{ "repo": "tidbcloud/core-portal", "binary": "server", "binary_path": "cmd/server/main.go", "dependencies": { "ServerLifecycle.ParseFlags": { "infrastructure": {}, "services": [] }, "ServerLifecycle.InitConfig": { "infrastructure": { "filesystem": { "conditions": ["Always before any runtime initialization"], "operations": [ { "operation": "READ FILE", "trigger": "Load the main config YAML from the `-config-path` flag before logger, DB, or listener setup begins", "conditions": ["configPath resolves to a readable file"], "implementation": "config2.InitConfig(configPath)" } ] } }, "services": [] }, "ServerLifecycle.SetupLoggerAndSentry": { "infrastructure": {}, "services": [] }, "ServerLifecycle.InitK8sAndInfraClients": { "infrastructure": { "kubernetes_api": { "conditions": ["Always after config initialization"], "operations": [ { "operation": "LOAD REST CONFIG", "trigger": "Resolve the gardener/base cluster kubeconfig from either in-cluster credentials or `GardenerConfig.KubeConfigPath`", "conditions": ["Use `rest.InClusterConfig()` when `GardenerConfig.KubeConfigPath == \"\"`", "Otherwise use `clientcmd.BuildConfigFromFlags(\"\", kubeConfig)`"], "implementation": "rest.InClusterConfig() / clientcmd.BuildConfigFromFlags(\"\", kubeConfig)" }, { "operation": "CREATE CLIENTS", "trigger": "Build the base Kubernetes clientset, the controller-runtime client, and the infra-api facade used by cluster and admin flows", "conditions": ["Always after the REST config is available"], "implementation": "kubernetes.NewForConfig(cfg); client.New(cfg, client.Options{Scheme: scheme}); api.InitInfraAPI(baseKubeCli)" } ] } }, "services": [] }, "ServerLifecycle.InitDatabaseAndSecrets": { "infrastructure": { "mysql": { "conditions": ["Always during startup"], "operations": [ { "operation": "CONNECT", "trigger": "Initialize the global MySQL connection shared by cluster, admin, and worker code paths", "conditions": ["Always before any handler or worker uses DB models"], "implementation": "db.InitializeWithoutMigrate(mysqlConfig)" } ] }, "aws_kms": { "conditions": ["config2.Global().InfraConfig.CMKArn is configured"], "operations": [ { "operation": "CREATE ENCRYPTOR", "trigger": "Build the secret encryptor used by cluster models and proxy helpers", "conditions": ["Always during startup"], "implementation": "secretprovider.NewSecretEncryptor(CMKArn)" } ] } }, "services": [] }, "ServerLifecycle.InitAuthAndModels": { "infrastructure": {}, "services": [ { "name": "auth0-jwks", "target_interface": "tenant and management JWKS", "target_repo": "auth0", "operation_type": "http", "conditions": ["Always after Auth0 config is loaded"], "operations": [ { "operation": "GET JWKS", "trigger": "Fetch JWKS for the central audience and the management-portal audience before creating token validators", "conditions": ["Always during startup"], "implementation": "auth0.GetJWKS(s.centralAuth0.Domain); auth0.GetJWKS(s.portalAuth0.Domain)" } ] } ] }, "ServerLifecycle.InitTracing": { "infrastructure": {}, "services": [] }, "ServerLifecycle.StartOptionalWorkers": { "infrastructure": { "background_runtime": { "conditions": ["enableWorker() == true"], "operations": [ { "operation": "START WORKERS", "trigger": "Launch the global background workers that reconcile clusters and dev-tier state", "conditions": ["`CENTRAL_ROLE` is `all` or `WORKER`"], "implementation": "cs.StartBackgroundWorkers() -> NewGlobalBgWorker(c).Start() -> ClusterWorker.Run / DevTierClusterWorker.Run" } ] } }, "services": [] }, "ServerLifecycle.StartMetricsListener": { "infrastructure": { "http_listener": { "conditions": ["config2.Global().ServerConfig.MetricsPort > 0"], "operations": [ { "operation": "LISTEN", "trigger": "Start the separate metrics and pprof listener instead of mounting those handlers on the main gateway engine", "conditions": ["Only when `MetricsPort > 0`"], "implementation": "http.ListenAndServe(fmt.Sprintf(\"0.0.0.0:%d\", MetricsPort), mux)" } ] }, "prometheus": { "conditions": ["config2.Global().ServerConfig.MetricsPort > 0"], "operations": [ { "operation": "REGISTER METRICS", "trigger": "Register the core portal and cluster metrics collectors before exposing `/metrics`", "conditions": ["Always before starting the metrics listener"], "implementation": "metrics2.RegisterMetrics(); clustermetrics.RegisterMetrics(); mux.Handle(\"/metrics\", promhttp.Handler())" } ] } }, "services": [] }, "ServerLifecycle.StartHealthOnlyServer": { "infrastructure": { "http_listener": { "conditions": ["enableApiService() == false"], "operations": [ { "operation": "LISTEN", "trigger": "Expose only `/healthz` and `/version` on port `11000` when the binary runs in worker-only mode", "conditions": ["`CENTRAL_ROLE` is neither `all` nor `API_SERVICE`"], "implementation": "eng.Any(\"/healthz\", ...); eng.Any(\"/version\", ...); eng.Run(\"0.0.0.0:11000\")" } ] } }, "services": [] }, "ServerLifecycle.BuildGRPCServer": { "infrastructure": {}, "services": [] }, "ServerLifecycle.RegisterGRPCServices": { "infrastructure": {}, "services": [ { "name": "server-registered-services", "target_interface": "central and openapi gRPC servers", "target_repo": "tidbcloud/core-portal", "operation_type": "internal", "conditions": ["enableApiService() == true"], "operations": [ { "operation": "REGISTER", "trigger": "Register the central, core, test-token, and OpenAPI gRPC services on the main gRPC server", "conditions": ["Only in API mode"], "implementation": "central.RegisterTenantServiceServer(...); central.RegisterClusterServiceServer(...); central.RegisterTestTokenServiceServer(...); core.RegisterCoreServiceServer(...); cm.RegisterClusterServer(...)" } ] } ] }, "ServerLifecycle.StartGRPCServer": { "infrastructure": { "grpc_listener": { "conditions": ["enableApiService() == true"], "operations": [ { "operation": "LISTEN", "trigger": "Start the dedicated gRPC listener before the gateway dials back into it", "conditions": ["Only in API mode"], "implementation": "net.Listen(\"tcp\", grpchttp.PortToAddress(config2.Global().ServerConfig.GrpcPort)); server.Serve(lis)" } ] } }, "services": [] }, "ServerLifecycle.BuildHTTPGateway": { "infrastructure": {}, "services": [ { "name": "grpc-gateway-loopback", "target_interface": "central and openapi gRPC gateway transport", "target_repo": "tidbcloud/core-portal", "operation_type": "grpc_gateway", "conditions": ["enableApiService() == true"], "operations": [ { "operation": "REGISTER ROUTES", "trigger": "Create the Gin gateway engine, attach shared CORS/trace/log middleware, and mount the central and OpenAPI grpc-gateway transports", "conditions": ["Only in API mode after the gRPC listener is available"], "implementation": "grpchttp.ServeHTTPGateway(log.L(), addr, grpchttp.ProdGatewayOptions, registerCentralHandler, registerOpenapiHandler)" } ] } ] }, "ServerLifecycle.ConfigureTenantProxy": { "infrastructure": { "prometheus": { "conditions": ["enableApiService() == true"], "operations": [ { "operation": "OBSERVE", "trigger": "Record proxy latency and status per tenant after each proxied request completes", "conditions": ["Only on non-OPTIONS proxy requests that reach `newProxyMetricsHandler`"], "implementation": "metrics2.ProxyRequestDuration.WithLabelValues(...).Observe(duration)" } ] } }, "services": [ { "name": "auth0-m2m", "target_interface": "Auth0 client credentials token endpoint", "target_repo": "auth0", "operation_type": "http", "conditions": ["enableApiService() == true", "A `/proxy/*any` request reaches the reverse proxy", "The reverse proxy target resolves successfully"], "operations": [ { "operation": "GET CLIENT TOKEN", "trigger": "Obtain a machine token before forwarding tenant proxy traffic to the target cluster endpoint", "conditions": ["Only after middleware auth succeeds and `makeTargetURL` returns a target"], "implementation": "proxy.NewAuth0M2MAuth(...)->auth0.GetClientToken(domain, clientID, clientSecret, audience)" } ] }, { "name": "tenant-cluster-runtime", "target_interface": "dashboard, metrics, and generic cluster proxy endpoints", "target_repo": "tenant cluster runtime", "operation_type": "http_proxy", "conditions": ["enableApiService() == true", "Request path matches `/proxy/*any`", "CORS preflight did not short-circuit the request", "Auth succeeded through test token, Auth0, or debug-session middleware", "The request is not blocked by debug-api or query-editor/configuration guards"], "operations": [ { "operation": "RESOLVE TARGET", "trigger": "Choose the dashboard, metrics, or generic cluster proxy base URL from the cluster model and request path", "conditions": ["`mesh.ProxyShootEndpoint(clusterModel)` returns a target URL"], "implementation": "mesh.ProxyShootEndpoint(clusterModel) -> cluster.FindClusterMetricsBaseURL / FindClusterDashboardBaseURL / FindClusterProxyBaseURL" }, { "operation": "REVERSE PROXY", "trigger": "Forward the request to the resolved tenant endpoint after terminal-path rewrite and auth header shaping", "conditions": ["Only after target resolution and Auth0 M2M token injection succeed"], "implementation": "proxy.NewReverseProxy(...).ServeHTTP(w, r)" } ] } ] }, "ServerLifecycle.SetupAdminAPI": { "infrastructure": {}, "services": [ { "name": "auth0-jwks", "target_interface": "management portal JWKS", "target_repo": "auth0", "operation_type": "http", "conditions": ["enableApiService() == true"], "operations": [ { "operation": "GET JWKS", "trigger": "Initialize the management-portal token validator before mounting admin routes", "conditions": ["Only in API mode before `InitAdminRouter` runs"], "implementation": "api2.InitTokenValidator(portalAuth0) -> auth0.GetJWKS(conf.Domain)" } ] } ] }, "ServerLifecycle.StartHTTPGateway": { "infrastructure": { "http_listener": { "conditions": ["enableApiService() == true"], "operations": [ { "operation": "LISTEN", "trigger": "Start the main Gin HTTP gateway on `0.0.0.0:11000` after grpc-gateway, proxy, health, version, and admin routes are mounted", "conditions": ["Only in API mode"], "implementation": "ginEng.Run(gatewayHttpAddr)" } ] } }, "services": [] }, "ClusterService.ListCloudProvidersV2": { "infrastructure": { "mysql": { "conditions": ["Caller OrgID and optional ProjectID pass permission checks"], "operations": [ { "operation": "SELECT", "trigger": "Load the tenant record to filter cloud providers by marketplace restrictions after the core-svc list returns", "conditions": ["Always after `grpcli.ListCloudProviders` succeeds"], "implementation": "dbutil.GetTenantByID(tx, entity.ID(orgID))" } ] } }, "services": [ { "name": "core-svc", "target_interface": "ListCloudProviders", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and optional ProjectID pass permission checks"], "operations": [ { "operation": "ListCloudProviders", "trigger": "Fetch the allowed provider and region inventory from core-svc before central-side filtering and sorting", "conditions": ["Always after permission checks", "`SpecificProjectId` is only set when `req.ProjectId != 0`", "`DeployType` depends on `req.IsDevTier`"], "implementation": "clusterService.ListCloudProviders -> grpcli.ListCloudProviders(ctx, listCloudProvidersReq)" } ] } ] }, "ClusterService.CalcNodeProfilesV2": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "ListNodeProfiles4Tenant", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID passes permission checks"], "operations": [ { "operation": "ListNodeProfiles4Tenant", "trigger": "Load the candidate node profiles for the requested provider, region, and deploy type before central computes defaults and grouping", "conditions": ["Always after permission checks", "`DeployType` depends on `req.IsDevTier`"], "implementation": "clusterService.CalcNodeProfiles -> grpcli.ListNodeProfiles4Tenant(ctx, listNodeProfiles4TenantReq)" } ] } ] }, "ClusterService.GenClusterName": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "GetClusterName", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "GetClusterName", "trigger": "Generate the suggested cluster name from the downstream naming service after the tenant and project are authorized", "conditions": ["Always after permission checks"], "implementation": "clusterService.GenClusterName -> grpcli.GetClusterName(ctx, &core.GetClusterNameReq{TenantId: req.OrgId, ProjectId: req.ProjectId})" } ] } ] }, "ClusterService.List": { "infrastructure": { "mysql": { "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "SELECT", "trigger": "Check whether each listed cluster has restores in progress before returning the converted list", "conditions": ["Runs once per cluster returned by core-svc"], "implementation": "dbutil.RestoresInProgress(rdb, entity.ID(clusterId))" } ] } }, "services": [ { "name": "core-svc", "target_interface": "ListClusters and CountClusters", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "ListClusters", "trigger": "Load the ordered cluster list for the tenant and project before local status filtering and pagination", "conditions": ["`Deleted` is forced to false", "Provider filter is only added when `req.Provider != \"\"`"], "implementation": "context.ListV2(ctx, projectID, entity.Cloud(req.Provider)) -> grpcli.ListClusters(ctx, listReq)" }, { "operation": "CountClusters", "trigger": "Load the total count for the same tenant/project filter", "conditions": ["Always together with `ListClusters`"], "implementation": "context.ListV2(ctx, projectID, entity.Cloud(req.Provider)) -> grpcli.CountClusters(ctx, &core.CountClustersReq{Filter: filter})" } ] } ] }, "ClusterService.ListDeletedClusters": { "infrastructure": { "mysql": { "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "SELECT", "trigger": "Load deleted cluster rows, their regions, and related backups before filtering to clusters that still have backups", "conditions": ["Provider-specific query path is used only when `req.Provider != \"\"`"], "implementation": "context.ListDeletedClusters(ctx, entity.Cloud(req.Provider), projectID) -> dbutil.ListDeletedClustersByProjectAndProvider / ListDeletedClustersByProject; dbutil.GetClusterRegion(...); dbutil.ClusterBackups(...)" } ] }, "kubernetes_api": { "conditions": ["A deleted cluster still has backup records in MySQL"], "operations": [ { "operation": "LIST", "trigger": "Read backup CRs from infra-api to recover the latest backup size for deleted clusters", "conditions": ["Only for deleted clusters with backup rows"], "implementation": "c.api.ListBackups(context.TODO(), cluster.ProjectID.Uint64(), cluster.ID.Uint64())" } ] } }, "services": [] }, "ClusterService.ChangePassword": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "ChangeClusterPasswd", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "ChangeClusterPasswd", "trigger": "Rotate the cluster root password through the downstream core service", "conditions": ["Always after permission checks"], "implementation": "grpcli.ChangeClusterPasswd(ctx, &core.ChangeClusterPasswdReq{ClusterId: req.ClusterId, Passwd: req.Password})" } ] } ] }, "ClusterService.GetTiDBNodes": { "infrastructure": { "mysql": { "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "SELECT", "trigger": "Load the cluster row before hydrating TiDB node details", "conditions": ["Always before reading the cluster CR"], "implementation": "context.ListTiDBNodesV1(ctx, orgID, projectID, clusterID) -> dbutil.GetClusterByID(tx, orgID, projectID, clusterID)" } ] }, "kubernetes_api": { "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "GET", "trigger": "Read the cluster CR from infra-api to enumerate TiDB members and resources", "conditions": ["Always after the cluster row is loaded"], "implementation": "context.ListTiDBNodesV1(ctx, orgID, projectID, clusterID) -> c.api.GetCluster(ctx, cluster.ProjectID.Uint64(), clusterID.Uint64())" } ] } }, "services": [] }, "ClusterService.GetTiKVNodes": { "infrastructure": { "mysql": { "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "SELECT", "trigger": "Load the cluster row and component storage size before hydrating TiKV node details", "conditions": ["Always before reading the cluster CR"], "implementation": "context.ListTiKVNodesV1(ctx, orgID, projectID, clusterID) -> dbutil.GetClusterByID(tx, orgID, projectID, clusterID)" } ] }, "kubernetes_api": { "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "GET", "trigger": "Read the cluster CR from infra-api to enumerate TiKV members and status", "conditions": ["Always after the cluster row is loaded"], "implementation": "context.ListTiKVNodesV1(ctx, orgID, projectID, clusterID) -> c.api.GetCluster(ctx, cluster.ProjectID.Uint64(), clusterID.Uint64())" } ] } }, "services": [] }, "ClusterService.GetTiFlashNodes": { "infrastructure": { "mysql": { "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "SELECT", "trigger": "Load the cluster row and component storage size before hydrating TiFlash node details", "conditions": ["Always before reading the cluster CR"], "implementation": "context.ListTiFlashNodesV1(ctx, orgID, projectID, clusterID) -> dbutil.GetClusterByID(tx, orgID, projectID, clusterID)" } ] }, "kubernetes_api": { "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "GET", "trigger": "Read the cluster CR from infra-api to enumerate TiFlash members and status", "conditions": ["Always after the cluster row is loaded"], "implementation": "context.ListTiFlashNodesV1(ctx, orgID, projectID, clusterID) -> c.api.GetCluster(ctx, cluster.ProjectID.Uint64(), clusterID.Uint64())" } ] } }, "services": [] }, "ClusterService.CreateGcpVpcPeering": { "infrastructure": {}, "services": [ { "name": "cluster-network-peer", "target_interface": "CreateNetworkPeer", "target_repo": "tidbcloud/core-portal", "operation_type": "internal", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "CreateNetworkPeer", "trigger": "Create the customer GCP network peer through the cluster user context before reading it back", "conditions": ["Always after permission checks"], "implementation": "s.userCluster(c).CreateNetworkPeer(c, &cluster.CreateNetworkPeerParams{CloudProvider: entity.Gcp.String(), ...})" } ] }, { "name": "core-svc", "target_interface": "GetNetworkPeer", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["The internal network peer creation returned a peering ID"], "operations": [ { "operation": "GetNetworkPeer", "trigger": "Read the newly created GCP peering back from the shared network-peer service", "conditions": ["Always after `CreateNetworkPeer` succeeds"], "implementation": "grpcli.GetNetworkPeer(c, entity.Gcp.String(), peeringId)" } ] } ] }, "ClusterService.ListAwsVpcPeerings": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "ListNetworkPeer", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "ListNetworkPeer", "trigger": "List AWS customer network peers for the project, optionally narrowed by region", "conditions": ["`req.Region` only contributes a filter when it is non-empty"], "implementation": "listVpcPeerings(c, entity.Aws.String(), req) -> grpcli.ListNetworkPeer(ctx, filter, nil, sorter)" } ] } ] }, "ClusterService.ListGcpVpcPeerings": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "ListNetworkPeer", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "ListNetworkPeer", "trigger": "List GCP customer network peers for the project, optionally narrowed by region", "conditions": ["`req.Region` only contributes a filter when it is non-empty"], "implementation": "listVpcPeerings(c, entity.Gcp.String(), req) -> grpcli.ListNetworkPeer(ctx, filter, nil, sorter)" } ] } ] }, "ClusterService.CreatePrivateEndpoint": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "GetCluster and CreateClusterConn", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "GetCluster", "trigger": "Confirm the cluster exists and belongs to the tenant/project before requesting a private connection", "conditions": ["Always after permission checks"], "implementation": "grpcli.GetCluster(ctx, orgID.Uint64(), projectID.Uint64(), clusterID.Uint64())" }, { "operation": "CreateClusterConn", "trigger": "Ask the downstream cluster service to create the private endpoint connection", "conditions": ["Only after `GetCluster` succeeds"], "implementation": "grpcli.CreateClusterConn(ctx, clusterID.Uint64(), core.ClusterConnectionType_CLUSTER_CONNECTION_TYPE_PRIVATE)" } ] } ] }, "ClusterService.GetAwsVpcPeering": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "GetNetworkPeer", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "GetNetworkPeer", "trigger": "Load the AWS network peer and then verify that it belongs to the caller project", "conditions": ["Always after permission checks"], "implementation": "grpcli.GetNetworkPeer(c, entity.Aws.String(), req.Id)" } ] } ] }, "ClusterService.GetGcpVpcPeering": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "GetNetworkPeer", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "GetNetworkPeer", "trigger": "Load the GCP network peer and then verify that it belongs to the caller project", "conditions": ["Always after permission checks"], "implementation": "grpcli.GetNetworkPeer(c, entity.Gcp.String(), req.Id)" } ] } ] }, "ClusterService.DeleteAwsVpcPeering": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "GetNetworkPeer and DeleteNetworkPeer", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "GetNetworkPeer", "trigger": "Load the AWS network peer before delete so the project ownership can be verified", "conditions": ["Always after permission checks"], "implementation": "grpcli.GetNetworkPeer(c, entity.Aws.String(), req.Id)" }, { "operation": "DeleteNetworkPeer", "trigger": "Delete the AWS network peer after ownership validation", "conditions": ["Only when `vpcPeering.ProjectId == req.ProjectId`"], "implementation": "grpcli.DeleteNetworkPeer(c, entity.Aws.String(), req.Id, userContext.UserID())" } ] } ] }, "ClusterService.DeleteGcpVpcPeering": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "GetNetworkPeer and DeleteNetworkPeer", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "GetNetworkPeer", "trigger": "Load the GCP network peer before delete so the project ownership can be verified", "conditions": ["Always after permission checks"], "implementation": "grpcli.GetNetworkPeer(c, entity.Gcp.String(), req.Id)" }, { "operation": "DeleteNetworkPeer", "trigger": "Delete the GCP network peer after ownership validation", "conditions": ["Only when `vpcPeering.ProjectId == req.ProjectId`"], "implementation": "grpcli.DeleteNetworkPeer(c, entity.Gcp.String(), req.Id, userContext.UserID())" } ] } ] }, "ClusterService.GetPrivateEndpoint": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "GetCluster and ListNetworkPeer", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "GetCluster", "trigger": "Load the cluster connections and cloud metadata before deriving the private-endpoint status", "conditions": ["Always after permission checks"], "implementation": "context.GetPrivateEndpoint(ctx, orgID, projectID, clusterID) -> grpcli.GetCluster(ctx, orgID.Uint64(), projectID.Uint64(), clusterID.Uint64())" }, { "operation": "ListNetworkPeer", "trigger": "Check whether the customer VPC peering already exists and is active before reporting the endpoint status", "conditions": ["Always after the cluster record is available"], "implementation": "c.getPrivateEndpointStatus(cluster, cluster.CloudProviderName, cluster.RegionName) -> grpcli.ListNetworkPeer(context.TODO(), filter, nil, nil)" } ] } ] }, "ClusterService.DeletePrivateLinkService": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "DeletePrivateLinkService", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID, ProjectID, and ClusterID pass permission checks"], "operations": [ { "operation": "DeletePrivateLinkService", "trigger": "Delete the private-link service for the target cluster through core-svc", "conditions": ["Always after `CheckOrgIDAndProjectIDAndClusterID` succeeds"], "implementation": "grpcli.DeletePrivateLinkService(ctx, deleteReq)" } ] } ] }, "ClusterService.GetPrivateLinkService": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "GetPrivateLinkService", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID, ProjectID, and ClusterID pass permission checks"], "operations": [ { "operation": "GetPrivateLinkService", "trigger": "Read the current private-link service state for the cluster from core-svc", "conditions": ["Always after `CheckOrgIDAndProjectIDAndClusterID` succeeds"], "implementation": "grpcli.GetPrivateLinkService(ctx, getReq)" } ] } ] }, "ClusterService.ListPrivateLinkEndpointsOfProject": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "ListPrivateLinkEndpoints", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "ListPrivateLinkEndpoints", "trigger": "List all private-link endpoints in the project and convert them into central responses", "conditions": ["Always after `CheckOrgIDAndProjectID` succeeds"], "implementation": "clusterService.ListPrivateLinkEndpoints -> grpcli.ListPrivateLinkEndpoints(ctx, listReq)" } ] } ] }, "ClusterService.CreatePrivateLinkEndpoint": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "CreatePrivateLinkEndpoint", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID, ProjectID, and ClusterID pass permission checks", "req.PrivatelinkEndpoint.Id != \"\""], "operations": [ { "operation": "CreatePrivateLinkEndpoint", "trigger": "Create the project-scoped private-link endpoint for the target cluster", "conditions": ["Always after permission checks and endpoint ID validation"], "implementation": "grpcli.CreatePrivateLinkEndpoint(ctx, createReq)" } ] } ] }, "ClusterService.DeletePrivateLinkEndpoint": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "DeletePrivateLinkEndpoint", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID, ProjectID, and ClusterID pass permission checks", "req.EndpointId != \"\""], "operations": [ { "operation": "DeletePrivateLinkEndpoint", "trigger": "Delete the requested private-link endpoint from core-svc", "conditions": ["Always after permission checks and endpoint ID validation"], "implementation": "grpcli.DeletePrivateLinkEndpoint(ctx, deleteReq)" } ] } ] }, "ClusterService.GetProjectCIDR": { "infrastructure": { "mysql": { "conditions": ["Caller OrgID and ProjectID pass permission checks", "req.Provider is a valid cloud provider"], "operations": [ { "operation": "SELECT", "trigger": "Resolve the provider row and any persisted project network before deciding between custom and default CIDR", "conditions": ["Always after provider validation"], "implementation": "dbutil.GetProviderByCloudName(ctx, tx, providerName); cluster.GetProjectNetwork(ctx, projectID, provider.ID)" } ] }, "kubernetes_api": { "conditions": ["Caller OrgID and ProjectID pass permission checks", "req.Provider is a valid cloud provider"], "operations": [ { "operation": "GET", "trigger": "Load the region CIDR from infra-api when region-level CIDR lookup is requested", "conditions": ["Region may be empty, which asks infra-api for the provider/project default region CIDR context"], "implementation": "cluster.GetRegionCIDRFromInfraAPI(ctx, s.clustersModel.InfraAPI(), *provider, projectID, req.Region)" } ] } }, "services": [] }, "ClusterService.GetProjectCIDRWithoutRegion": { "infrastructure": {}, "services": [ { "name": "cluster-cidr", "target_interface": "GetProjectCIDR", "target_repo": "tidbcloud/core-portal", "operation_type": "internal", "conditions": ["Always"], "operations": [ { "operation": "Delegate", "trigger": "Proxy directly to the shared `GetProjectCIDR` implementation", "conditions": ["Always"], "implementation": "return s.GetProjectCIDR(ctx, req)" } ] } ] }, "ClusterService.CreateProjectCIDR": { "infrastructure": { "mysql": { "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "SELECT", "trigger": "Validate provider existence and ensure the project does not already have a CIDR", "conditions": ["Always before creating the project network"], "implementation": "validateCreateProjectCIDRReq(ctx, req) -> dbutil.GetProviderByCloudName(...); cluster.GetProjectNetwork(ctx, projectID, provider.ID)" }, { "operation": "INSERT", "trigger": "Persist the new project network after validation succeeds", "conditions": ["Only after `validateCreateProjectCIDRReq` succeeds"], "implementation": "cluster.CreateProjectNetwork(ctx, projectID, providerID, req.Cidr)" } ] } }, "services": [] }, "ClusterService.ValidateProjectCIDR": { "infrastructure": { "mysql": { "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "SELECT", "trigger": "Check provider existence and confirm the project has not already claimed a CIDR", "conditions": ["Always after permission checks"], "implementation": "validateCreateProjectCIDRReq(ctx, req) -> dbutil.GetProviderByCloudName(...); cluster.GetProjectNetwork(ctx, projectID, provider.ID)" } ] } }, "services": [] }, "ClusterService.GetProjectRegionCIDR": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "ListRegionCIDROfProject", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "ListRegionCIDROfProject", "trigger": "Load the AWS region CIDRs for the project", "conditions": ["Always after permission checks"], "implementation": "s.getProjectRegionCIDR(ctx, projectID, entity.Aws) -> grpcli.ListRegionCIDROfProject(ctx, req)" }, { "operation": "ListRegionCIDROfProject", "trigger": "Load the GCP region CIDRs for the project", "conditions": ["Always after permission checks"], "implementation": "s.getProjectRegionCIDR(ctx, projectID, entity.Gcp) -> grpcli.ListRegionCIDROfProject(ctx, req)" } ] } ] }, "ClusterService.MakeClusterWritable": { "infrastructure": { "mysql": { "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "SELECT", "trigger": "Load the cluster row before issuing the read-only SQL through the cluster proxy", "conditions": ["Always before `ExecuteSqlCommon`"], "implementation": "context.SetReadOnly(ctx, clusterID, projectID, \"OFF\") -> c.dao.GetCluster(clusterID)" } ] } }, "services": [ { "name": "cluster-sql-proxy", "target_interface": "execute SQL on target cluster", "target_repo": "tenant cluster runtime", "operation_type": "sql_over_proxy", "conditions": ["Caller OrgID and ProjectID pass permission checks", "The cluster belongs to the provided project"], "operations": [ { "operation": "SET READ ONLY OFF", "trigger": "Execute the cluster-level SQL that clears the read-only flag", "conditions": ["Only after the cluster row is loaded and project ownership matches"], "implementation": "util.ExecuteSqlCommon(ctx, &cluster, fmt.Sprintf(config.SetSuperReadonlyClause, \"OFF\"), c.api, c.encryptor, tidbcloud.BuildClusterProxy, config.DefaultClusterProxyTimeout)" } ] } ] }, "ClusterService.GetAuditLogStatus": { "infrastructure": { "mysql": { "conditions": ["Caller passes project permission checks", "Caller is audit admin", "Cluster belongs to the project", "Cluster is not dev tier", "Cluster version supports audit log"], "operations": [ { "operation": "SELECT", "trigger": "Load the cluster row for project and dev-tier validation, then read the persisted cluster config", "conditions": ["Always during `validateAuditLogReq` and config lookup"], "implementation": "dbutil.GetCluster(tx, clusterID); dbutil.GetClusterConfig(ctx, tx, clusterID)" } ] }, "kubernetes_api": { "conditions": ["Caller passes project permission checks", "Caller is audit admin"], "operations": [ { "operation": "GET", "trigger": "Load the cluster CR from infra-api to validate audit-log version support", "conditions": ["Always during `validateAuditLogReq`"], "implementation": "api.GetCluster(ctx, projectID.Uint64(), clusterID.Uint64())" } ] } }, "services": [] }, "ClusterService.UpdateAuditLogStatus": { "infrastructure": { "mysql": { "conditions": ["Caller passes project permission checks", "Caller is audit admin", "Cluster belongs to the project", "Cluster is not dev tier", "Cluster status is one of normal/scaling"], "operations": [ { "operation": "SELECT", "trigger": "Load the cluster row for validation and later SQL/proxy execution", "conditions": ["Always before syncing audit config"], "implementation": "dbutil.GetCluster(tx, clusterID)" }, { "operation": "UPSERT", "trigger": "Persist the final audit-log enabled flag and serialized config after infra and in-cluster sync succeed", "conditions": ["Only after `SyncAuditLogStatusToInfra` and `UpdateAuditLogStatus` succeed"], "implementation": "dbutil.UpsertClusterConfig(ctx, tx, clusterID, auditEnabled, string(auditLogconfig))" } ] }, "kubernetes_api": { "conditions": ["Caller passes project permission checks", "Caller is audit admin", "Cluster status is valid for audit-log operations"], "operations": [ { "operation": "GET", "trigger": "Load the cluster CR to validate version support and to build the cluster proxy for precheck/update", "conditions": ["Always during `validateAuditLogReq` and `precheckAuditLogConfig`"], "implementation": "api.GetCluster(ctx, projectID.Uint64(), clusterID.Uint64())" }, { "operation": "UPDATE", "trigger": "Sync audit-log bucket settings into the infra layer and toggle the audit plugin on the cluster", "conditions": ["Only after validation succeeds", "Precheck runs only when `req.Enabled == true`", "`auditEnabled` is forced to true when `req.Restart == true`"], "implementation": "cluster.SyncAuditLogStatusToInfra(...); cluster.UpdateAuditLogStatus(ctx, api, s.clustersModel.Encryptor(), clusterID, projectID, auditEnabled)" } ] } }, "services": [ { "name": "cluster-proxy", "target_interface": "TestAuditConnection", "target_repo": "tenant cluster runtime", "operation_type": "sql_over_proxy", "conditions": ["`req.Enabled == true`", "Validation and cluster-status checks already passed"], "operations": [ { "operation": "TestAuditConnection", "trigger": "Precheck the bucket and credentials through the TiDB-side audit helper before enabling audit log", "conditions": ["Only on the enable path, not on disable-only updates"], "implementation": "s.precheckAuditLogConfig(ctx, req.AuditLogConfig, req.ProjectId, req.ClusterId) -> proxy.TestAuditConnection(ctx, args)" } ] } ] }, "ClusterService.PrecheckAuditLogConfig": { "infrastructure": { "mysql": { "conditions": ["Caller passes project permission checks", "Caller is audit admin", "Cluster belongs to the project", "Cluster is not dev tier", "Cluster status is one of normal/scaling"], "operations": [ { "operation": "SELECT", "trigger": "Load the cluster row and ingestion profile needed to build the precheck request", "conditions": ["Always after permission and status validation"], "implementation": "dbutil.GetCluster(tx, clusterID); s.userCluster(ctx).GetDataIngestionProfile(ctx, entity.ID(clusterID))" } ] }, "kubernetes_api": { "conditions": ["Caller passes project permission checks", "Caller is audit admin", "Cluster status is valid for audit-log operations"], "operations": [ { "operation": "GET", "trigger": "Load the cluster CR to validate version support and construct the cluster proxy", "conditions": ["Always during validation and precheck"], "implementation": "api.GetCluster(ctx, projectID.Uint64(), clusterID.Uint64())" } ] } }, "services": [ { "name": "cluster-proxy", "target_interface": "TestAuditConnection", "target_repo": "tenant cluster runtime", "operation_type": "sql_over_proxy", "conditions": ["Validation and cluster-status checks already passed"], "operations": [ { "operation": "TestAuditConnection", "trigger": "Verify the remote bucket and audit credentials through the target cluster proxy", "conditions": ["For S3, `RoleArn` must be provided", "Data source is either S3 or GCS"], "implementation": "s.precheckAuditLogConfig(ctx, req.AuditLogConfig, req.ProjectId, req.ClusterId) -> proxy.TestAuditConnection(ctx, args)" } ] } ] }, "ClusterService.CheckAuditLogPluginStatus": { "infrastructure": { "mysql": { "conditions": ["Caller passes project permission checks", "Caller is audit admin", "Cluster belongs to the project", "Cluster is not dev tier", "Cluster status is one of normal/scaling"], "operations": [ { "operation": "SELECT", "trigger": "Load the cluster row for project and dev-tier validation", "conditions": ["Always during `validateAuditLogReq`"], "implementation": "dbutil.GetCluster(tx, clusterID)" } ] }, "kubernetes_api": { "conditions": ["Caller passes project permission checks", "Caller is audit admin", "Cluster status is one of normal/scaling"], "operations": [ { "operation": "GET", "trigger": "Read the cluster CR and inspect whether the TiDB audit plugin is enabled in the live spec", "conditions": ["Always after validation succeeds"], "implementation": "api.GetCluster(ctx, projectID.Uint64(), clusterID.Uint64())" } ] } }, "services": [] }, "ClusterService.GetAuditLogAccessRecords": { "infrastructure": { "mysql": { "conditions": ["Caller passes project permission checks", "Caller is audit admin", "Cluster status is one of normal/scaling"], "operations": [ { "operation": "SELECT", "trigger": "Load the cluster row needed to execute SQL through the cluster proxy", "conditions": ["Always after validation succeeds"], "implementation": "dbutil.GetCluster(tx, clusterID)" } ] }, "kubernetes_api": { "conditions": ["Caller passes project permission checks", "Caller is audit admin"], "operations": [ { "operation": "GET", "trigger": "Read the cluster CR during validation and while building the SQL proxy connection", "conditions": ["Always during validation and SQL execution"], "implementation": "api.GetCluster(ctx, projectID.Uint64(), clusterID.Uint64())" } ] } }, "services": [ { "name": "cluster-proxy", "target_interface": "query audit log ACL tables", "target_repo": "tenant cluster runtime", "operation_type": "sql_over_proxy", "conditions": ["Validation and cluster-status checks already passed"], "operations": [ { "operation": "QUERY SQL", "trigger": "Read all audit-log access records from the target cluster over the SQL proxy", "conditions": ["Always after the cluster row is loaded"], "implementation": "cluster.QueryClusterWithSQL(ctx, api, encryptor, &c, tidbcloud.BuildClusterProxy, config.GetAllAuditLogAccessClause)" } ] } ] }, "ClusterService.CreateAuditLogAccessRecord": { "infrastructure": { "mysql": { "conditions": ["Caller passes project permission checks", "Caller is audit admin", "Cluster status is one of normal/scaling", "Input regex and access-type validation passed"], "operations": [ { "operation": "SELECT", "trigger": "Load the cluster row needed to execute SQL through the cluster proxy", "conditions": ["Always after validation succeeds"], "implementation": "dbutil.GetCluster(tx, clusterID)" } ] }, "kubernetes_api": { "conditions": ["Caller passes project permission checks", "Caller is audit admin"], "operations": [ { "operation": "GET", "trigger": "Read the cluster CR during validation and while building the SQL proxy connection", "conditions": ["Always during validation and SQL execution"], "implementation": "api.GetCluster(ctx, projectID.Uint64(), clusterID.Uint64())" } ] } }, "services": [ { "name": "cluster-proxy", "target_interface": "insert and flush audit log ACL tables", "target_repo": "tenant cluster runtime", "operation_type": "sql_over_proxy", "conditions": ["Validation, cluster-status checks, and `checkAuditLogInput` all succeeded"], "operations": [ { "operation": "EXECUTE SQL", "trigger": "Insert the new audit-log access rule into the cluster-side ACL table", "conditions": ["Always after the input record is validated"], "implementation": "util.ExecuteSqlCommon(ctx, &c, fmt.Sprintf(config.CreateAuditLogAccessClause, ...), api, encryptor, tidbcloud.BuildClusterProxy, config.AuditLogClusterproxyTimeout)" }, { "operation": "EXECUTE SQL", "trigger": "Flush the audit-log ACL table so the new rule becomes effective", "conditions": ["Only after the insert succeeds"], "implementation": "util.ExecuteSqlCommon(ctx, &c, config.FlushAuditLogAccessClause, api, encryptor, tidbcloud.BuildClusterProxy, config.AuditLogClusterproxyTimeout)" } ] } ] }, "ClusterService.DeleteAuditLogAccessRecord": { "infrastructure": { "mysql": { "conditions": ["Caller passes project permission checks", "Caller is audit admin", "Cluster status is one of normal/scaling"], "operations": [ { "operation": "SELECT", "trigger": "Load the cluster row needed to execute SQL through the cluster proxy", "conditions": ["Always after validation succeeds"], "implementation": "dbutil.GetCluster(tx, clusterID)" } ] }, "kubernetes_api": { "conditions": ["Caller passes project permission checks", "Caller is audit admin"], "operations": [ { "operation": "GET", "trigger": "Read the cluster CR during validation and while building the SQL proxy connection", "conditions": ["Always during validation and SQL execution"], "implementation": "api.GetCluster(ctx, projectID.Uint64(), clusterID.Uint64())" } ] } }, "services": [ { "name": "cluster-proxy", "target_interface": "delete and flush audit log ACL tables", "target_repo": "tenant cluster runtime", "operation_type": "sql_over_proxy", "conditions": ["Validation and cluster-status checks already passed"], "operations": [ { "operation": "EXECUTE SQL", "trigger": "Delete the selected audit-log access rule from the cluster-side ACL table", "conditions": ["Always after the cluster row is loaded"], "implementation": "util.ExecuteSqlCommon(ctx, &c, fmt.Sprintf(config.DeleteAuditLogAccessClause, req.Id), api, encryptor, tidbcloud.BuildClusterProxy, config.AuditLogClusterproxyTimeout)" }, { "operation": "EXECUTE SQL", "trigger": "Flush the audit-log ACL table so the deletion becomes effective", "conditions": ["Only after the delete succeeds"], "implementation": "util.ExecuteSqlCommon(ctx, &c, config.FlushAuditLogAccessClause, api, encryptor, tidbcloud.BuildClusterProxy, config.AuditLogClusterproxyTimeout)" } ] } ] }, "ClusterService.GetClusterCACertificate": { "infrastructure": { "aws_s3": { "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "PRESIGN GET OBJECT", "trigger": "Generate a short-lived download URL for the shared cluster CA certificate object", "conditions": ["Always after permission checks"], "implementation": "s.s3PresignClient.PresignGetObject(ctx, &s3.GetObjectInput{Bucket: caCertificateS3Bucket, Key: caCertificateS3Key, ResponseContentDisposition: attachment}, s3.WithPresignExpires(defaultPresignExpires))" } ] } }, "services": [] }, "ClusterService.ChangeClusterName": { "infrastructure": {}, "services": [] }, "ClusterService.GetProjectMaintenanceWindow": { "infrastructure": {}, "services": [] }, "ClusterService.UpdateProjectMaintenanceWindow": { "infrastructure": {}, "services": [] }, "ClusterService.ListProjectMaintenanceTasks": { "infrastructure": {}, "services": [] }, "ClusterService.DeferMaintenanceTask": { "infrastructure": {}, "services": [] }, "ClusterService.GetProjectAWSAccount": { "infrastructure": {}, "services": [] }, "ClusterService.CreateAwsCmek": { "infrastructure": {}, "services": [] }, "ClusterService.GetAwsCmek": { "infrastructure": {}, "services": [] }, "ClusterService.CreateCidr": { "infrastructure": {}, "services": [] }, "ClusterService.ListCidrs": { "infrastructure": {}, "services": [] }, "ClusterService.GetCidr": { "infrastructure": {}, "services": [] }, "ClusterService.UpdateCidr": { "infrastructure": {}, "services": [] }, "ClusterService.DeleteCidr": { "infrastructure": {}, "services": [] }, "ClusterService.GetDefaultCidr": { "infrastructure": {}, "services": [] }, "ClusterService.ListAccesspoints": { "infrastructure": {}, "services": [] }, "ClusterService.GetThreeArch": { "infrastructure": {}, "services": [] }, "ClusterService.Get": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "SELECT", "trigger": "Get cluster info from database", "conditions": ["Always"], "implementation": "clusterModel.GetCluster(ctx, orgID, projectID, clusterID)" } ] }, "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "GET", "trigger": "Get cluster CR from infra-api", "conditions": ["Always"], "implementation": "infraAPI.GetCluster(ctx, projectID, clusterID)" } ] } }, "services": [] }, "ClusterService.CreateClusterV2": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "INSERT", "trigger": "Create cluster record in database", "conditions": ["Always"], "implementation": "clusterModel.CreateCluster(ctx, req)" }, { "operation": "SELECT", "trigger": "Get tenant/project info", "conditions": ["Always"], "implementation": "clusterModel.GetTenant(ctx, orgID)" } ] }, "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "CREATE", "trigger": "Create cluster CR in infra-api", "conditions": ["Always"], "implementation": "infraAPI.CreateCluster(ctx, clusterCR)" } ] }, "aws": { "conditions": ["provider == aws"], "operations": [ { "operation": "ValidateAccount", "trigger": "Validate AWS account", "conditions": ["provider == aws"], "implementation": "awsConfig.Validate()" } ] } }, "services": [] }, "ClusterService.ScaleClusterV2": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "UPDATE", "trigger": "Update cluster config in database", "conditions": ["Always"], "implementation": "clusterModel.UpdateCluster(ctx, cluster)" } ] }, "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "UPDATE", "trigger": "Update cluster CR in infra-api", "conditions": ["Always"], "implementation": "infraAPI.UpdateCluster(ctx, clusterCR)" } ] } }, "services": [] }, "ClusterService.Delete": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "UPDATE", "trigger": "Mark cluster as deleted in database", "conditions": ["Always"], "implementation": "clusterModel.DeleteCluster(ctx, clusterID)" } ] }, "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "DELETE", "trigger": "Delete cluster CR from infra-api", "conditions": ["Always"], "implementation": "infraAPI.DeleteCluster(ctx, projectID, clusterID)" } ] } }, "services": [] }, "ClusterService.PauseCluster": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "UPDATE", "trigger": "Update cluster status to pausing", "conditions": ["Always"], "implementation": "clusterModel.UpdateClusterStatus(ctx, clusterID, Pausing)" } ] }, "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "UPDATE", "trigger": "Update cluster CR to paused state", "conditions": ["Always"], "implementation": "infraAPI.PauseCluster(ctx, clusterCR)" } ] } }, "services": [] }, "ClusterService.ResumeCluster": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "UPDATE", "trigger": "Update cluster status to resuming", "conditions": ["Always"], "implementation": "clusterModel.UpdateClusterStatus(ctx, clusterID, Resuming)" } ] }, "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "UPDATE", "trigger": "Update cluster CR to resume state", "conditions": ["Always"], "implementation": "infraAPI.ResumeCluster(ctx, clusterCR)" } ] } }, "services": [] }, "ClusterService.CreateAWSVpcPeering": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "INSERT", "trigger": "Create VPC peering record", "conditions": ["Always"], "implementation": "clusterModel.CreateVpcPeering(ctx, peering)" } ] }, "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "CREATE", "trigger": "Create VPC peering CR in infra-api", "conditions": ["Always"], "implementation": "infraAPI.CreateVpcPeering(ctx, peeringCR)" } ] } }, "services": [] }, "ClusterService.CalcClusterFee": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "SELECT", "trigger": "Get pricing info from database", "conditions": ["Always"], "implementation": "billingModel.CalcClusterFee(ctx, req)" } ] } }, "services": [] }, "ClusterService.GetTrafficFilter": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "SELECT", "trigger": "Get traffic filter rules", "conditions": ["Always"], "implementation": "clusterModel.GetTrafficFilter(ctx, clusterID)" } ] } }, "services": [] }, "ClusterService.UpdateTrafficFilter": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "UPDATE", "trigger": "Update traffic filter rules", "conditions": ["Always"], "implementation": "clusterModel.UpdateTrafficFilter(ctx, clusterID, rules)" } ] }, "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "UPDATE", "trigger": "Update cluster CR traffic filter", "conditions": ["Always"], "implementation": "infraAPI.UpdateTrafficFilter(ctx, clusterCR, rules)" } ] } }, "services": [] }, "ClusterService.CreatePrivateLinkService": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "INSERT", "trigger": "Create private link service record", "conditions": ["Always"], "implementation": "clusterModel.CreatePrivateLinkService(ctx, pls)" } ] }, "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "CREATE", "trigger": "Create private link service CR", "conditions": ["Always"], "implementation": "infraAPI.CreatePrivateLinkService(ctx, plsCR)" } ] } }, "services": [] }, "CoreService.CreateCluster": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "INSERT", "trigger": "Create cluster record", "conditions": ["Always"], "implementation": "clusterModel.CreateCluster(ctx, req)" } ] }, "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "CREATE", "trigger": "Create cluster CR via infra-api", "conditions": ["Always"], "implementation": "infraAPI.CreateCluster(ctx, clusterCR)" } ] } }, "services": [] }, "CoreService.ListClusters": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "SELECT", "trigger": "List clusters from database", "conditions": ["Always"], "implementation": "clusterModel.ListClusters(ctx, req)" } ] }, "kubernetes": { "conditions": ["List with CR info"], "operations": [ { "operation": "LIST", "trigger": "List cluster CRs from infra-api", "conditions": ["List with CR info"], "implementation": "infraAPI.ListClusters(ctx, projectID)" } ] } }, "services": [] }, "CoreService.CleanProjectResource": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "SELECT", "trigger": "Get project clusters", "conditions": ["Always"], "implementation": "clusterModel.ListClusters(ctx, projectID)" } ] }, "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "DELETE", "trigger": "Clean project resources via infra-api", "conditions": ["Always"], "implementation": "infraAPI.CleanProjectResource(ctx, projectID)" } ] } }, "services": [] }, "CoreService.SyncInfraProfile": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "UPSERT", "trigger": "Sync profile to database", "conditions": ["Always"], "implementation": "profileModel.SyncProfile(ctx, req)" } ] }, "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "UPDATE", "trigger": "Update profile CR in infra-api", "conditions": ["Always"], "implementation": "infraAPI.UpdateProfile(ctx, profileCR)" } ] } }, "services": [] }, "CoreService.CreatePrivateLinkService": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "INSERT", "trigger": "Create private link service record", "conditions": ["Always"], "implementation": "clusterModel.CreatePrivateLinkService(ctx, req)" } ] }, "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "CREATE", "trigger": "Create PLSS CR in infra-api", "conditions": ["Always"], "implementation": "infraAPI.CreatePrivateLinkService(ctx, plsCR)" } ] } }, "services": [] }, "CoreService.CreatePrivateLinkEndpoint": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "INSERT", "trigger": "Create private link endpoint record", "conditions": ["Always"], "implementation": "clusterModel.CreatePrivateLinkEndpoint(ctx, req)" } ] }, "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "CREATE", "trigger": "Create PLE CR in infra-api", "conditions": ["Always"], "implementation": "infraAPI.CreatePrivateLinkEndpoint(ctx, pleCR)" } ] } }, "services": [] }, "CoreService.GetMaintenanceWindowByProjectID": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "SELECT", "trigger": "Get maintenance window config", "conditions": ["Always"], "implementation": "maintenanceModel.GetMaintenanceWindow(ctx, projectID)" } ] } }, "services": [] }, "CoreService.CreateMaintenanceTask": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "INSERT", "trigger": "Create maintenance task record", "conditions": ["Always"], "implementation": "maintenanceModel.CreateMaintenanceTask(ctx, task)" } ] } }, "services": [] }, "CoreService.CleanClusters": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "SELECT", "trigger": "Load all active clusters for the tenant before deciding whether to perform dedicated-tier final-backup cleanup or dev-tier direct deletion", "conditions": ["Always when `req.IsDevTier` is true or false"], "implementation": "cleanFreeClusters / cleanNonDevTierClusters -> entity.NewClusterQuerySet(...).All(&clusters)" }, { "operation": "DELETE", "trigger": "Delete cluster rows and related backup rows from MySQL during the billing cleanup flow", "conditions": ["Dedicated tier uses `DeleteClusterAndMakeFinalBackup` for normal/scaling/pausing/paused/resuming clusters", "Developer tier deletes uncleared clusters and then deletes backup rows by cluster IDs"], "implementation": "dbutil.DeleteClusterAndMakeFinalBackup(ctx, tx, cluster.ID); dbutil.DeleteCluster(ctx, tx, cluster.ID); dbutil.DeleteBackupsByClusterIDs(tx, allClusterIDs)" } ] } }, "services": [] }, "CoreService.CleanTenantResource": { "infrastructure": { "kubernetes_api": { "conditions": ["Always"], "operations": [ { "operation": "DELETE", "trigger": "Delete tenant-scoped networks through infra-api during billing cleanup", "conditions": ["Always"], "implementation": "s.infraAPI.DeleteTenantNetworks(ctx, req.GetTenantId())" } ] } }, "services": [] }, "CoreService.DeleteCluster": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "SELECT", "trigger": "Load the operator user row before impersonating it for the internal delete flow", "conditions": ["Always before cluster deletion"], "implementation": "service.GetAndSetUserById(ctx, entity.ID(req.OperatorId)) -> dbutil.GetUserByUID(tx, uid)" } ] } }, "services": [ { "name": "core-svc", "target_interface": "GetClusterWithoutPermCheck", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Always"], "operations": [ { "operation": "GetClusterWithoutPermCheck", "trigger": "Load the cluster tenant/project identity before delegating to the internal cluster delete path", "conditions": ["Always after the operator user is loaded"], "implementation": "grpcli.GetClusterWithoutPermCheck(ctx, req.ClusterId)" } ] }, { "name": "cluster-model", "target_interface": "Delete", "target_repo": "tidbcloud/core-portal", "operation_type": "internal", "conditions": ["The cluster exists in core-svc"], "operations": [ { "operation": "Delete", "trigger": "Delete the cluster through the same internal cluster model used by the user-facing central service", "conditions": ["Only after the cluster lookup succeeds"], "implementation": "s.clusterModel.User(ctx, operator).Delete(ctx, entity.ID(cluster.TenantId), entity.ID(cluster.ProjectId), entity.ID(cluster.Id))" } ] } ] }, "CoreService.CheckSkuSynced": { "infrastructure": {}, "services": [] }, "CoreService.UpsertProfileByYaml": { "infrastructure": {}, "services": [] }, "CoreService.ListNodeProfiles4Tenant": { "infrastructure": {}, "services": [] }, "CoreService.BatchGetTiers": { "infrastructure": {}, "services": [] }, "CoreService.ListCloudProviders": { "infrastructure": {}, "services": [] }, "CoreService.QueryCloudProviders": { "infrastructure": {}, "services": [] }, "CoreService.ListCloudRegions": { "infrastructure": {}, "services": [] }, "CoreService.CreateIamRole": { "infrastructure": {}, "services": [] }, "CoreService.DeleteIamRole": { "infrastructure": {}, "services": [] }, "CoreService.ListIamRoles": { "infrastructure": {}, "services": [] }, "CoreService.CreateAwsCmek": { "infrastructure": {}, "services": [] }, "CoreService.GetAwsCmek": { "infrastructure": {}, "services": [] }, "CoreService.GetAwsAccount": { "infrastructure": {}, "services": [] }, "CoreService.GetClusterName": { "infrastructure": {}, "services": [] }, "CoreService.ChangeClusterPasswd": { "infrastructure": {}, "services": [] }, "CoreService.UpdateClusterTrafficFilter": { "infrastructure": {}, "services": [] }, "CoreService.CreateClusterSnapshot": { "infrastructure": {}, "services": [] }, "CoreService.ListClusterSnapshots": { "infrastructure": {}, "services": [] }, "CoreService.ScaleCluster": { "infrastructure": {}, "services": [] }, "CoreService.PauseCluster": { "infrastructure": {}, "services": [] }, "CoreService.ResumeCluster": { "infrastructure": {}, "services": [] }, "CoreService.ClearCluster": { "infrastructure": {}, "services": [] }, "CoreService.SetClusterReadonly": { "infrastructure": {}, "services": [] }, "CoreService.CalcClusterFee": { "infrastructure": {}, "services": [] }, "CoreService.CountClusters": { "infrastructure": {}, "services": [] }, "CoreService.GetClusterConfidentialInfo": { "infrastructure": {}, "services": [] }, "CoreService.CreateXAccountDeploy": { "infrastructure": {}, "services": [] }, "CoreService.ListXAccountDeploy": { "infrastructure": {}, "services": [] }, "CoreService.DeleteXAccountDeploy": { "infrastructure": {}, "services": [] }, "CoreService.GetClusterCACertificate": { "infrastructure": {}, "services": [] }, "CoreService.ListRegionCIDROfProject": { "infrastructure": {}, "services": [] }, "CoreService.CreateClusterConn": { "infrastructure": {}, "services": [] }, "CoreService.CreateNetworkPeer": { "infrastructure": {}, "services": [] }, "CoreService.DeleteNetworkPeer": { "infrastructure": {}, "services": [] }, "CoreService.ListNetworkPeer": { "infrastructure": {}, "services": [] }, "CoreService.DeletePrivateLinkService": { "infrastructure": {}, "services": [] }, "CoreService.GetPrivateLinkService": { "infrastructure": {}, "services": [] }, "CoreService.DeletePrivateLinkEndpoint": { "infrastructure": {}, "services": [] }, "CoreService.ListPrivateLinkEndpoints": { "infrastructure": {}, "services": [] }, "CoreService.CreateDBUser": { "infrastructure": {}, "services": [] }, "CoreService.UpdateDBUser": { "infrastructure": {}, "services": [] }, "CoreService.DeleteDBUser": { "infrastructure": {}, "services": [] }, "CoreService.GetDBUser": { "infrastructure": {}, "services": [] }, "CoreService.IsDBUserExisting": { "infrastructure": {}, "services": [] }, "CoreService.CreateDBRole": { "infrastructure": {}, "services": [] }, "CoreService.UpdateDBRole": { "infrastructure": {}, "services": [] }, "CoreService.ListDBUsers": { "infrastructure": {}, "services": [] }, "CoreService.SetClusterAuthPubKey": { "infrastructure": {}, "services": [] }, "CoreService.CreateClusterJob": { "infrastructure": {}, "services": [] }, "CoreService.DeleteClusterJob": { "infrastructure": {}, "services": [] }, "CoreService.IsClusterJobRegistered": { "infrastructure": {}, "services": [] }, "CoreService.ListClusterJobs": { "infrastructure": {}, "services": [] }, "CoreService.UpdateMaintenanceWindow": { "infrastructure": {}, "services": [] }, "CoreService.QueryMaintenanceTasks": { "infrastructure": {}, "services": [] }, "CoreService.CountMaintenanceTasks": { "infrastructure": {}, "services": [] }, "CoreService.DeferMaintenanceTask": { "infrastructure": {}, "services": [] }, "CoreService.UpdateMaintenanceTaskStatus": { "infrastructure": {}, "services": [] }, "CoreService.QueryMaintenanceTaskExecutions": { "infrastructure": {}, "services": [] }, "CoreService.UpdateMaintenanceTaskExecutionStatus": { "infrastructure": {}, "services": [] }, "CoreService.SyncMaintenanceWindow": { "infrastructure": {}, "services": [] }, "CoreService.GetClusterTopology": { "infrastructure": {}, "services": [] }, "CoreService.ExecuteCtlCommand": { "infrastructure": {}, "services": [] }, "CoreService.ListTenantQuota": { "infrastructure": {}, "services": [] }, "CoreService.UpdateTenantQuota": { "infrastructure": {}, "services": [] }, "CoreService.CreateAccessPoint": { "infrastructure": {}, "services": [] }, "CoreService.UpdateAccessPoint": { "infrastructure": {}, "services": [] }, "CoreService.DeleteAccessPoint": { "infrastructure": {}, "services": [] }, "CoreService.ListAccessPointPrivateLinkEndpoints": { "infrastructure": {}, "services": [] }, "CoreService.QueryAccessPoints": { "infrastructure": {}, "services": [] }, "CoreService.CreateCidr": { "infrastructure": {}, "services": [] }, "CoreService.QueryCidrs": { "infrastructure": {}, "services": [] }, "CoreService.UpdateCidr": { "infrastructure": {}, "services": [] }, "CoreService.DeleteCidr": { "infrastructure": {}, "services": [] }, "CoreService.GetDefaultCidr": { "infrastructure": {}, "services": [] }, "CoreService.SimulatedSelectTierUnit": { "infrastructure": {}, "services": [] }, "CoreService.CountBillableClusters": { "infrastructure": {}, "services": [] }, "Cluster.ListProviderRegions": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "SELECT", "trigger": "Load the tenant row to filter provider regions by marketplace restrictions after the node-profile list returns", "conditions": ["Always after `ListNodeProfiles4Tenant` succeeds"], "implementation": "dbutil.GetTenantByID(tx, entity.ID(orgID))" } ] } }, "services": [ { "name": "core-svc", "target_interface": "ListNodeProfiles4Tenant", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Always"], "operations": [ { "operation": "ListNodeProfiles4Tenant", "trigger": "Load the available node profiles for the caller tenant before grouping them by provider and region", "conditions": ["Always"], "implementation": "grpcli.ListNodeProfiles4Tenant(ctx, &core.ListNodeProfiles4TenantReq{TenantId: orgID})" } ] } ] }, "Cluster.CreateCluster": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "CreateCluster", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller has project permission", "Request passes `validateCreateClusterReq`", "Cloud provider and deploy type conversions succeed"], "operations": [ { "operation": "CreateCluster", "trigger": "Create the OpenAPI cluster through the downstream core service after composing components and traffic filters", "conditions": ["`IsDevTier` is true only when deploy type is shared", "Dev-tier requests synthesize fixed components; dedicated requests use explicit component config"], "implementation": "grpcli.CreateCluster(ctx, createClusterReq)" } ] }, { "name": "billing-model", "target_interface": "EnableOrgDevTier", "target_repo": "tidbcloud/core-portal", "operation_type": "internal", "conditions": ["The create request is for a developer tier cluster", "Cluster creation succeeded"], "operations": [ { "operation": "EnableOrgDevTier", "trigger": "Mark the organization as dev-tier-enabled in billing after a shared cluster is created", "conditions": ["Only when `createClusterReq.IsDevTier == true`"], "implementation": "billingCtx.EnableOrgDevTier()" } ] } ] }, "Cluster.GetCluster": { "infrastructure": { "kubernetes_api": { "conditions": ["The cluster status is one that should expose node details"], "operations": [ { "operation": "GET", "trigger": "Load the cluster CR from infra-api to build the node map for the OpenAPI response", "conditions": ["Only when `constant.DisplayNodeMap(clusterStatus)` is true"], "implementation": "s.infraAPI.GetCluster(ctx, cluster.ProjectId, cluster.Id)" } ] } }, "services": [ { "name": "core-svc", "target_interface": "ListClusters", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Always"], "operations": [ { "operation": "ListClusters", "trigger": "Load the requested cluster via the shared list API before permission check and response shaping", "conditions": ["Always"], "implementation": "getCluster(ctx, projectID, clusterID) -> grpcli.ListClusters(ctx, listReq)" } ] } ] }, "Cluster.ListClustersOfProject": { "infrastructure": { "kubernetes_api": { "conditions": ["At least one listed cluster has a status that should expose node details"], "operations": [ { "operation": "GET", "trigger": "Load cluster CRs from infra-api while building node maps for returned cluster items", "conditions": ["Per cluster, only when `constant.DisplayNodeMap(clusterStatus)` is true"], "implementation": "s.buildClusterItem(ctx, cluster) -> s.buildClusterNodeMap(ctx, cluster) -> s.infraAPI.GetCluster(ctx, cluster.ProjectId, cluster.Id)" } ] } }, "services": [ { "name": "core-svc", "target_interface": "ListClusters and CountClusters", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller has project permission"], "operations": [ { "operation": "ListClusters", "trigger": "Load the paginated project cluster list before converting items into the OpenAPI schema", "conditions": ["Page defaults to 1 when omitted", "PageSize defaults to 10 when omitted"], "implementation": "grpcli.ListClusters(ctx, &core.ListClustersReq{Filter: filter, Pager: pager, Sorters: []*base.Sorter{sorter}})" }, { "operation": "CountClusters", "trigger": "Load the total project cluster count for the same filter", "conditions": ["Always together with `ListClusters`"], "implementation": "grpcli.CountClusters(ctx, &core.CountClustersReq{Filter: filter})" } ] } ] }, "Cluster.UpdateCluster": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "ListClusters, ScaleCluster, PauseCluster, and ResumeCluster", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["The target cluster exists", "Caller has cluster permission"], "operations": [ { "operation": "ListClusters", "trigger": "Load the current cluster shape before deciding whether the update is a scale or pause/resume operation", "conditions": ["Always"], "implementation": "getCluster(ctx, projectID, clusterID) -> grpcli.ListClusters(ctx, listReq)" }, { "operation": "ScaleCluster", "trigger": "Apply component replica changes through core-svc", "conditions": ["`req.Config.Components != nil`", "Computed components differ from the existing cluster shape"], "implementation": "updateClusterComponents(ctx, cluster, req) -> grpcli.ScaleCluster(ctx, scaleClusterReq)" }, { "operation": "PauseCluster / ResumeCluster", "trigger": "Toggle the cluster paused state through core-svc", "conditions": ["`req.Config.Paused != nil`", "`req.Config.Components == nil`"], "implementation": "pauseOrResumeCluster(ctx, *paused, clusterID) -> grpcli.PauseCluster / grpcli.ResumeCluster" } ] } ] }, "Cluster.DeleteCluster": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "ListClusters", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Always"], "operations": [ { "operation": "ListClusters", "trigger": "Load the target cluster via the shared list API before permission check and delete", "conditions": ["Always"], "implementation": "getCluster(ctx, projectID, clusterID) -> grpcli.ListClusters(ctx, listReq)" } ] }, { "name": "cluster-model", "target_interface": "Delete", "target_repo": "tidbcloud/core-portal", "operation_type": "internal", "conditions": ["Caller has cluster permission"], "operations": [ { "operation": "Delete", "trigger": "Delete the cluster through the same internal user-context model used by the central gRPC surface", "conditions": ["Only after the cluster lookup and permission check succeed"], "implementation": "userContext.Delete(ctx, orgID, entity.ID(projectID), entity.ID(clusterID))" } ] } ] }, "Cluster.CreateAwsCmek": { "infrastructure": {}, "services": [] }, "Cluster.ListAwsCmek": { "infrastructure": {}, "services": [] }, "Cluster.CreatePrivateEndpointService": { "infrastructure": {}, "services": [] }, "Cluster.GetPrivateEndpointService": { "infrastructure": {}, "services": [] }, "Cluster.ListPrivateEndpointsOfProject": { "infrastructure": {}, "services": [] }, "Cluster.CreatePrivateEndpoint": { "infrastructure": {}, "services": [] }, "Cluster.ListPrivateEndpoints": { "infrastructure": {}, "services": [] }, "Cluster.DeletePrivateEndpoint": { "infrastructure": {}, "services": [] }, "Cluster.CreateAccesspoint": { "infrastructure": {}, "services": [] }, "Cluster.GetAccesspoint": { "infrastructure": {}, "services": [] }, "Cluster.ListAccesspoints": { "infrastructure": {}, "services": [] }, "Cluster.UpdateAccesspoint": { "infrastructure": {}, "services": [] }, "Cluster.DeleteAccesspoint": { "infrastructure": {}, "services": [] }, "Cluster.CreatePrivateLinkEndpoint": { "infrastructure": {}, "services": [] }, "Cluster.GetPrivateLinkEndpoint": { "infrastructure": {}, "services": [] }, "Cluster.ListPrivateLinkEndpoints": { "infrastructure": {}, "services": [] }, "Cluster.DeletePrivateLinkEndpoint": { "infrastructure": {}, "services": [] }, "TenantService.CreateIamRole": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "INSERT", "trigger": "Create IAM role record", "conditions": ["Always"], "implementation": "tenantModel.CreateIamRole(ctx, role)" } ] } }, "services": [] }, "TenantService.CreateCrossAccountDeployment": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "INSERT", "trigger": "Create cross-account deployment record", "conditions": ["Always"], "implementation": "tenantModel.CreateCrossAccountDeployment(ctx, deployment)" } ] }, "aws": { "conditions": ["provider == aws"], "operations": [ { "operation": "ValidateAccount", "trigger": "Validate AWS cross-account setup", "conditions": ["provider == aws"], "implementation": "awsConfig.ValidateCrossAccount(deployment)" } ] } }, "services": [] }, "TenantService.ListIamRoles": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "ListIamRoles", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "ListIamRoles", "trigger": "List all IAM roles attached to the project and convert them into central response objects", "conditions": ["Always after permission checks"], "implementation": "grpcli.ListIamRoles(ctx, &core.ListIamRolesReq{Filter: &core.IamRoleFilter{ProjectIds: []uint64{projectID.Uint64()}}})" } ] } ] }, "TenantService.DeleteIamRole": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "DeleteIamRole", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "DeleteIamRole", "trigger": "Delete the selected IAM role from the project", "conditions": ["Always after permission checks"], "implementation": "grpcli.DeleteIamRole(ctx, &core.DeleteIamRoleReq{RoleId: req.Id})" } ] } ] }, "TenantService.ListCrossAccountDeployments": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "ListCrossAccountDeployments", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "ListCrossAccountDeployments", "trigger": "List cross-account deployment records for the project and convert them into central response objects", "conditions": ["Always after permission checks"], "implementation": "grpcli.ListCrossAccountDeployments(ctx, &core.ListXAccountDeployReq{Filter: &core.XAccountDeployFilter{ProjectIds: []uint64{projectID.Uint64()}}})" } ] } ] }, "TenantService.DeleteCrossAccountDeployment": { "infrastructure": {}, "services": [ { "name": "core-svc", "target_interface": "DeleteCrossAccountDeployment", "target_repo": "tidbcloud/core-svc", "operation_type": "grpc", "conditions": ["Caller OrgID and ProjectID pass permission checks"], "operations": [ { "operation": "DeleteCrossAccountDeployment", "trigger": "Delete the selected cross-account deployment record from the project", "conditions": ["Always after permission checks"], "implementation": "grpcli.DeleteCrossAccountDeployment(ctx, &core.DeleteXAccountDeployReq{XaccountDeployId: req.Id})" } ] } ] }, "TenantService.GetTiDBCloudDelegationInfo": { "infrastructure": {}, "services": [] }, "TestTokenService.GenerateTestToken": { "infrastructure": { "crypto": { "conditions": ["Supplied Auth0 domain, client ID, and client secret exactly match the configured test-token settings"], "operations": [ { "operation": "ENCRYPT", "trigger": "Generate the short-lived local test token by serializing the email claim and encrypting it with the configured AES helper", "conditions": ["Credentials match the configured management values"], "implementation": "testTokenService.GenerateTestToken -> s.model.GenerateTestToken(...) -> m.aesCrypt.Encrypt(data)" } ] } }, "services": [] }, "HTTPHandlers.Healthz": { "infrastructure": { "http_listener": { "conditions": ["Always when the binary is running", "Registered either on the health-only Gin server or the main gateway Gin engine"], "operations": [ { "operation": "WRITE STATUS", "trigger": "Return `200` without touching downstream services", "conditions": ["`enableApiService() == false` uses the minimal health-only Gin server", "`enableApiService() == true` uses the main grpc-gateway Gin engine"], "implementation": "eng.Any(\"/healthz\", ...); ginEng.Any(\"/healthz\", func(c *gin.Context) { c.Status(200) })" } ] } }, "services": [] }, "HTTPHandlers.Version": { "infrastructure": { "http_listener": { "conditions": ["Always when the binary is running", "Registered either on the health-only Gin server or the main gateway Gin engine"], "operations": [ { "operation": "WRITE JSON", "trigger": "Return the in-process Git hash payload without making downstream calls", "conditions": ["`enableApiService() == false` uses the minimal health-only Gin server", "`enableApiService() == true` uses the main grpc-gateway Gin engine"], "implementation": "versionHandler -> json.Marshal(versionInfo{Hash: version.GitHash})" } ] } }, "services": [] }, "HTTPHandlers.Metrics": { "infrastructure": { "prometheus": { "conditions": ["config2.Global().ServerConfig.MetricsPort > 0"], "operations": [ { "operation": "Collect", "trigger": "Collect Prometheus metrics", "conditions": ["Only on the separate metrics listener when `MetricsPort > 0`"], "implementation": "promhttp.Handler()" } ] } }, "services": [] }, "HTTPHandlers.PprofIndex": { "infrastructure": { "http_listener": { "conditions": ["config2.Global().ServerConfig.MetricsPort > 0"], "operations": [ { "operation": "SERVE PPROF", "trigger": "Expose the pprof index on the separate metrics listener", "conditions": ["Only when `MetricsPort > 0`"], "implementation": "setupPprofHandler(mux); mux.HandleFunc(\"/debug/pprof/\", pprof.Index)" } ] } }, "services": [] }, "HTTPHandlers.PprofCmdline": { "infrastructure": { "http_listener": { "conditions": ["config2.Global().ServerConfig.MetricsPort > 0"], "operations": [ { "operation": "SERVE PPROF", "trigger": "Expose the pprof cmdline endpoint on the separate metrics listener", "conditions": ["Only when `MetricsPort > 0`"], "implementation": "setupPprofHandler(mux); mux.HandleFunc(\"/debug/pprof/cmdline\", pprof.Cmdline)" } ] } }, "services": [] }, "HTTPHandlers.PprofProfile": { "infrastructure": { "http_listener": { "conditions": ["config2.Global().ServerConfig.MetricsPort > 0"], "operations": [ { "operation": "SERVE PPROF", "trigger": "Expose the CPU profile endpoint on the separate metrics listener", "conditions": ["Only when `MetricsPort > 0`"], "implementation": "setupPprofHandler(mux); mux.HandleFunc(\"/debug/pprof/profile\", pprof.Profile)" } ] } }, "services": [] }, "HTTPHandlers.PprofSymbol": { "infrastructure": { "http_listener": { "conditions": ["config2.Global().ServerConfig.MetricsPort > 0"], "operations": [ { "operation": "SERVE PPROF", "trigger": "Expose the pprof symbol endpoint on the separate metrics listener", "conditions": ["Only when `MetricsPort > 0`"], "implementation": "setupPprofHandler(mux); mux.HandleFunc(\"/debug/pprof/symbol\", pprof.Symbol)" } ] } }, "services": [] }, "HTTPHandlers.PprofTrace": { "infrastructure": { "http_listener": { "conditions": ["config2.Global().ServerConfig.MetricsPort > 0"], "operations": [ { "operation": "SERVE PPROF", "trigger": "Expose the execution trace endpoint on the separate metrics listener", "conditions": ["Only when `MetricsPort > 0`"], "implementation": "setupPprofHandler(mux); mux.HandleFunc(\"/debug/pprof/trace\", pprof.Trace)" } ] } }, "services": [] }, "HTTPHandlers.Proxy": { "infrastructure": { "prometheus": { "conditions": ["Path matches `/proxy/*any`", "Request is not short-circuited by OPTIONS or middleware rejection"], "operations": [ { "operation": "OBSERVE", "trigger": "Record proxy request latency and final status code for tenant traffic", "conditions": ["Only when `newProxyMetricsHandler` runs the wrapped handler"], "implementation": "newProxyMetricsHandler -> metrics2.ProxyRequestDuration.WithLabelValues(...).Observe(duration)" } ] } }, "services": [ { "name": "auth0-m2m", "target_interface": "Auth0 client credentials token endpoint", "target_repo": "auth0", "operation_type": "http", "conditions": ["Path matches `/proxy/*any`", "The request survives the auth and path-filter middleware chain", "The proxy target resolves successfully"], "operations": [ { "operation": "GET CLIENT TOKEN", "trigger": "Fetch a machine token that is injected into proxied requests before they leave the binary", "conditions": ["Only after `mesh.ProxyShootEndpoint(clusterModel)` returns a target"], "implementation": "proxy.NewAuth0M2MAuth(...)->auth0.GetClientToken(domain, clientID, clientSecret, audience)" } ] }, { "name": "tenant-cluster-runtime", "target_interface": "dashboard, metrics, and generic cluster proxy endpoints", "target_repo": "tenant cluster runtime", "operation_type": "http_proxy", "conditions": ["Path matches `/proxy/*any`", "OPTIONS requests stop in `mwCORS` and are not proxied", "Auth succeeds through test-token, Auth0, or debug-session middleware", "Paths matching `debug_api` require `debugAuth.IsDebugSessionAuth(ctx)`", "Paths matching `query_editor` or `configuration/edit` are rejected with `403`", "The target cluster endpoint resolves successfully"], "operations": [ { "operation": "RESOLVE TARGET", "trigger": "Choose the downstream base URL from the request path and cluster metadata before proxying", "conditions": ["Metrics paths use `FindClusterMetricsBaseURL`", "Dashboard paths use `FindClusterDashboardBaseURL`", "All other paths use `FindClusterProxyBaseURL`"], "implementation": "mesh.ProxyShootEndpoint(clusterModel)" }, { "operation": "REVERSE PROXY", "trigger": "Forward the rewritten request to the resolved tenant endpoint", "conditions": ["Only after terminal-path rewrite and Auth0 M2M token injection succeed"], "implementation": "proxy.NewReverseProxy(proxyAuthenticator, mesh.ProxyShootEndpoint(clusterModel)).ServeHTTP(w, r)" } ] } ] }, "AdminRoutes.ExternalReplaceNodeAndSKU": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "UPDATE", "trigger": "Replace node and SKU by YAML", "conditions": ["Always"], "implementation": "profileModel.UpdateByYaml(ctx, yaml)" } ] } }, "services": [] }, "AdminRoutes.ListTenantClusters": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "SELECT", "trigger": "List tenant clusters", "conditions": ["Always"], "implementation": "clusterModel.ListClusters(ctx, orgID)" } ] } }, "services": [] }, "AdminRoutes.DeleteTenantCluster": { "infrastructure": { "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "DELETE", "trigger": "Delete tenant cluster", "conditions": ["Always"], "implementation": "infraAPI.DeleteCluster(ctx, orgID, projectID, clusterID)" } ] }, "mysql": { "conditions": ["Always"], "operations": [ { "operation": "DELETE", "trigger": "Delete cluster record", "conditions": ["Always"], "implementation": "clusterModel.DeleteCluster(ctx, orgID, projectID, clusterID)" } ] } }, "services": [] }, "AdminRoutes.ScaleTenantCluster": { "infrastructure": { "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "UPDATE", "trigger": "Scale tenant cluster components", "conditions": ["Always"], "implementation": "infraAPI.ScaleCluster(ctx, orgID, projectID, clusterID, components)" } ] } }, "services": [] }, "AdminRoutes.PauseTenantCluster": { "infrastructure": { "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "UPDATE", "trigger": "Pause tenant cluster", "conditions": ["Always"], "implementation": "infraAPI.PauseCluster(ctx, orgID, projectID, clusterID)" } ] } }, "services": [] }, "AdminRoutes.ResumeTenantCluster": { "infrastructure": { "kubernetes": { "conditions": ["Always"], "operations": [ { "operation": "UPDATE", "trigger": "Resume tenant cluster", "conditions": ["Always"], "implementation": "infraAPI.ResumeCluster(ctx, orgID, projectID, clusterID)" } ] } }, "services": [] }, "AdminRoutes.GetDashboardLinks": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "SELECT", "trigger": "Get dashboard links", "conditions": ["Always"], "implementation": "clusterModel.GetDashboardLinks(ctx, orgID, clusterID)" } ] } }, "services": [] }, "AdminRoutes.ListTenantClusterLifeCycle": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "SELECT", "trigger": "List tenant cluster lifecycle events", "conditions": ["Always"], "implementation": "clusterModel.ListClusterLifeCycle(ctx, orgID)" } ] } }, "services": [] }, "AdminRoutes.AddProvider": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "INSERT", "trigger": "Add cloud provider", "conditions": ["Always"], "implementation": "providerModel.AddProvider(ctx, provider)" } ] } }, "services": [] }, "AdminRoutes.ListProviders": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "SELECT", "trigger": "List cloud providers", "conditions": ["Always"], "implementation": "providerModel.ListProviders(ctx)" } ] } }, "services": [] }, "AdminRoutes.AddRegion": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "INSERT", "trigger": "Add region to provider", "conditions": ["Always"], "implementation": "regionModel.AddRegion(ctx, provider, region)" } ] } }, "services": [] }, "AdminRoutes.UpdateRegion": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "UPDATE", "trigger": "Update region", "conditions": ["Always"], "implementation": "regionModel.UpdateRegion(ctx, provider, regionID, region)" } ] } }, "services": [] }, "AdminRoutes.ListRegions": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "SELECT", "trigger": "List regions for provider", "conditions": ["Always"], "implementation": "regionModel.ListRegions(ctx, provider)" } ] } }, "services": [] }, "AdminRoutes.GetRegionByID": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "SELECT", "trigger": "Get region by ID", "conditions": ["Always"], "implementation": "regionModel.GetRegionByID(ctx, provider, regionID)" } ] } }, "services": [] }, "AdminRoutes.CalcNodeProfiles": { "infrastructure": { "mysql": { "conditions": ["Always"], "operations": [ { "operation": "SELECT", "trigger": "Query and calculate node profiles", "conditions": ["Always"], "implementation": "profileModel.QueryProfiles(ctx, query)" } ] } }, "services": [] } } }