# Seed Operations

Before you begin, please refer to [Operation 101](../operation-101.md) to learn how to accessing the different kinds of clusters and understand the overall landscape.

## Add a new Seed

New seeds should be added through the [CD pipeline](../change-process.md), this document describe how.

Adding a seed is equivalent to creating a Kubernetes cluster, deploying the necessary components to it and adding it to the target Gardener cluster.

### Creating A Kubernetes Cluster

To create a new k8s cluster, simply adding a new k8s stack. Currently, two k8s stack GKE and EKS are supported. Taking EKS as an example, the following commands add a new eks stack:

```sh
$ cd deploy/eks
$ pulumi login --local
$ pulumi stack init ${K8S_STACK_NAME}
# set configurations, you may refer to existing stacks for this
$ pulumi config set ...
```

Note: by convention, we name the cluster stack as `${stage}-seed-${region}`(based on the prior knowledge that region names of different cloud providers do not overlap).

Open a pull request and get your change reviewed and merged, the kubernetes cluster will be created in CD then.

A full example can be found [here](https://github.com/tidbcloud/dbaas/pull/1970)

### Deploy Monitoring Stack and Register Seed

Deploying monitoring stack to the newly created cluster:

```sh
$ cd deploy/monitoring
$ pulumi login --local
$ pulumi stack init ${K8S_STACK_NAME}-monitoring
# K8S_PROJECT is either gke or eks
$ pulumi config set infra-stack sre-bot/${K8S_PROJECT}/${K8S_STACK_NAME}
# other configurations
$ pulumi config set ...
```

Add monitoring healthy check, add follow config to deploy/monitoring/dead-mans-switch-${ENV}.yaml. The configuration will used for
dead-mans-switch service verify headbeat payload as expected.

```yaml
      - status: firing
        labels:
          alertname: Watchdog
          cluster: seed
          prometheus: monitoring/k8s
          provider: <provider-type> // gke or eks
          region: <region>
          severity: none
```

And register the seed to the target gardener cluster by adding the following snippets in `deploy/garden/${stage}-acre.sh`:

```
    - name: ${provider}-${region}
      type: ${provider}
      mode: seed
      region: ${region}
      zones:
        - ${zone1}
        - ${zone2}
        - ${zone3}
      credentials:
        <provider-credentials>
      cluster:
        networks:
          nodes: "10.0.0.0/17"
          pods: "10.0.128.0/17"
          services: "172.20.0.0/16"
        kubeconfig:
$(command to get kubeconfig of the target cluster)
```

Then, add the egress IP of seed to the whitelist of gardener apiserver, for example:

```
landscape:
  ingressSourceRanges:
  # Seed AWS ap-southeast-1
  - 54.179.199.245/32
  - 54.179.200.40/32
  - 54.151.153.55/32
```

You may find the egress IP of seed from the jenkins CD log when creating cluster.

Note: the new seed entry **MUST** be added after existing entries.

A full example can be found in [monitoring](https://github.com/tidbcloud/dbaas/pull/1973) and [registering seed](https://github.com/tidbcloud/dbaas/pull/1971) and [whitelist](https://github.com/tidbcloud/dbaas/pull/1976), usually you should include these changes in one single pull request after the k8s cluster is created.