidecar
      source: quay.io/kiwigrid/k8s-sidecar
      tags:
        allow:
          - 1.19.2
  autoDeployRepositories:
    ## =============================================================================== auto deploy job images
    - source: us-docker.pkg.dev/pingcap-dbaas-build/auto-deploy/deploy-job-runner
      name: auto-deploy/deploy-job-runner

targetRegistries:
  - name: 380838443567.dkr.ecr.ap-southeast-3.amazonaws.com
    type: ECR
    includeRepositorySets:
      - commonRepositories
  - name: 380838443567.dkr.ecr.ap-northeast-1.amazonaws.com
    type: ECR
    includeRepositorySets:
      - commonRepositories
  - name: 380838443567.dkr.ecr.ap-northeast-2.amazonaws.com
    type: ECR
    includeRepositorySets:
      - commonRepositories
  - name: 380838443567.dkr.ecr.ap-southeast-1.amazonaws.com
    type: ECR
    includeRepositorySets:
      - commonRepositories
  - name: 380838443567.dkr.ecr.ap-east-1.amazonaws.com
    type: ECR
    includeRepositorySets:
      - commonRepositories
  - name: 380838443567.dkr.ecr.ap-south-1.amazonaws.com
    type: ECR
    includeRepositorySets:
      - commonRepositories
  - name: 380838443567.dkr.ecr.eu-central-1.amazonaws.com
    type: ECR
    includeRepositorySets:
      - commonRepositories
  - name: 380838443567.dkr.ecr.us-east-1.amazonaws.com
    type: ECR
    includeRepositorySets:
      - commonRepositories
  - name: 380838443567.dkr.ecr.us-west-2.amazonaws.com
    type: ECR
    includeRepositorySets:
      - commonRepositories
      - autoDeployRepositories
    repositories:
      - name: third-party/crossplanecontrib/provider-aws
        source: docker.io/crossplanecontrib/provider-aws
        tags:
          allow:
            - "v0.36.0"
            - "v0.38.0"
            - "v0.39.0"
            - "v0.40.0"
            - "v0.47.0" # deprecate
            - "v0.45.0"
            - "v0.45.2"
      # - name: third-party/bitnami/etcd # infra-api etcd, only us-west-2 needed
      #   source: docker.io/bitnami/etcd
      #   tags:
      #     allow:
      #       - "3.4.16-debian-10-r14"
      - name: third-party/kube-apiserver # infra-apiserver
        source: registry.k8s.io/kube-apiserver
        tags:
          allow:
            - "v1.21.1"
      - name: third-party/kube-controller-manager # infra-apiserver
        source: registry.k8s.io/kube-controller-manager
        tags:
          allow:
            - "v1.21.1"
      - name: third-party/mysql
        source: docker.io/mysql
        tags:
          allow:
            - "5.6"
            - "5.7"
  - name: tidbcloudprod.azurecr.io
    type: ACR
    includeRepositorySets:
      - commonRepositories
  - name: gcr.io
    project: dbaas-prod
    type: GCR
    repositories:
      - name: tidbcloud/infra-exporter
        source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/infra-exporter
      - name: tidbcloud/vector
        source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/vector
        tags:
          allow:
            - "0.49-0605-6865bfc"
            - "0.49-0605-6865bfc-ng"
            - "0.49-0720-4c68515"
            - "0.49-0720-4c68515-ng"
            - "0.49-0820-c465793"
            - "0.49-0820-c465793-ng"
      - name: tidbcloud/vmagent
        source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/vmagent
        tags:
          allow:
            - "v1.122.2-cluster"
      - name: third-party/prometheus-operator/prometheus-config-reloader
        source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/third-party/prometheus-operator/prometheus-config-reloader
        tags:
          allow:
            - "v0.84.1"
      - name: third-party/victoriametrics/operator
        source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/third-party/victoriametrics/operator
        tags:
          allow:
            - "v0.62.0"
      - name: third-party/kube-state-metrics/kube-state-metrics
        source: 380838443567.dkr.ecr.us-west-2.amazonaws.com/third-party/kube-state-metrics/kube-state-metrics
        tags:
          allow:
            - "v2.16.0"
            - "v2.10.0"
            - "v2.3.0"
  - name: gcr.io
    project: pingcap-public
    type: GCR
    repositories:
      - name: third-party/golang
        source: amd64/golang
        tags:
          allow:
            - "1.19.4-alpine3.17"

      - name: third-party/google/cloud-sdk
        source: docker.io/google/cloud-sdk
        tags:
          allow:
            - "494.0.0-alpine"

      - name: third-party/baseimage/golang
        source: docker.io/library/golang
        tags:
          allow:
            - "1.21.6-alpine3.18"
            - "1.19"
            - "1.23"
            - "1.24.5-alpine3.22"
            - "1.24.6-alpine3.22"

      - name: third-party/baseimage/python
        source: docker.io/library/python
        tags:
          allow:
            - "3.11-bookworm"
            - "3.11"

      - name: third-party/redis
        source: docker.io/library/redis
        tags:
          allow:
            - "6"

      - name: third-party/pause
        source: registry.k8s.io/pause
        tags:
          allow:
            - "3.9"

      - name: dbaas/tiproxy
        source: docker.io/pingcap/tiproxy

      - source: docker.io/pingcap/tidb-tools
        name: third-party/tidb-tools
        tags:
          allow:
            - "latest"

      - source: docker.io/victoriametrics/vmagent
        name: third-party/victoriametrics/vmagent
        tags:
          allow:
            - "v1.78.0"
            - "v1.79.13"
            - "v1.87.7"
            - "v1.97.1"

      - source: docker.io/victoriametrics/operator
        name: third-party/victoriametrics/operator
        tags:
          allow:
            - "v0.29.2"
            - "v0.34.1"

      - source: docker.io/kong/kubernetes-ingress-controller
        name: third-party/kong/kubernetes-ingress-controller
        tags:
          allow:
            - "3.1"

      - source: docker.io/library/kong
        name: third-party/kong/kong
        tags:
          allow:
            - "3.6"

      - source: docker.io/joelnb/dumb-init-alpine
        name: third-party/joelnb/dumb-init-alpine
        tags:
          allow:
            - "3"

      - source: docker.io/tonistiigi/binfmt
        name: third-party/tonistiigi/binfmt
        tags:
          allow:
            - "qemu-v6.2.0"

      - source: docker.io/library/mysql
        name: third-party/mysql
        tags:
          allow:
            - "8.0"

      - source: docker.io/golangci/golangci-lint
        name: third-party/golangci/golangci-lint
        tags:
          allow:
            - "v1.56.2"

      - source: docker.io/joelnb/dumb-init-alpine
        name: third-party/joelnb/dumb-init-alpine
        tags:
          allow:
            - "3"

      - source: docker.io/moby/buildkit
        name: third-party/moby/buildkit
        tags:
          allow:
            - "buildx-stable-1"

      - source: docker.io/debian
        name: third-party/debian
        tags:
          allow:
            - "bookworm-slim"
      - source: docker.io/prom/node-exporter
        name: third-party/prom/node-exporter
        tags:
          allow:
            - "v1.6.1"
            - "v1.3.1"

defaults:
  ratelimit:
    min: 100
    retry: 15m
  parallel: 5