project_name         = "tidb-onebox"
environment          = "dev"
aws_region           = "us-west-2"
vpc_cidr             = "10.20.0.0/16"
availability_zones   = ["us-west-2a", "us-west-2b"]
public_subnet_cidrs  = ["10.20.0.0/24", "10.20.1.0/24"]
private_subnet_cidrs = ["10.20.10.0/24", "10.20.11.0/24"]

eks_cluster_version  = "1.35"
node_instance_types  = ["m6i.large"]
node_desired_size    = 2
node_min_size        = 2
node_max_size        = 4

enable_ingress_nginx  = false
enable_metrics_server = true

# IAM principal ARN granted EKS cluster-admin access. Any IAM role/user ARN works,
# including the ARN returned by `aws sts get-caller-identity` (e.g. an assumed-role
# ARN like arn:aws:sts::<ACCOUNT_ID>:assumed-role/<ROLE_NAME>/<SESSION>, or the
# underlying role ARN such as the AWSReservedSSO_* form below).
# Leave empty to fall back to the caller's own ARN.
cluster_admin_principal_arn = "arn:aws:iam::<ACCOUNT_ID>:role/aws-reserved/sso.amazonaws.com/<SSO_REGION>/AWSReservedSSO_<PERMISSION_SET>_<SUFFIX>"

tags = {
  Owner      = "onebox"
  CostCenter = "engineering"
}

# ── TiDB-X cluster ────────────────────────────────────────────────────────────
# Replace the ECR image URIs below with those matching your AWS account.
# All fields are optional and fall back to the defaults defined in variables.tf.

tidb_x = {
  # Operator
  operator_namespace     = "tidb-x-admin"
  operator_chart_version = "v2.1.0-alpha.15"
  operator_image         = "pingcap/tidb-operator"

  # Cluster identity
  # NOTE: cluster_name here is the TiDB-X Cluster CR name (used inside the
  # tidb-x-cluster namespace), NOT the EKS cluster name. The EKS cluster name
  # is derived from project_name + environment (top-level vars above).
  cluster_name      = "tidb-x-onebox"
  cluster_namespace = "tidb-x-cluster"
  cluster_version   = "v8.5.4-nextgen.202510.1"

  # S3 object storage — the deploy script auto-creates the bucket if missing
  # (errors out if creation fails, usually due to wrong AWS profile).
  # Bucket name must be globally unique.
  s3_bucket_name     = "tidb-x-onebox-data"
  s3_create_bucket   = false
  s3_service_account = "tidb-x-s3"

  # PD
  pd_image    = "385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/pd"
  pd_replicas = 1
  pd_storage  = "20Gi"
  pd_config   = <<-TOML
    [schedule]
      max-merge-region-size = 20
  TOML

  # TiKV — extra_spec injects S3 env vars and sets the IRSA ServiceAccount.
  tikv_image   = "385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/tikv"
  tikv_replicas = 1
  tikv_storage  = "100Gi"
  tikv_config   = <<-TOML
    [storage]
      reserve-space = "10GB"
      api-version = 2
      enable-ttl = true
  TOML
  tikv_extra_spec = <<-YAML
    overlay:
      pod:
        spec:
          serviceAccountName: tidb-x-s3
          containers:
            - name: tikv
              env:
                - name: DFS_PREFIX
                  value: "cse"
                - name: DFS_S3_BUCKET
                  value: "tidb-x-onebox-data"
                - name: DFS_S3_REGION
                  value: "us-west-2"
  YAML

  # TiDB
  tidb_image    = "385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/tidb"
  tidb_replicas = 1
  tidb_config   = <<-TOML
    keyspace-name = "SYSTEM"

    [performance]
      max-procs = 0
  TOML

  # PD TSO microservice (requires pd_scheduling_enabled=true for mode=ms)
  pd_tso_enabled  = true
  pd_tso_image    = "385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/pd"
  pd_tso_replicas = 1

  # PD Scheduling microservice
  pd_scheduling_enabled  = true
  pd_scheduling_image    = "385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/pd"
  pd_scheduling_replicas = 1

  # TiProxy
  tiproxy_enabled  = true
  tiproxy_image    = "385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/tiproxy"
  tiproxy_version  = "v1.4.0-nextgen.202510.1"
  tiproxy_replicas = 1

  # TiFlash write node
  tiflash_write_enabled  = true
  tiflash_write_image    = "385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/tiflash"
  tiflash_write_replicas = 1
  tiflash_write_storage  = "100Gi"
  tiflash_write_extra_spec = <<-YAML
    overlay:
      pod:
        spec:
          serviceAccountName: tidb-x-s3
  YAML
  tiflash_write_config = <<-TOML
    [flash]
      disaggregated_mode = "tiflash_write"

    [storage.s3]
      bucket = "tidb-x-onebox-data"
      endpoint = "http://s3.us-west-2.amazonaws.com"
      root = "tiflash-root"
  TOML

  # TiFlash compute node
  tiflash_compute_enabled  = true
  tiflash_compute_image    = "385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/tiflash"
  tiflash_compute_replicas = 1
  tiflash_compute_storage  = "100Gi"
  tiflash_compute_extra_spec = <<-YAML
    overlay:
      pod:
        spec:
          serviceAccountName: tidb-x-s3
  YAML
  tiflash_compute_config = <<-TOML
    [flash]
      disaggregated_mode = "tiflash_compute"

    [storage.s3]
      bucket = "tidb-x-onebox-data"
      endpoint = "http://s3.us-west-2.amazonaws.com"
      root = "tiflash-root"
  TOML
}