{
  "repo": "tidbcloud/clusterproxy",
  "binary": "proxy",
  "binary_path": "cmd/proxy/main.go",
  "dependencies": {
    "HealthService.Readyz": {
      "infrastructure": {},
      "services": []
    },
    "CentralService.TestConnectionByClusterID": {
      "infrastructure": {
        "mysql": [
          {
            "operation": "PING",
            "target": "user-supplied DSN",
            "conditions": [
              "Only when request body type=mysql"
            ],
            "implementation": "service/central/connection.go:274"
          }
        ],
        "kafka": [
          {
            "operation": "DIAL/BROKERS/DESCRIBE_CONFIGS",
            "target": "user-supplied broker",
            "conditions": [
              "Only when request body type=kafka"
            ],
            "implementation": "service/central/connection.go:85"
          }
        ],
        "network": [
          {
            "operation": "TCP DIAL",
            "target": "schema registry endpoint",
            "conditions": [
              "Only when kafka_item.schema_registry_endpoints is set"
            ],
            "implementation": "service/central/connection.go:228"
          }
        ]
      },
      "services": []
    },
    "CentralService.TestConnectionByNamespacedCluster": {
      "infrastructure": {
        "mysql": [
          {
            "operation": "PING",
            "target": "user-supplied DSN",
            "conditions": [
              "Only when request body type=mysql"
            ],
            "implementation": "service/central/connection.go:274"
          }
        ],
        "kafka": [
          {
            "operation": "DIAL/BROKERS/DESCRIBE_CONFIGS",
            "target": "user-supplied broker",
            "conditions": [
              "Only when request body type=kafka"
            ],
            "implementation": "service/central/connection.go:85"
          }
        ],
        "network": [
          {
            "operation": "TCP DIAL",
            "target": "schema registry endpoint",
            "conditions": [
              "Only when kafka_item.schema_registry_endpoints is set"
            ],
            "implementation": "service/central/connection.go:228"
          }
        ]
      },
      "services": []
    },
    "CentralService.ChangePasswordByClusterID": {
      "infrastructure": {
        "kubernetes": [
          {
            "operation": "GET Secret",
            "resource": "core/v1 Secret {cluster}-cluster-client-secret",
            "conditions": [
              "When TLS is enabled for the target cluster"
            ],
            "implementation": "util/crypto.go:19"
          }
        ]
      },
      "services": [
        {
          "name": "tidb",
          "target_interface": "MySQL ALTER USER / FLUSH PRIVILEGES",
          "operation_type": "mysql_client",
          "target_repo": "pingcap/tidb",
          "conditions": [
            "Always; login path depends on V1/V2/V3 auth variant"
          ],
          "operations": [
            {
              "operation": "ALTER USER",
              "trigger": "Change root or requested user password",
              "conditions": [
                "Always"
              ],
              "implementation": "service/central/password.go:143"
            },
            {
              "operation": "FLUSH PRIVILEGES",
              "trigger": "Persist password change",
              "conditions": [
                "Always"
              ],
              "implementation": "service/central/password.go:147"
            }
          ]
        },
        {
          "name": "tidb-gateway-inner",
          "target_interface": "MySQL ALTER USER / FLUSH PRIVILEGES",
          "operation_type": "mysql_client",
          "target_repo": "tidbcloud/clusterproxy",
          "conditions": [
            "Only when direct {cluster}-tidb Service is absent and connectGateway is used"
          ],
          "operations": [
            {
              "operation": "ALTER USER / FLUSH PRIVILEGES",
              "trigger": "Serverless fallback path",
              "conditions": [
                "Direct TiDB Service missing"
              ],
              "implementation": "pkg/k8s/tidb/connect.go:160"
            }
          ]
        }
      ]
    },
    "CentralService.ChangePasswordByNamespacedCluster": {
      "infrastructure": {
        "kubernetes": [
          {
            "operation": "GET Secret",
            "resource": "core/v1 Secret {cluster}-cluster-client-secret",
            "conditions": [
              "When TLS is enabled for the target cluster"
            ],
            "implementation": "util/crypto.go:19"
          }
        ]
      },
      "services": [
        {
          "name": "tidb",
          "target_interface": "MySQL ALTER USER / FLUSH PRIVILEGES",
          "operation_type": "mysql_client",
          "target_repo": "pingcap/tidb",
          "conditions": [
            "Always; login path depends on V1/V2/V3 auth variant"
          ],
          "operations": [
            {
              "operation": "ALTER USER",
              "trigger": "Change root or requested user password",
              "conditions": [
                "Always"
              ],
              "implementation": "service/central/password.go:143"
            },
            {
              "operation": "FLUSH PRIVILEGES",
              "trigger": "Persist password change",
              "conditions": [
                "Always"
              ],
              "implementation": "service/central/password.go:147"
            }
          ]
        },
        {
          "name": "tidb-gateway-inner",
          "target_interface": "MySQL ALTER USER / FLUSH PRIVILEGES",
          "operation_type": "mysql_client",
          "target_repo": "tidbcloud/clusterproxy",
          "conditions": [
            "Only when direct {cluster}-tidb Service is absent and connectGateway is used"
          ],
          "operations": [
            {
              "operation": "ALTER USER / FLUSH PRIVILEGES",
              "trigger": "Serverless fallback path",
              "conditions": [
                "Direct TiDB Service missing"
              ],
              "implementation": "pkg/k8s/tidb/connect.go:160"
            }
          ]
        }
      ]
    },
    "ClusterProxyService.TiCDCProxyByClusterID": {
      "infrastructure": {
        "kubernetes": [
          {
            "operation": "GET Secret",
            "resource": "core/v1 Secret {cluster}-cluster-client-secret",
            "conditions": [
              "When TiCDC endpoint is TLS-enabled"
            ],
            "implementation": "util/crypto.go:19"
          }
        ]
      },
      "services": [
        {
          "name": "ticdc",
          "target_interface": "HTTP /*",
          "operation_type": "http_proxy",
          "target_repo": "pingcap/tiflow",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "ReverseProxy.ServeHTTP",
              "trigger": "Forward TiCDC OpenAPI traffic to {cluster}-ticdc-peer",
              "conditions": [
                "Always"
              ],
              "implementation": "service/cluster/cdc.go:56"
            }
          ]
        }
      ]
    },
    "ClusterProxyService.TiCDCProxyByNamespacedCluster": {
      "infrastructure": {
        "kubernetes": [
          {
            "operation": "GET Secret",
            "resource": "core/v1 Secret {cluster}-cluster-client-secret",
            "conditions": [
              "When TiCDC endpoint is TLS-enabled"
            ],
            "implementation": "util/crypto.go:19"
          }
        ]
      },
      "services": [
        {
          "name": "ticdc",
          "target_interface": "HTTP /*",
          "operation_type": "http_proxy",
          "target_repo": "pingcap/tiflow",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "ReverseProxy.ServeHTTP",
              "trigger": "Forward TiCDC OpenAPI traffic to {cluster}-ticdc-peer",
              "conditions": [
                "Always"
              ],
              "implementation": "service/cluster/cdc.go:56"
            }
          ]
        }
      ]
    },
    "ClusterProxyService.KubernetesDashboardProxyByClusterID": {
      "infrastructure": {},
      "services": [
        {
          "name": "kubernetes-dashboard",
          "target_interface": "HTTP /*",
          "operation_type": "http_proxy",
          "target_repo": "kubernetes/dashboard",
          "conditions": [
            "Always; request must include Portal-Authorization header"
          ],
          "operations": [
            {
              "operation": "ReverseProxy.ServeHTTP",
              "trigger": "Forward request after copying Portal-Authorization to Authorization",
              "conditions": [
                "Always"
              ],
              "implementation": "service/cluster/k8s.go:42"
            }
          ]
        }
      ]
    },
    "ClusterProxyService.KubernetesDashboardProxyByNamespacedCluster": {
      "infrastructure": {},
      "services": [
        {
          "name": "kubernetes-dashboard",
          "target_interface": "HTTP /*",
          "operation_type": "http_proxy",
          "target_repo": "kubernetes/dashboard",
          "conditions": [
            "Always; request must include Portal-Authorization header"
          ],
          "operations": [
            {
              "operation": "ReverseProxy.ServeHTTP",
              "trigger": "Forward request after copying Portal-Authorization to Authorization",
              "conditions": [
                "Always"
              ],
              "implementation": "service/cluster/k8s.go:42"
            }
          ]
        }
      ]
    },
    "ClusterProxyService.PDProxyByClusterID": {
      "infrastructure": {
        "kubernetes": [
          {
            "operation": "GET Secret",
            "resource": "core/v1 Secret {cluster}-cluster-client-secret",
            "conditions": [
              "Always for TLS discovery; repeated again when clearcdcinfo needs PD security material"
            ],
            "implementation": "util/crypto.go:19"
          }
        ]
      },
      "services": [
        {
          "name": "pd",
          "target_interface": "HTTP /*",
          "operation_type": "http_proxy",
          "target_repo": "tikv/pd",
          "conditions": [
            "Always unless subpath contains clearcdcinfo, which executes a local workaround instead of proxying"
          ],
          "operations": [
            {
              "operation": "ReverseProxy.ServeHTTP",
              "trigger": "Forward arbitrary PD dashboard/API requests",
              "conditions": [
                "Normal proxy path"
              ],
              "implementation": "service/cluster/pd.go:110"
            },
            {
              "operation": "POST /dashboard/api/user/login",
              "trigger": "Fetch dashboard bearer token when subpath starts with dashboard and password query param is provided",
              "conditions": [
                "Path prefix dashboard"
              ],
              "implementation": "service/cluster/pd.go:146"
            }
          ]
        },
        {
          "name": "etcd",
          "target_interface": "CDCEtcdClient.ClearAllCDCInfo / RevokeAllLeases",
          "operation_type": "grpc_client",
          "target_repo": "go.etcd.io/etcd",
          "conditions": [
            "Only when subpath contains clearcdcinfo"
          ],
          "operations": [
            {
              "operation": "GetCaptureLeases; ClearAllCDCInfo; RevokeAllLeases",
              "trigger": "Purge TiCDC metadata stored in PD-backed etcd",
              "conditions": [
                "Path contains clearcdcinfo"
              ],
              "implementation": "service/cluster/pd.go:185"
            }
          ]
        },
        {
          "name": "pd",
          "target_interface": "GC.RemoveServiceGCSafepoint",
          "operation_type": "grpc_client",
          "target_repo": "tikv/pd",
          "conditions": [
            "Only when subpath contains clearcdcinfo"
          ],
          "operations": [
            {
              "operation": "RemoveServiceGCSafepoint",
              "trigger": "Remove TiCDC service safepoint after clearing CDC info",
              "conditions": [
                "Path contains clearcdcinfo"
              ],
              "implementation": "service/cluster/pd.go:203"
            }
          ]
        }
      ]
    },
    "ClusterProxyService.PDProxyByNamespacedCluster": {
      "infrastructure": {
        "kubernetes": [
          {
            "operation": "GET Secret",
            "resource": "core/v1 Secret {cluster}-cluster-client-secret",
            "conditions": [
              "Always for TLS discovery; repeated again when clearcdcinfo needs PD security material"
            ],
            "implementation": "util/crypto.go:19"
          }
        ]
      },
      "services": [
        {
          "name": "pd",
          "target_interface": "HTTP /*",
          "operation_type": "http_proxy",
          "target_repo": "tikv/pd",
          "conditions": [
            "Always unless subpath contains clearcdcinfo, which executes a local workaround instead of proxying"
          ],
          "operations": [
            {
              "operation": "ReverseProxy.ServeHTTP",
              "trigger": "Forward arbitrary PD dashboard/API requests",
              "conditions": [
                "Normal proxy path"
              ],
              "implementation": "service/cluster/pd.go:110"
            },
            {
              "operation": "POST /dashboard/api/user/login",
              "trigger": "Fetch dashboard bearer token when subpath starts with dashboard and password query param is provided",
              "conditions": [
                "Path prefix dashboard"
              ],
              "implementation": "service/cluster/pd.go:146"
            }
          ]
        },
        {
          "name": "etcd",
          "target_interface": "CDCEtcdClient.ClearAllCDCInfo / RevokeAllLeases",
          "operation_type": "grpc_client",
          "target_repo": "go.etcd.io/etcd",
          "conditions": [
            "Only when subpath contains clearcdcinfo"
          ],
          "operations": [
            {
              "operation": "GetCaptureLeases; ClearAllCDCInfo; RevokeAllLeases",
              "trigger": "Purge TiCDC metadata stored in PD-backed etcd",
              "conditions": [
                "Path contains clearcdcinfo"
              ],
              "implementation": "service/cluster/pd.go:185"
            }
          ]
        },
        {
          "name": "pd",
          "target_interface": "GC.RemoveServiceGCSafepoint",
          "operation_type": "grpc_client",
          "target_repo": "tikv/pd",
          "conditions": [
            "Only when subpath contains clearcdcinfo"
          ],
          "operations": [
            {
              "operation": "RemoveServiceGCSafepoint",
              "trigger": "Remove TiCDC service safepoint after clearing CDC info",
              "conditions": [
                "Path contains clearcdcinfo"
              ],
              "implementation": "service/cluster/pd.go:203"
            }
          ]
        }
      ]
    },
    "ClusterProxyService.PrometheusProxyByClusterID": {
      "infrastructure": {},
      "services": [
        {
          "name": "prometheus",
          "target_interface": "HTTP /*",
          "operation_type": "http_proxy",
          "target_repo": "prometheus/prometheus",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "ReverseProxy.ServeHTTP",
              "trigger": "Forward monitoring queries to {monitor}-prometheus",
              "conditions": [
                "Always"
              ],
              "implementation": "service/cluster/prom.go:34"
            }
          ]
        }
      ]
    },
    "ClusterProxyService.PrometheusProxyByNamespacedCluster": {
      "infrastructure": {},
      "services": [
        {
          "name": "prometheus",
          "target_interface": "HTTP /*",
          "operation_type": "http_proxy",
          "target_repo": "prometheus/prometheus",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "ReverseProxy.ServeHTTP",
              "trigger": "Forward monitoring queries to {monitor}-prometheus",
              "conditions": [
                "Always"
              ],
              "implementation": "service/cluster/prom.go:34"
            }
          ]
        }
      ]
    },
    "ClusterProxyService.PrometheusProxyByMonitorName": {
      "infrastructure": {},
      "services": [
        {
          "name": "prometheus",
          "target_interface": "HTTP /*",
          "operation_type": "http_proxy",
          "target_repo": "prometheus/prometheus",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "ReverseProxy.ServeHTTP",
              "trigger": "Forward monitoring queries to the explicitly addressed TidbMonitor-backed Prometheus Service",
              "conditions": [
                "Always"
              ],
              "implementation": "service/cluster/prom.go:34"
            }
          ]
        }
      ]
    },
    "ClusterProxyService.TiFlashProxyByClusterID": {
      "infrastructure": {
        "kubernetes": [
          {
            "operation": "GET Secret",
            "resource": "core/v1 Secret {cluster}-cluster-client-secret",
            "conditions": [
              "When TiFlash endpoint is TLS-enabled"
            ],
            "implementation": "util/crypto.go:19"
          }
        ]
      },
      "services": [
        {
          "name": "tiflash",
          "target_interface": "HTTP /*",
          "operation_type": "http_proxy",
          "target_repo": "pingcap/tiflash",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "ReverseProxy.ServeHTTP",
              "trigger": "Forward TiFlash HTTP traffic to {cluster}-tiflash-peer",
              "conditions": [
                "Always"
              ],
              "implementation": "service/cluster/tiflash.go:46"
            }
          ]
        }
      ]
    },
    "ClusterProxyService.TiFlashProxyByNamespacedCluster": {
      "infrastructure": {
        "kubernetes": [
          {
            "operation": "GET Secret",
            "resource": "core/v1 Secret {cluster}-cluster-client-secret",
            "conditions": [
              "When TiFlash endpoint is TLS-enabled"
            ],
            "implementation": "util/crypto.go:19"
          }
        ]
      },
      "services": [
        {
          "name": "tiflash",
          "target_interface": "HTTP /*",
          "operation_type": "http_proxy",
          "target_repo": "pingcap/tiflash",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "ReverseProxy.ServeHTTP",
              "trigger": "Forward TiFlash HTTP traffic to {cluster}-tiflash-peer",
              "conditions": [
                "Always"
              ],
              "implementation": "service/cluster/tiflash.go:46"
            }
          ]
        }
      ]
    },
    "ClusterProxyService.TerminalProxyByClusterID": {
      "infrastructure": {
        "kubernetes": [
          {
            "operation": "GET Service / GET Endpoints",
            "resource": "core/v1 Service and Endpoints for {cluster}-tidb or shell service",
            "conditions": [
              "Always during readiness checks"
            ],
            "implementation": "service/gotty/gotty.go:112"
          },
          {
            "operation": "GET/DELETE/CREATE Job",
            "resource": "batch/v1 Job shell-{cluster}-{userId}-{user}",
            "conditions": [
              "Whenever terminal helper must be provisioned or recycled"
            ],
            "implementation": "service/gotty/gotty.go:185"
          },
          {
            "operation": "CREATE Service",
            "resource": "core/v1 Service shell-{cluster}-{userId}-{user}",
            "conditions": [
              "When terminal helper Service does not already exist"
            ],
            "implementation": "service/gotty/gotty.go:239"
          }
        ]
      },
      "services": [
        {
          "name": "gotty",
          "target_interface": "HTTP /*",
          "operation_type": "http_proxy",
          "target_repo": "external/gotty",
          "conditions": [
            "Always after the helper job becomes ready"
          ],
          "operations": [
            {
              "operation": "HTTP GET readiness probe; ReverseProxy.ServeHTTP",
              "trigger": "Wait for gotty to boot, then proxy browser traffic to the helper Service",
              "conditions": [
                "Always"
              ],
              "implementation": "service/gotty/gotty.go:84"
            }
          ]
        },
        {
          "name": "tidb",
          "target_interface": "MySQL terminal session",
          "operation_type": "job_bootstrap",
          "target_repo": "pingcap/tidb",
          "conditions": [
            "Preferred path when {cluster}-tidb Service can be resolved"
          ],
          "operations": [
            {
              "operation": "Provision gotty job with ti://user@{tidb-service}:4000/ DSN",
              "trigger": "Create interactive SQL shell against the cluster-local TiDB Service",
              "conditions": [
                "runGotty succeeds"
              ],
              "implementation": "service/gotty/gotty.go:156"
            }
          ]
        },
        {
          "name": "tidb-gateway-inner",
          "target_interface": "MySQL terminal session",
          "operation_type": "job_bootstrap",
          "target_repo": "tidbcloud/clusterproxy",
          "conditions": [
            "Fallback path for serverless/shared-namespace routing"
          ],
          "operations": [
            {
              "operation": "Provision gotty job with ti://user@tidb-gateway-inner.tidb-admin.svc.cluster.local:4000/ DSN",
              "trigger": "Create shell via shared gateway when direct TiDB Service path is unavailable",
              "conditions": [
                "runGotty returns false and runGottyWithGW succeeds"
              ],
              "implementation": "service/gotty/gotty.go:93"
            }
          ]
        }
      ]
    },
    "ClusterProxyService.TerminalProxyByNamespacedCluster": {
      "infrastructure": {
        "kubernetes": [
          {
            "operation": "GET Service / GET Endpoints",
            "resource": "core/v1 Service and Endpoints for {cluster}-tidb or shell service",
            "conditions": [
              "Always during readiness checks"
            ],
            "implementation": "service/gotty/gotty.go:112"
          },
          {
            "operation": "GET/DELETE/CREATE Job",
            "resource": "batch/v1 Job shell-{cluster}-{userId}-{user}",
            "conditions": [
              "Whenever terminal helper must be provisioned or recycled"
            ],
            "implementation": "service/gotty/gotty.go:185"
          },
          {
            "operation": "CREATE Service",
            "resource": "core/v1 Service shell-{cluster}-{userId}-{user}",
            "conditions": [
              "When terminal helper Service does not already exist"
            ],
            "implementation": "service/gotty/gotty.go:239"
          }
        ]
      },
      "services": [
        {
          "name": "gotty",
          "target_interface": "HTTP /*",
          "operation_type": "http_proxy",
          "target_repo": "external/gotty",
          "conditions": [
            "Always after the helper job becomes ready"
          ],
          "operations": [
            {
              "operation": "HTTP GET readiness probe; ReverseProxy.ServeHTTP",
              "trigger": "Wait for gotty to boot, then proxy browser traffic to the helper Service",
              "conditions": [
                "Always"
              ],
              "implementation": "service/gotty/gotty.go:84"
            }
          ]
        },
        {
          "name": "tidb",
          "target_interface": "MySQL terminal session",
          "operation_type": "job_bootstrap",
          "target_repo": "pingcap/tidb",
          "conditions": [
            "Preferred path when {cluster}-tidb Service can be resolved"
          ],
          "operations": [
            {
              "operation": "Provision gotty job with ti://user@{tidb-service}:4000/ DSN",
              "trigger": "Create interactive SQL shell against the cluster-local TiDB Service",
              "conditions": [
                "runGotty succeeds"
              ],
              "implementation": "service/gotty/gotty.go:156"
            }
          ]
        },
        {
          "name": "tidb-gateway-inner",
          "target_interface": "MySQL terminal session",
          "operation_type": "job_bootstrap",
          "target_repo": "tidbcloud/clusterproxy",
          "conditions": [
            "Fallback path for serverless/shared-namespace routing"
          ],
          "operations": [
            {
              "operation": "Provision gotty job with ti://user@tidb-gateway-inner.tidb-admin.svc.cluster.local:4000/ DSN",
              "trigger": "Create shell via shared gateway when direct TiDB Service path is unavailable",
              "conditions": [
                "runGotty returns false and runGottyWithGW succeeds"
              ],
              "implementation": "service/gotty/gotty.go:93"
            }
          ]
        }
      ]
    },
    "TiDBService.AuditCheckByClusterID": {
      "infrastructure": {
        "aws": [
          {
            "operation": "STS AssumeRole + S3 PutObject",
            "target": "req.audit.roleArn and req.audit.bucketUrl",
            "conditions": [
              "Only when bucketUrl scheme=s3"
            ],
            "implementation": "service/tidb/audit.go:115"
          }
        ],
        "gcp": [
          {
            "operation": "Impersonate service account + GCS object write",
            "target": "req.serviceAccount and req.audit.bucketUrl",
            "conditions": [
              "Only when bucketUrl scheme=gcs"
            ],
            "implementation": "service/tidb/audit.go:156"
          }
        ]
      },
      "services": []
    },
    "TiDBService.AuditCheckByNamespacedCluster": {
      "infrastructure": {
        "aws": [
          {
            "operation": "STS AssumeRole + S3 PutObject",
            "target": "req.audit.roleArn and req.audit.bucketUrl",
            "conditions": [
              "Only when bucketUrl scheme=s3"
            ],
            "implementation": "service/tidb/audit.go:115"
          }
        ],
        "gcp": [
          {
            "operation": "Impersonate service account + GCS object write",
            "target": "req.serviceAccount and req.audit.bucketUrl",
            "conditions": [
              "Only when bucketUrl scheme=gcs"
            ],
            "implementation": "service/tidb/audit.go:156"
          }
        ]
      },
      "services": []
    },
    "TiDBService.CreateAdminByClusterID": {
      "infrastructure": {
        "kubernetes": [
          {
            "operation": "GET Secret",
            "resource": "core/v1 Secret {cluster}-cluster-client-secret",
            "conditions": [
              "When TLS is enabled for the target cluster"
            ],
            "implementation": "util/crypto.go:19"
          }
        ]
      },
      "services": [
        {
          "name": "tidb",
          "target_interface": "MySQL ALTER USER cloud_admin / SELECT 1 / FLUSH PRIVILEGES",
          "operation_type": "mysql_client",
          "target_repo": "pingcap/tidb",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "ALTER USER cloud_admin IDENTIFIED BY ...",
              "trigger": "Set the initial cloud_admin password",
              "conditions": [
                "Always"
              ],
              "implementation": "service/tidb/create_admin.go:99"
            },
            {
              "operation": "SELECT 1",
              "trigger": "Verify idempotent success path after ALTER USER error",
              "conditions": [
                "Only when ALTER USER fails and a second cloud_admin login succeeds"
              ],
              "implementation": "service/tidb/create_admin.go:104"
            },
            {
              "operation": "FLUSH PRIVILEGES",
              "trigger": "Persist cloud_admin password update",
              "conditions": [
                "After ALTER USER succeeds"
              ],
              "implementation": "service/tidb/create_admin.go:111"
            }
          ]
        }
      ]
    },
    "TiDBService.CreateAdminByNamespacedCluster": {
      "infrastructure": {
        "kubernetes": [
          {
            "operation": "GET Secret",
            "resource": "core/v1 Secret {cluster}-cluster-client-secret",
            "conditions": [
              "When TLS is enabled for the target cluster"
            ],
            "implementation": "util/crypto.go:19"
          }
        ]
      },
      "services": [
        {
          "name": "tidb",
          "target_interface": "MySQL ALTER USER cloud_admin / SELECT 1 / FLUSH PRIVILEGES",
          "operation_type": "mysql_client",
          "target_repo": "pingcap/tidb",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "ALTER USER cloud_admin IDENTIFIED BY ...",
              "trigger": "Set the initial cloud_admin password",
              "conditions": [
                "Always"
              ],
              "implementation": "service/tidb/create_admin.go:99"
            },
            {
              "operation": "SELECT 1",
              "trigger": "Verify idempotent success path after ALTER USER error",
              "conditions": [
                "Only when ALTER USER fails and a second cloud_admin login succeeds"
              ],
              "implementation": "service/tidb/create_admin.go:104"
            },
            {
              "operation": "FLUSH PRIVILEGES",
              "trigger": "Persist cloud_admin password update",
              "conditions": [
                "After ALTER USER succeeds"
              ],
              "implementation": "service/tidb/create_admin.go:111"
            }
          ]
        }
      ]
    },
    "TiDBService.ExecuteByClusterID": {
      "infrastructure": {
        "kubernetes": [
          {
            "operation": "GET Secret",
            "resource": "core/v1 Secret {cluster}-cluster-client-secret",
            "conditions": [
              "When TLS is enabled for the target cluster"
            ],
            "implementation": "util/crypto.go:19"
          }
        ]
      },
      "services": [
        {
          "name": "tidb",
          "target_interface": "MySQL Exec",
          "operation_type": "mysql_client",
          "target_repo": "pingcap/tidb",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "BEGIN; EXEC; COMMIT",
              "trigger": "Run query, batch queries, or SET GLOBAL TIDB_GC_LIFE_TIME",
              "conditions": [
                "Always"
              ],
              "implementation": "service/tidb/execute.go:79"
            }
          ]
        },
        {
          "name": "tidb-gateway-inner",
          "target_interface": "MySQL Exec",
          "operation_type": "mysql_client",
          "target_repo": "tidbcloud/clusterproxy",
          "conditions": [
            "Only when direct {cluster}-tidb Service is absent and connectGateway is used"
          ],
          "operations": [
            {
              "operation": "BEGIN; EXEC; COMMIT",
              "trigger": "Serverless fallback path for SQL execution",
              "conditions": [
                "Direct TiDB Service missing"
              ],
              "implementation": "pkg/k8s/tidb/connect.go:160"
            }
          ]
        }
      ]
    },
    "TiDBService.ExecuteByNamespacedCluster": {
      "infrastructure": {
        "kubernetes": [
          {
            "operation": "GET Secret",
            "resource": "core/v1 Secret {cluster}-cluster-client-secret",
            "conditions": [
              "When TLS is enabled for the target cluster"
            ],
            "implementation": "util/crypto.go:19"
          }
        ]
      },
      "services": [
        {
          "name": "tidb",
          "target_interface": "MySQL Exec",
          "operation_type": "mysql_client",
          "target_repo": "pingcap/tidb",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "BEGIN; EXEC; COMMIT",
              "trigger": "Run query, batch queries, or SET GLOBAL TIDB_GC_LIFE_TIME",
              "conditions": [
                "Always"
              ],
              "implementation": "service/tidb/execute.go:79"
            }
          ]
        },
        {
          "name": "tidb-gateway-inner",
          "target_interface": "MySQL Exec",
          "operation_type": "mysql_client",
          "target_repo": "tidbcloud/clusterproxy",
          "conditions": [
            "Only when direct {cluster}-tidb Service is absent and connectGateway is used"
          ],
          "operations": [
            {
              "operation": "BEGIN; EXEC; COMMIT",
              "trigger": "Serverless fallback path for SQL execution",
              "conditions": [
                "Direct TiDB Service missing"
              ],
              "implementation": "pkg/k8s/tidb/connect.go:160"
            }
          ]
        }
      ]
    },
    "TiDBService.QueryByClusterID": {
      "infrastructure": {
        "kubernetes": [
          {
            "operation": "GET Secret",
            "resource": "core/v1 Secret {cluster}-cluster-client-secret",
            "conditions": [
              "When TLS is enabled for the target cluster"
            ],
            "implementation": "util/crypto.go:19"
          }
        ]
      },
      "services": [
        {
          "name": "tidb",
          "target_interface": "MySQL Query",
          "operation_type": "mysql_client",
          "target_repo": "pingcap/tidb",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "BEGIN; QUERY; COMMIT",
              "trigger": "Run user SQL or SHOW MASTER STATUS and convert rows to JSON",
              "conditions": [
                "Always"
              ],
              "implementation": "service/tidb/query.go:80"
            }
          ]
        },
        {
          "name": "tidb-gateway-inner",
          "target_interface": "MySQL Query",
          "operation_type": "mysql_client",
          "target_repo": "tidbcloud/clusterproxy",
          "conditions": [
            "Only when direct {cluster}-tidb Service is absent and connectGateway is used"
          ],
          "operations": [
            {
              "operation": "BEGIN; QUERY; COMMIT",
              "trigger": "Serverless fallback path for SQL query",
              "conditions": [
                "Direct TiDB Service missing"
              ],
              "implementation": "pkg/k8s/tidb/connect.go:160"
            }
          ]
        }
      ]
    },
    "TiDBService.QueryByNamespacedCluster": {
      "infrastructure": {
        "kubernetes": [
          {
            "operation": "GET Secret",
            "resource": "core/v1 Secret {cluster}-cluster-client-secret",
            "conditions": [
              "When TLS is enabled for the target cluster"
            ],
            "implementation": "util/crypto.go:19"
          }
        ]
      },
      "services": [
        {
          "name": "tidb",
          "target_interface": "MySQL Query",
          "operation_type": "mysql_client",
          "target_repo": "pingcap/tidb",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "BEGIN; QUERY; COMMIT",
              "trigger": "Run user SQL or SHOW MASTER STATUS and convert rows to JSON",
              "conditions": [
                "Always"
              ],
              "implementation": "service/tidb/query.go:80"
            }
          ]
        },
        {
          "name": "tidb-gateway-inner",
          "target_interface": "MySQL Query",
          "operation_type": "mysql_client",
          "target_repo": "tidbcloud/clusterproxy",
          "conditions": [
            "Only when direct {cluster}-tidb Service is absent and connectGateway is used"
          ],
          "operations": [
            {
              "operation": "BEGIN; QUERY; COMMIT",
              "trigger": "Serverless fallback path for SQL query",
              "conditions": [
                "Direct TiDB Service missing"
              ],
              "implementation": "pkg/k8s/tidb/connect.go:160"
            }
          ]
        }
      ]
    }
  },
  "notes": [
    "All routed methods except HealthService.Readyz are wrapped by auth.Middleware and metrics.Middleware; in non-dev mode the JWT middleware validates each request after loading JWKS from Auth0 during startup.",
    "All *ByNamespacedCluster methods also depend on resolve.ByNamespacedName.Resolve; on TidbMonitor cache miss it calls PingcapV1alpha1().TidbMonitors(namespace).List(...) to populate cl.MonitorName.",
    "ClusterProxyService.TiCDCProxyByClusterID additionally depends on resolve.ByID.Resolve probing {namespace}/db-ticdc-peer to decide whether the runtime cluster name should stay db or switch to db-cdc.",
    "This file replaces the previous provides/consumes summary with method-level dependencies derived from handler implementations."
  ]
}