# Public Entrypoint Scan

Date: 2026-03-30

## Purpose

This document summarizes the first deployment-side scan for public or externally reachable entrypoints.

It is intended to answer which deployment objects appear to expose user-facing or externally reachable surfaces, and where their interface artifacts likely live.

## Summary

- entrypoint records: `430`
- deployment objects with entrypoints: `34`
- mapped source repos represented: `18`
- internet-reachable records: `143`
- gateway-routed records with unknown host ownership: `109`

Exposure surface counts:
- `gateway`: `166`
- `ingress`: `125`
- `nodeport_service`: `65`
- `loadbalancer_service`: `48`
- `httproute`: `26`

Reachability counts:
- `unknown`: `143`
- `public_dns`: `124`
- `gateway_routed_unknown_host`: `109`
- `unknown_lb`: `20`
- `internet_facing_lb`: `19`
- `internal_lb`: `9`
- `unknown_dns`: `6`

## Highest-Signal Internet-Reachable Candidates

- `dedicated-regional-server`: `53` internet-reachable records, source owner `tidbcloud/infra-provider`, sample host `regional-api.eastus.dev.azure.tidbcloud.com`, sample file `dedicated-regional-server/gateway-crds/variants/azure/kong-gateway.yaml`
- `nextgen-regional-control-plane`: `30` internet-reachable records, source owner `next-gen regional platform bundle`, sample host `ap-southeast-1.regional-api.staging.aliyun.tidbcloud.com`, sample file `staging/nextgen-regional-control-plane/gateway-crds/variants/alicloud/kong-gateway.yaml`
- `serverless-regional-service`: `17` internet-reachable records, source owner `tidbcloud/serverless-service`, sample host `regionalsvc01.ap-east-1.prod.aws.tidbcloud.com`, sample file `serverless-regional-service/envs/prod-aws-ap-east-1/ingress.yaml`
- `metrics-integration`: `12` internet-reachable records, source owner `tidbcloud/metrics-integration`, sample host `None`, sample file `staging/metrics-integration/metrics-integration-regional-loadbalancer/envs/stg-aws-us-west-2/service.yaml`
- `o11y-svc`: `12` internet-reachable records, source owner `tidbcloud/observability`, sample host `serverless.tidbapi.com`, sample file `o11y-svc/envs/prod/ingress.yaml`
- `dataservice-regional-svc`: `5` internet-reachable records, source owner `tidbcloud/dataservices`, sample host `regionalsvc01.ap-southeast-1.dev.shared.alicloud.tidbcloud.com`, sample file `dev/dataservice-regional-svc/envs/dev-ali-ap-southeast-1/ingress.yaml`
- `serverless-ops-service`: `4` internet-reachable records, source owner `tidbcloud/aws-shared-provider`, sample host `regionalsvc01.us-east-1.staging.shared.aws.tidbcloud.com`, sample file `serverless-ops-service/envs/staging-us-east-1-f01/ingress.yaml`
- `devops-service`: `3` internet-reachable records, source owner `tidbcloud/devops`, sample host `investibook.tidbcloud.com`, sample file `devops-service/investibook/envs/preview/ingress.yaml`
- `tidb-mgmt-service`: `2` internet-reachable records, source owner `tidbcloud/tidb-management-service`, sample host `None`, sample file `tidb-mgmt-service/envs/staging/service-cleanup.yaml`
- `tempo-proxy`: `2` internet-reachable records, source owner `tidbcloud/tidb-management-service`, sample host `None`, sample file `tempo-proxy/envs/staging/service-cleanup.yaml`
- `core-svc`: `2` internet-reachable records, source owner `tidbcloud/core-svc`, sample host `None`, sample file `core-svc/envs/staging/core-svc-server-grpc-cleanup-service.yaml`
- `dedicated-infra-apiserver`: `1` internet-reachable records, source owner `infra-cd apiserver stack + third-party kubernetes control-plane bundle`, sample host `None`, sample file `dedicated-infra-apiserver/base/service.yaml`

## Shared-Gateway Candidates

- `dedicated-regional-server`: `54` gateway-routed records, source owner `tidbcloud/infra-provider`, sample file `dedicated-regional-server/regional-server/base/httproute.yaml`
- `nextgen-regional-control-plane`: `38` gateway-routed records, source owner `next-gen regional platform bundle`, sample file `staging/nextgen-regional-control-plane/gateway-crds/variants/alicloud/kong-gateway.yaml`
- `dedicated-cluster-ng-service`: `9` gateway-routed records, source owner `None`, sample file `staging/dedicated-cluster-ng-service/cluster-ng-server/base/httproute.yaml`
- `config-center-regional`: `3` gateway-routed records, source owner `tidbcloud/config-center`, sample file `staging/config-center-regional/base/httproute.yaml`
- `dedicated-cluster-service`: `3` gateway-routed records, source owner `None`, sample file `dedicated-cluster-service/tiworkload/envs/staging-eastus2/tiworkload-agent-httproute.yaml`
- `tcidm`: `1` gateway-routed records, source owner `None`, sample file `tcidm/regional-tcidm-service/base/httproute.yaml`
- `dedicated-ticdc-service`: `1` gateway-routed records, source owner `tidbcloud/dataflow-service`, sample file `dedicated-ticdc-service/ticdc-service/base/httproute.yaml`

## Notes

- `public_dns` means the manifest exposes an explicit hostname that looks externally meaningful, often under `tidbcloud.com` or `tidbapi.com`.
- `gateway_routed_unknown_host` means the object is attached to shared gateway infrastructure but the local manifest does not carry the final hostname.
- `internal_lb` means a load balancer is exposed at the network layer but marked internal-only in deployment annotations.
- Repo interface artifacts are lookup hints and may include more than the exact backend binary serving that entrypoint.

## Machine-Readable Output

- `knowledge/deployment/public-entrypoint-catalog.json`