{
  "repo": "tidbcloud/config-service",
  "binary": "config-service",
  "binary_path": "app/config-service/main.go",
  "dependencies": {
    "ConfigServiceLifecycle.LoadFlagsAndLogger": {
      "infrastructure": {
        "runtime_flags": [
          {
            "operation": "PARSE FLAGS",
            "target": "metrics-addr, enable-leader-election, leader-election-namespace, account-svc-host, core-svc-host, gardener-project, config-file, log-level, activity, activity-hub, source-key, clinic, clinic-token",
            "conditions": [
              "Always at process start"
            ],
            "implementation": "app/config-service/main.go:79-101"
          }
        ]
      },
      "services": []
    },
    "ConfigServiceLifecycle.ParsePreConfig": {
      "infrastructure": {
        "filesystem": [
          {
            "operation": "READ FILE",
            "target": "preconfig yaml file",
            "conditions": [
              "--config-file is set or defaults to ./example/preconfig.yaml"
            ],
            "implementation": "app/config-service/main.go:106-108"
          }
        ]
      },
      "services": []
    },
    "ConfigServiceLifecycle.WarmupAuth0Tokens": {
      "infrastructure": {
        "environment": [
          {
            "operation": "READ ENV",
            "target": "AUTH0_DOMAIN, AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET, AUTH0_AUDIENCE, PROXY_AUTH0_CLIENT_ID, PROXY_AUTH0_CLIENT_SECRET, PROXY_AUTH0_AUDIENCE",
            "conditions": [
              "Always during startup"
            ],
            "implementation": "app/config-service/main.go:110-122"
          }
        ]
      },
      "services": [
        {
          "name": "auth0",
          "target_interface": "POST /oauth/token",
          "operation_type": "http_post",
          "target_repo": "auth0",
          "conditions": [
            "Always during startup",
            "Both central and PD proxy credentials must succeed or the process panics"
          ],
          "operations": [
            {
              "operation": "FETCH CLIENT TOKEN",
              "trigger": "Warm up the token cache for central-service access",
              "conditions": [
                "Always"
              ],
              "implementation": "app/config-service/main.go:119-122 -> pkg/auth/token_cache.go:25-69"
            },
            {
              "operation": "FETCH CLIENT TOKEN",
              "trigger": "Warm up the token cache for PD proxy access",
              "conditions": [
                "Always"
              ],
              "implementation": "app/config-service/main.go:120-122 -> pkg/auth/token_cache.go:25-69"
            }
          ]
        }
      ]
    },
    "ConfigServiceLifecycle.CreateManager": {
      "infrastructure": {
        "kubernetes_api": [
          {
            "operation": "BUILD MANAGER CLIENTS",
            "target": "controller-runtime manager and metrics listener",
            "conditions": [
              "Always after Auth0 warmup succeeds"
            ],
            "implementation": "app/config-service/main.go:126-136"
          },
          {
            "operation": "LEADER ELECTION",
            "target": "leader-election configmap in the configured namespace",
            "conditions": [
              "--enable-leader-election=true"
            ],
            "implementation": "app/config-service/main.go:127-135"
          }
        ]
      },
      "services": []
    },
    "ConfigServiceLifecycle.BuildBaseClusterClient": {
      "infrastructure": {
        "kubernetes_api": [
          {
            "operation": "CREATE DIRECT CLIENT",
            "target": "base cluster controller-runtime client",
            "conditions": [
              "Always"
            ],
            "implementation": "app/config-service/main.go:143-147"
          }
        ]
      },
      "services": []
    },
    "ConfigServiceLifecycle.BuildGardenerClientSet": {
      "infrastructure": {
        "kubernetes_api": [
          {
            "operation": "GET SECRET",
            "target": "garden/garden-kubeconfig-for-admin",
            "conditions": [
              "Always"
            ],
            "implementation": "gardener/util.go:22-37"
          },
          {
            "operation": "CREATE CLIENTSET",
            "target": "garden cluster kubernetes clientset",
            "conditions": [
              "The secret exists and kubeconfig can be parsed"
            ],
            "implementation": "gardener/util.go:22-37"
          }
        ]
      },
      "services": []
    },
    "ConfigServiceLifecycle.BuildInfraAPIClient": {
      "infrastructure": {
        "kubernetes_api": [
          {
            "operation": "GET SECRET",
            "target": "gitops/config-service-infra-kubeconfig",
            "conditions": [
              "Always"
            ],
            "implementation": "pkg/utils/infraapi_util.go:12-38"
          },
          {
            "operation": "CREATE DIRECT CLIENT",
            "target": "infra-api controller-runtime client",
            "conditions": [
              "The secret exists and kubeconfig can be parsed"
            ],
            "implementation": "pkg/utils/infraapi_util.go:12-38"
          }
        ]
      },
      "services": []
    },
    "ConfigServiceLifecycle.InitEventClient": {
      "infrastructure": {},
      "services": [
        {
          "name": "activity-hub",
          "target_interface": "POST /activity",
          "operation_type": "http_client_init",
          "target_repo": "tidbcloud/activity-hub",
          "conditions": [
            "--activity=true"
          ],
          "operations": [
            {
              "operation": "INITIALIZE GLOBAL CLIENT",
              "trigger": "Enable optional GitOps event sending",
              "conditions": [
                "activityHub endpoint, source key, and optional clinic settings are accepted by InitEventClient"
              ],
              "implementation": "app/config-service/main.go:155-159 -> pkg/clinic_event/event.go:23-40"
            }
          ]
        }
      ]
    },
    "ConfigServiceLifecycle.BuildTenantLister": {
      "infrastructure": {},
      "services": [
        {
          "name": "account-service",
          "target_interface": "GET /api/v1/admin/orgs?brief=true&no-limit=true",
          "operation_type": "http_client",
          "target_repo": "tidbcloud/account",
          "conditions": [
            "Used later by dead-code tenant watcher helpers, not by the current runtime startup path"
          ],
          "operations": [
            {
              "operation": "BUILD CLIENT",
              "trigger": "Prepare tenant lister client from account-svc-host",
              "conditions": [
                "Always during startup"
              ],
              "implementation": "app/config-service/main.go:169 -> pkg/tenant/tenant.go:19-26 -> pkg/central/admin_client.go:47-64"
            }
          ]
        }
      ]
    },
    "ConfigServiceLifecycle.BuildClusterLister": {
      "infrastructure": {},
      "services": [
        {
          "name": "core-service",
          "target_interface": "GET /api/v1/admin/orgs/{orgId}/clusters and GET /api/v1/admin/clusters4configservice",
          "operation_type": "http_client",
          "target_repo": "tidbcloud/core-svc",
          "conditions": [
            "Always during runtime once the alive-cluster watcher starts"
          ],
          "operations": [
            {
              "operation": "BUILD CLIENT",
              "trigger": "Prepare core-service-backed cluster lister",
              "conditions": [
                "Always during startup"
              ],
              "implementation": "app/config-service/main.go:170 -> pkg/cluster/cluster.go:111-124 -> pkg/central/admin_client.go:47-64"
            }
          ]
        }
      ]
    },
    "ConfigServiceLifecycle.RegisterClusterConfigController": {
      "infrastructure": {},
      "services": []
    },
    "ConfigServiceLifecycle.RegisterHTTPRoutes": {
      "infrastructure": {},
      "services": []
    },
    "ConfigServiceLifecycle.StartHTTPServer": {
      "infrastructure": {},
      "services": []
    },
    "ConfigServiceLifecycle.StartManager": {
      "infrastructure": {
        "kubernetes_api": [
          {
            "operation": "RUN MANAGER",
            "target": "controller-runtime manager runtime and metrics listener",
            "conditions": [
              "Always after route registration and HTTP goroutine launch"
            ],
            "implementation": "app/config-service/main.go:187-193"
          }
        ]
      },
      "services": []
    },
    "ConfigServiceHTTP.Healthz": {
      "infrastructure": {},
      "services": []
    },
    "ConfigServiceHTTP.ClusterConfiguration": {
      "infrastructure": {
        "kubernetes_api": [
          {
            "operation": "LIST/GET",
            "target": "ClusterConfig CRs from the manager client cache",
            "conditions": [
              "Request JSON decodes successfully",
              "tenantId is present"
            ],
            "implementation": "server/server.go:32-107 -> pkg/utils/cluster_config_util.go:13-52"
          },
          {
            "operation": "LIST",
            "target": "infra-api Cluster and Provider CRs via the dedicated infra-api client",
            "conditions": [
              "clusterId is present",
              "The cluster exists in infra-api"
            ],
            "implementation": "server/server.go:79-101 -> pkg/configeval/clusterconfig_eval_helper.go:36-70 -> pkg/configeval/clusterconfig_eval.go:42-89"
          }
        ]
      },
      "services": []
    },
    "ConfigServiceHTTP.BackupConfiguration": {
      "infrastructure": {
        "kubernetes_api": [
          {
            "operation": "LIST/GET",
            "target": "ClusterConfig CRs from the manager client cache",
            "conditions": [
              "Request JSON decodes successfully",
              "tenantId is present"
            ],
            "implementation": "server/br_handler.go:37-73 -> server/server.go:79-107 -> pkg/utils/cluster_config_util.go:13-52"
          },
          {
            "operation": "LIST",
            "target": "infra-api Cluster and Provider CRs via the dedicated infra-api client",
            "conditions": [
              "clusterId is present",
              "The cluster exists in infra-api"
            ],
            "implementation": "server/br_handler.go:49-57 -> server/server.go:79-101 -> pkg/configeval/clusterconfig_eval_helper.go:36-70 -> pkg/configeval/clusterconfig_eval.go:42-89"
          }
        ]
      },
      "services": []
    },
    "ConfigServiceHTTP.RestoreConfiguration": {
      "infrastructure": {
        "kubernetes_api": [
          {
            "operation": "LIST/GET",
            "target": "ClusterConfig CRs from the manager client cache",
            "conditions": [
              "Request JSON decodes successfully",
              "tenantId is present"
            ],
            "implementation": "server/br_handler.go:37-73 -> server/server.go:79-107 -> pkg/utils/cluster_config_util.go:13-52"
          },
          {
            "operation": "LIST",
            "target": "infra-api Cluster and Provider CRs via the dedicated infra-api client",
            "conditions": [
              "clusterId is present",
              "The cluster exists in infra-api"
            ],
            "implementation": "server/br_handler.go:49-57 -> server/server.go:79-101 -> pkg/configeval/clusterconfig_eval_helper.go:36-70 -> pkg/configeval/clusterconfig_eval.go:42-89"
          }
        ]
      },
      "services": []
    },
    "ClusterConfigWatcher.Start": {
      "infrastructure": {},
      "services": []
    },
    "ClusterConfigWatcher.SyncAliveClusters": {
      "infrastructure": {},
      "services": [
        {
          "name": "core-service",
          "target_interface": "GET /api/v1/admin/clusters4configservice",
          "operation_type": "http_get",
          "target_repo": "tidbcloud/core-svc",
          "conditions": [
            "Every 2 minutes while the manager context is alive",
            "The runnable is leader-elected"
          ],
          "operations": [
            {
              "operation": "LIST ALIVE CLUSTERS",
              "trigger": "Fetch all active non-devtier dedicated clusters to reconcile",
              "conditions": [
                "Always on each watcher tick"
              ],
              "implementation": "controllers/clusterconfig_controller.go:131-158 -> pkg/cluster/cluster.go:167-192 -> pkg/central/admin_client.go:94-100"
            }
          ]
        },
        {
          "name": "auth0",
          "target_interface": "POST /oauth/token",
          "operation_type": "http_post",
          "target_repo": "auth0",
          "conditions": [
            "Whenever the cached core-service token is missing or expired"
          ],
          "operations": [
            {
              "operation": "FETCH CLIENT TOKEN",
              "trigger": "Authenticate the core-service API call",
              "conditions": [
                "Token cache miss or expiry"
              ],
              "implementation": "pkg/central/admin_client.go:147-165 via Auth0Authenticator.Auth"
            }
          ]
        },
        {
          "name": "gardener-base-cluster",
          "target_interface": "Secret and Service reads used to reach shoot proxy endpoints",
          "operation_type": "kubernetes_api",
          "target_repo": "tidbcloud/config-service",
          "conditions": [
            "Only when a shoot clientset is not already cached for the resolved shoot hash"
          ],
          "operations": [
            {
              "operation": "GET SECRET",
              "trigger": "Load {shoot}.kubeconfig from the garden-{project} namespace",
              "conditions": [
                "Cache miss on loadShootClientSet"
              ],
              "implementation": "pkg/cluster/cluster.go:194-206, 560-569"
            },
            {
              "operation": "GET SERVICE",
              "trigger": "Resolve the dbaas-proxy load balancer endpoint for PD proxy traffic",
              "conditions": [
                "The shoot kubeconfig was loaded successfully"
              ],
              "implementation": "pkg/cluster/cluster.go:579-595"
            }
          ]
        }
      ]
    },
    "ClusterConfigWatcher.ReconcileAliveCluster": {
      "infrastructure": {
        "kubernetes_api": [
          {
            "operation": "GET/UPDATE",
            "target": "TidbCluster resource in the target shoot cluster",
            "conditions": [
              "Cluster status contains NORMAL",
              "shoot clientset was successfully created or reused"
            ],
            "implementation": "controllers/clusterconfig_controller.go:182-248 -> pkg/cluster/cluster.go:217-337"
          },
          {
            "operation": "LIST/GET",
            "target": "ClusterConfig CRs from the manager cache",
            "conditions": [
              "Cluster status contains NORMAL"
            ],
            "implementation": "controllers/clusterconfig_controller.go:193-197 -> pkg/utils/cluster_config_util.go:13-52"
          },
          {
            "operation": "LIST",
            "target": "infra-api Cluster and Provider CRs",
            "conditions": [
              "ClusterConfig evaluation is attempted for the tenant and cluster ids"
            ],
            "implementation": "controllers/clusterconfig_controller.go:199-211 -> pkg/configeval/clusterconfig_eval_helper.go:36-70 -> pkg/configeval/clusterconfig_eval.go:42-89"
          }
        ]
      },
      "services": [
        {
          "name": "pd-proxy",
          "target_interface": "GET/POST https://{proxy}/proxy/cluster/{id}/pd/pd/api/v1/config",
          "operation_type": "https_request",
          "target_repo": "tidbcloud/dbaas-proxy",
          "conditions": [
            "PD config diff exists after MergeMaps(current, desired)",
            "dryrun is false for POST",
            "PD GET failures are downgraded to warning and skip update"
          ],
          "operations": [
            {
              "operation": "GET CONFIG",
              "trigger": "Fetch current PD cluster config before merge",
              "conditions": [
                "Always before deciding whether to update PD"
              ],
              "implementation": "pkg/cluster/cluster.go:338-352 -> pkg/cluster/pd_proxy.go:13-16 -> pkg/pdapi/pdapi.go:46-70"
            },
            {
              "operation": "POST CONFIG",
              "trigger": "Apply merged PD config through the PD proxy",
              "conditions": [
                "Merged PD config differs from current config",
                "dryrun is false"
              ],
              "implementation": "pkg/cluster/cluster.go:353-368 -> pkg/pdapi/pdapi.go:72-102"
            }
          ]
        },
        {
          "name": "auth0",
          "target_interface": "POST /oauth/token",
          "operation_type": "http_post",
          "target_repo": "auth0",
          "conditions": [
            "Whenever the cached PD proxy token is missing or expired"
          ],
          "operations": [
            {
              "operation": "FETCH CLIENT TOKEN",
              "trigger": "Authenticate the PD proxy GET/POST requests",
              "conditions": [
                "Token cache miss or expiry for the proxy client id"
              ],
              "implementation": "pkg/pdapi/pdapi.go:17-24 -> pkg/auth/token_cache.go:25-69"
            }
          ]
        },
        {
          "name": "activity-hub",
          "target_interface": "POST /activity",
          "operation_type": "http_post",
          "target_repo": "tidbcloud/activity-hub",
          "conditions": [
            "--activity=true",
            "Either PD config or TidbCluster resource update actually changed state"
          ],
          "operations": [
            {
              "operation": "SEND EVENT",
              "trigger": "Emit GitOps change events after successful config application",
              "conditions": [
                "SendEvent(...) is reached and global event client is initialized"
              ],
              "implementation": "controllers/clusterconfig_controller.go:220-245 -> pkg/cluster/cluster.go:370-421 -> pkg/clinic_event/event.go:57-95"
            },
            {
              "operation": "REGISTER CLINIC JOB",
              "trigger": "Create clinic follow-up jobs for apply events",
              "conditions": [
                "Event name ends with apply",
                "clinic endpoint is configured"
              ],
              "implementation": "pkg/clinic_event/event.go:87-125"
            }
          ]
        }
      ]
    }
  },
  "notes": [
    "The HTTP request path does not call account-service, core-service, or PD directly; those remote calls happen in startup token warmup and in the background alive-cluster watcher.",
    "The tenant watcher helpers exist in source but are dead in the current runtime because Start() only launches getAliveClusterWatcher().",
    "PD updates are split into GET current config, merge with desired cluster config, and conditional POST only when a real diff remains and dryrun is false."
  ]
}