apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    owner: chenfei
  name: config-manager-chenfei
  namespace: infra
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: config-manager-chenfei
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/restartedAt: "2023-11-24T01:16:13+08:00"
      creationTimestamp: null
      labels:
        app: config-manager-chenfei
        owner: chenfei
    spec:
      containers:
      - args:
        - --leader-elect=false
        - --zap-devel=false
        - --activity
        - --activity-config=/etc/config-manager/activity.yaml
        - --ghapp-private-key-file=/etc/config-manager/ghapp-private-key.pem
        - --ghapp-app-id=340871
        - --ghapp-install-id=38097753
        - --jump-endpoint=https://ops-dev.tidbcloud.com/configchange
        - --cluster-ns-prefix=nightly-ms-
        - --api-bind-address=:8082
        - --config-revision-ttl=168h0m0s
        - --config-path=/etc/config-manager/config.yaml
        command:
        - /manager
        env:
        - name: KUBECONFIG
          value: /.kube/config
        - name: GCP_WORKLOAD_IDENTITY_AUDIENCE
          value: //iam.googleapis.com/projects/27323915999/locations/global/workloadIdentityPools/dev-dbaas/providers/dev-dbaas-eks-oidc
        - name: GCP_IMPERSONATE_SA
          value: dev-nightly-central@pingcap-gardener.iam.gserviceaccount.com
        - name: TIINF_POD_NAME
          value: "coresvc-server-dummy1-dummy2"
        - name: GOOGLE_APPLICATION_CREDENTIALS
          value: /gcloud-config/application_default_credentials.json
        - name: PROXY_AUTH0_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: proxy-auth0-client
              key: Auth0ClientID
        - name: PROXY_AUTH0_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: proxy-auth0-client
              key: Auth0ClientSecret
        image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/config-manager:6daff8ef2e8037bbecb795045ff319684d022046
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: 8081
            scheme: HTTP
          initialDelaySeconds: 15
          periodSeconds: 20
          successThreshold: 1
          timeoutSeconds: 1
        name: manager
        ports:
        - containerPort: 9443
          name: webhook-server
          protocol: TCP
        readinessProbe:
          failureThreshold: 10
          httpGet:
            path: /readyz
            port: 8081
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 5
          successThreshold: 1
          timeoutSeconds: 1
        resources:
          limits:
            cpu: "2"
            memory: 2Gi
          requests:
            cpu: 100m
            memory: 100Mi
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /etc/config-manager
          name: bizconfig
        - mountPath: /.kube
          name: kubeconfig
        - mountPath: /tmp/k8s-webhook-server/serving-certs
          name: cert
        - mountPath: /etc/conifg-manager
          name: activity-config
        - name: config-manager-gcp-credential-config
          mountPath: /gcloud-config/
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: central
      serviceAccountName: central
      terminationGracePeriodSeconds: 30
      volumes:
      - name: kubeconfig
        secret:
          defaultMode: 420
          secretName: config-manager-infra-kubeconfig
      - name: bizconfig
        projected:
          defaultMode: 420
          sources:
          - secret:
              name: config-manager-ghapp-private-key
          - configMap:
              name: config-manager-activity-config-b5g7ktf99t
          - configMap:
              name: config-manager-config-chenfei
      - name: cert
        secret:
          defaultMode: 420
          secretName: infra-webhook-cert
      - configMap:
          defaultMode: 420
          name: config-manager-activity-config-b5g7ktf99t
        name: activity-config
      - name: config-manager-gcp-credential-config
        secret:
          secretName: config-manager-gcp-credential-config
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: config-manager-chenfei
    owner: chenfei
  name: config-manager-api-chenfei
  namespace: infra
spec:
  internalTrafficPolicy: Cluster
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  ports:
    - name: http-api
      port: 8082
      protocol: TCP
      targetPort: 8082
  selector:
    app: config-manager-chenfei
  type: ClusterIP
---
apiVersion: v1
data:
  config.yaml: |
    server:
      coreSvcAddr: "dbaas-core-svc-server-grpc.nightly-ms:8888"
      kmsArn: "arn:aws:kms:us-west-2:385595570414:key/f15101b5-6aed-48bf-9b9a-fc36406efe92"
    
    clusterProxy:
      auth0Audience: "dev-proxy-service"
      auth0Domain: "tidb-dev.us.auth0.com"
      pcaArn: "arn:aws:acm-pca:us-west-2:385595570414:certificate-authority/4668d5cc-1042-4371-9ff4-72ab9493c545"
    
    predicate:
      matchExpressions:
        - key: "cloud.pingcap.com/reconciler"
          operator: "In"
          values:
            - chenfei
    
    featureGates:
      independent_config_change:
        all: true
kind: ConfigMap
metadata:
  labels:
    owner: chenfei
  name: config-manager-config-chenfei
  namespace: infra