{ "repo": "tidbcloud/infra-api", "binary": "infra-provider", "binary_path": "cmd/infra-provider/main.go", "dependencies": { "Runtime InfraProviderLifecycle.LoadFlagsAndLogger": { "infrastructure": { "runtime_flags": [ { "operation": "PARSE FLAGS", "target": "metrics-bind-address, pprof, health-probe-bind-address, leader-elect, config, namespace, enable-gitops-v2, enable-o11y-agent", "conditions": [ "Always at process start" ], "implementation": "cmd/infra-provider/main.go:99-121" } ] }, "services": [] }, "Runtime InfraProviderLifecycle.LoadControllerConfig": { "infrastructure": { "filesystem": [ { "operation": "READ FILE", "target": "controller config file referenced by --config", "conditions": [ "--config is non-empty" ], "implementation": "cmd/infra-provider/main.go:139-148" } ] }, "services": [] }, "Runtime InfraProviderLifecycle.ValidateControllerConfig": { "infrastructure": {}, "services": [] }, "Runtime InfraProviderLifecycle.OverrideGardenerConfigFromEnv": { "infrastructure": { "environment": [ { "operation": "READ ENV", "target": "GARDENER_CONFIG", "conditions": [ "Environment variable is present" ], "implementation": "cmd/infra-provider/main.go:163-165" } ] }, "services": [] }, "Runtime InfraProviderLifecycle.CreateManager": { "infrastructure": { "kubernetes_api": [ { "operation": "BUILD MANAGER CLIENTS", "target": "controller-runtime manager, cache, webhook server, metrics server, and probe server", "conditions": [ "Always after config validation" ], "implementation": "cmd/infra-provider/main.go:167-171" } ] }, "services": [] }, "Runtime InfraProviderLifecycle.LoadProviderClients": { "infrastructure": { "aws": [ { "operation": "LOAD DEFAULT CONFIG", "target": "ambient AWS credentials and region config", "conditions": [ "Always" ], "implementation": "cmd/infra-provider/main.go:173-182" } ], "gcp": [ { "operation": "INITIALIZE DEFAULT API", "target": "default GCP API client", "conditions": [ "Always" ], "implementation": "cmd/infra-provider/main.go:184-188" } ] }, "services": [] }, "Runtime InfraProviderLifecycle.InitO11yApi": { "infrastructure": { "environment": [ { "operation": "READ ENV", "target": "O11Y_AUTH0_CLIENT_ID and O11Y_AUTH0_CLIENT_SECRET", "conditions": [ "--enable-o11y-agent=true" ], "implementation": "pkg/o11y/api.go:40-49" } ] }, "services": [ { "name": "auth0", "target_interface": "POST token endpoint", "operation_type": "http_post", "target_repo": "auth0", "conditions": [ "--enable-o11y-agent=true" ], "operations": [ { "operation": "FETCH ACCESS TOKEN", "trigger": "Initialize the o11y API client and refresh its first bearer token", "conditions": [ "Client ID and client secret are non-empty after env override" ], "implementation": "pkg/o11y/api.go:40-66" } ] } ] }, "Runtime InfraProviderLifecycle.InitGardenerEnvironment": { "infrastructure": { "filesystem": [ { "operation": "READ FILE", "target": "gardener kubeconfig path", "conditions": [ "ctrlConfig.Gardener.KubeConfigPath is non-empty after optional env override" ], "implementation": "pkg/gardener/shoot_cluster.go:108-121" } ], "kubernetes_api": [ { "operation": "BUILD SECONDARY MANAGER", "target": "gardener manager watching garden-{projectName}", "conditions": [ "Always when gardener.NewGardEnvironment(...) succeeds" ], "implementation": "pkg/gardener/shoot_cluster.go:124-141" } ] }, "services": [] }, "Runtime InfraProviderLifecycle.RegisterControllers": { "infrastructure": {}, "services": [] }, "Runtime InfraProviderLifecycle.RegisterWebhooks": { "infrastructure": { "environment": [ { "operation": "READ ENV", "target": "ENABLE_WEBHOOKS", "conditions": [ "Always" ], "implementation": "cmd/infra-provider/main.go:356-362" } ] }, "services": [] }, "Runtime InfraProviderLifecycle.RegisterHealthAndPprof": { "infrastructure": {}, "services": [] }, "Runtime InfraProviderLifecycle.SetupAudit": { "infrastructure": {}, "services": [] }, "Runtime InfraProviderLifecycle.StartLeaderWorker": { "infrastructure": { "kubernetes_api": [ { "operation": "REGISTER METRICS COLLECTORS", "target": "infra and gardener custom collectors attached to the process metrics registry", "conditions": [ "Only after mgr.Elected() fires" ], "implementation": "cmd/infra-provider/main.go:395-402" } ], "gardener_api": [ { "operation": "START SECONDARY MANAGERS", "target": "gardenerEnv manager and any shoot managers", "conditions": [ "Only after mgr.Elected() fires" ], "implementation": "cmd/infra-provider/main.go:395-406, pkg/gardener/shoot_cluster.go:158-188" } ] }, "services": [] }, "Runtime InfraProviderLifecycle.StartManager": { "infrastructure": { "kubernetes_api": [ { "operation": "LIST/WATCH/GET/CREATE/UPDATE/DELETE", "target": "all controller-managed CRDs and owned resources", "conditions": [ "Always after registration completes" ], "implementation": "cmd/infra-provider/main.go:408-411" }, { "operation": "LEADER ELECTION", "target": "controller-runtime leader-election lock", "conditions": [ "Only when --leader-elect=true or config enables leader election" ], "implementation": "cmd/infra-provider/main.go:102-138, 408-411" } ] }, "services": [] }, "Runtime InfraProviderController.ProviderTypeReconcile": { "infrastructure": { "kubernetes_api": [ { "operation": "GET/UPDATE/LIST", "target": "ProviderType plus Provider objects labeled with the reconciler's provider type", "conditions": [ "Only for ProviderType objects whose providerType label matches the controller instance" ], "implementation": "controllers/providertype/providertype_controller.go:47-88" } ] }, "services": [] }, "Runtime InfraProviderController.ClusterReconcile": { "infrastructure": { "kubernetes_api": [ { "operation": "GET/LIST/CREATE/UPDATE/DELETE", "target": "Cluster, Secret, ConfigMap, TiDB operator resources, and related owned objects", "conditions": [ "Always when ClusterReconciler.Reconcile runs" ], "implementation": "controllers/cluster/cluster_controller.go:166-894" } ], "gardener_api": [ { "operation": "GET/CREATE/UPDATE/DELETE", "target": "Shoot, SecretBinding, and other gardener-side resources", "conditions": [ "For gardener-backed provider types" ], "implementation": "controllers/cluster/cluster_controller.go:166-894" } ], "aws": [ { "operation": "KMS/IAM/Route53/ELB/EC2/S3 API CALLS", "target": "provider-managed AWS infrastructure for the cluster", "conditions": [ "provider type is AWS" ], "implementation": "controllers/cluster/cluster_creation.go, controllers/cluster/cluster_reconcilation.go, controllers/cluster/cluster_privatelink.go" } ], "gcp": [ { "operation": "COMPUTE/DNS/IAM/STORAGE/CLOUD RESOURCE MANAGER API CALLS", "target": "provider-managed GCP infrastructure for the cluster", "conditions": [ "provider type is GCP" ], "implementation": "controllers/cluster/cluster_creation.go, controllers/cluster/cluster_reconcilation.go" } ] }, "services": [ { "name": "config-service", "target_interface": "configsdk.Interface methods used by cluster reconciliation", "operation_type": "sdk_call", "target_repo": "tidbcloud/config-service", "conditions": [ "Always during cluster reconcile" ], "operations": [ { "operation": "FETCH CLUSTER CONFIGURATION", "trigger": "Resolve desired cluster configuration before create/update flows", "conditions": [ "Always" ], "implementation": "cmd/infra-provider/main.go:190-191, controllers/cluster/cluster_controller.go:166-894" } ] }, { "name": "o11y-service", "target_interface": "Create/Get/Delete o11y infra", "operation_type": "http_client", "target_repo": "tidbcloud/o11y", "conditions": [ "--enable-o11y-agent=true" ], "operations": [ { "operation": "CREATE/GET/DELETE O11Y INFRA", "trigger": "Manage observability infrastructure alongside cluster lifecycle", "conditions": [ "Only when o11y agent support is enabled" ], "implementation": "cmd/infra-provider/main.go:232-248, controllers/cluster/cluster_controller.go:166-894" } ] } ] }, "Runtime InfraProviderController.NetworkReconcile": { "infrastructure": { "kubernetes_api": [ { "operation": "GET", "target": "Network, Provider, and ProviderType resources", "conditions": [ "Always" ], "implementation": "controllers/network_controller.go:66-96" }, { "operation": "GET/LIST/CREATE/UPDATE/DELETE", "target": "Network plus owned S3/GCP bucket and service-account resources", "conditions": [ "After the provider-specific network reconciler is selected" ], "implementation": "controllers/network_controller.go:97-144, controllers/provider/gardener/network.go:116-1771" } ], "gardener_api": [ { "operation": "GET/CREATE/UPDATE/DELETE", "target": "Shoot and related gardener resources for the network", "conditions": [ "For gardener-backed provider types" ], "implementation": "controllers/provider/gardener/network.go:116-1771" } ], "aws": [ { "operation": "EC2/Route53/S3/IAM API CALLS", "target": "VPC, subnets, IAM roles, buckets, and DNS resources", "conditions": [ "provider type is AWS" ], "implementation": "controllers/provider/gardener/network.go:116-1771" } ], "gcp": [ { "operation": "COMPUTE/DNS/IAM/STORAGE API CALLS", "target": "PSC, firewall, DNS, IAM, and bucket resources", "conditions": [ "provider type is GCP" ], "implementation": "controllers/provider/gardener/network.go:116-1771" } ] }, "services": [ { "name": "o11y-service", "target_interface": "Create/Get/Delete o11y infra", "operation_type": "http_client", "target_repo": "tidbcloud/o11y", "conditions": [ "--enable-o11y-agent=true" ], "operations": [ { "operation": "CREATE/GET/DELETE O11Y INFRA", "trigger": "Provision or remove shared observability infrastructure for network-level agents", "conditions": [ "Only when o11y agent support is enabled" ], "implementation": "controllers/network_controller.go:97-144, controllers/provider/gardener/network.go:116-1771" } ] } ] }, "Runtime InfraProviderController.HibernationReconcile": { "infrastructure": { "gardener_api": [ { "operation": "GET", "target": "Shoot named by the reconcile request", "conditions": [ "Always" ], "implementation": "pkg/gardener/hibernation/hibernation_controller.go:48-62" } ] }, "services": [] }, "Runtime InfraProviderController.HibernationEstimatorLoop": { "infrastructure": { "kubernetes_api": [ { "operation": "LIST", "target": "Network and Cluster objects used to detect idle shoots", "conditions": [ "Each checkIdleInterval tick after gardener.Started() becomes true" ], "implementation": "pkg/gardener/hibernation/hibernation_controller.go:65-204" } ], "gardener_api": [ { "operation": "GET/UPDATE", "target": "Shoot objects and shoot contexts used during idle evaluation and hibernation", "conditions": [ "Network phase is normal, the shoot is not already hibernating, and the idle threshold is exceeded" ], "implementation": "pkg/gardener/hibernation/hibernation_controller.go:91-220" } ] }, "services": [] }, "Runtime InfraProviderController.NetworkPeerReconcile": { "infrastructure": { "kubernetes_api": [ { "operation": "GET/LIST/CREATE/UPDATE/DELETE", "target": "NetworkPeer and referenced Network objects", "conditions": [ "Always" ], "implementation": "controllers/networkpeer/networkpeer_controller.go:126-624" } ], "aws": [ { "operation": "EC2 VPC PEERING API CALLS", "target": "AWS VPC peering connections", "conditions": [ "provider type is AWS" ], "implementation": "controllers/networkpeer/networkpeer_controller.go:299-529" } ], "gcp": [ { "operation": "NETWORKS ADD PEERING", "target": "GCP VPC peering", "conditions": [ "provider type is GCP" ], "implementation": "controllers/networkpeer/networkpeer_controller.go:299-529" } ] }, "services": [] }, "Runtime InfraProviderController.ImportReconcile": { "infrastructure": { "kubernetes_api": [ { "operation": "GET/LIST/CREATE/UPDATE/DELETE", "target": "Import resources plus cluster/job/secrets touched during import lifecycle", "conditions": [ "Always" ], "implementation": "controllers/imports/import_controller.go:117-864" } ], "gardener_api": [ { "operation": "GET SHOOT CONTEXT", "target": "target shoot used for import execution", "conditions": [ "For gardener-backed provider types" ], "implementation": "controllers/imports/import_controller.go:206-864" } ] }, "services": [ { "name": "config-service", "target_interface": "configsdk.Interface methods used by import reconciliation", "operation_type": "sdk_call", "target_repo": "tidbcloud/config-service", "conditions": [ "Always during import reconcile" ], "operations": [ { "operation": "FETCH IMPORT-RELATED CLUSTER CONFIGURATION", "trigger": "Resolve cluster configuration and manifests for import jobs", "conditions": [ "Always" ], "implementation": "cmd/infra-provider/main.go:329-330, controllers/imports/import_controller.go:117-864" } ] } ] }, "Runtime InfraProviderController.BackupReconcile": { "infrastructure": { "kubernetes_api": [ { "operation": "GET/LIST/CREATE/UPDATE/DELETE", "target": "Backup resources, secrets, and related owned objects", "conditions": [ "Always" ], "implementation": "controllers/backup/backup_controller.go:85-808" } ], "gardener_api": [ { "operation": "GET SHOOT CONTEXT", "target": "shoot resources used during backup orchestration", "conditions": [ "For gardener-backed provider types" ], "implementation": "controllers/backup/backup_controller.go:114-808" } ], "aws": [ { "operation": "S3 API CALLS", "target": "backup bucket lifecycle and policies", "conditions": [ "provider type is AWS" ], "implementation": "controllers/backup/backup_controller.go:346-647" } ], "gcp": [ { "operation": "STORAGE API CALLS", "target": "backup bucket IAM and access setup", "conditions": [ "provider type is GCP" ], "implementation": "controllers/backup/backup_controller.go:346-647" } ] }, "services": [ { "name": "config-service", "target_interface": "configsdk.Interface methods used by backup reconciliation", "operation_type": "sdk_call", "target_repo": "tidbcloud/config-service", "conditions": [ "Always during backup reconcile" ], "operations": [ { "operation": "FETCH BACKUP CONFIGURATION", "trigger": "Resolve backup-specific cluster configuration before create/update flows", "conditions": [ "Always" ], "implementation": "cmd/infra-provider/main.go:332-335, controllers/backup/backup_controller.go:85-808" } ] } ] }, "Runtime InfraProviderController.RestoreReconcile": { "infrastructure": { "kubernetes_api": [ { "operation": "GET/LIST/CREATE/UPDATE/DELETE", "target": "Restore resources, secrets, and related owned objects", "conditions": [ "Always" ], "implementation": "controllers/backup/restore_controller.go:100-780" } ], "gardener_api": [ { "operation": "GET SHOOT CONTEXT", "target": "shoot resources used during restore orchestration", "conditions": [ "For gardener-backed provider types" ], "implementation": "controllers/backup/restore_controller.go:141-780" } ], "aws": [ { "operation": "S3 API CALLS", "target": "restore source bucket and access policies", "conditions": [ "provider type is AWS" ], "implementation": "controllers/backup/restore_controller.go:391-780" } ], "gcp": [ { "operation": "STORAGE API CALLS", "target": "restore source bucket access setup", "conditions": [ "provider type is GCP" ], "implementation": "controllers/backup/restore_controller.go:391-780" } ] }, "services": [ { "name": "config-service", "target_interface": "configsdk.Interface methods used by restore reconciliation", "operation_type": "sdk_call", "target_repo": "tidbcloud/config-service", "conditions": [ "Always during restore reconcile" ], "operations": [ { "operation": "FETCH RESTORE CONFIGURATION", "trigger": "Resolve restore-specific cluster configuration before create/update flows", "conditions": [ "Always" ], "implementation": "cmd/infra-provider/main.go:337-340, controllers/backup/restore_controller.go:100-780" } ] } ] }, "Runtime InfraProviderController.TiCDCReconcile": { "infrastructure": { "kubernetes_api": [ { "operation": "GET/LIST/CREATE/UPDATE/DELETE", "target": "TiCDC, Cluster, Network, Deployment, Service, and certificate resources", "conditions": [ "Always" ], "implementation": "controllers/ticdc/ticdc_controller.go:678-711 and surrounding helper methods" } ], "gardener_api": [ { "operation": "GET SHOOT CONTEXT", "target": "upstream and downstream shoot contexts for TiCDC deployment", "conditions": [ "For gardener-backed provider types" ], "implementation": "controllers/ticdc/ticdc_controller.go:88-220" } ] }, "services": [ { "name": "config-service", "target_interface": "configsdk.Interface methods used by TiCDC reconciliation", "operation_type": "sdk_call", "target_repo": "tidbcloud/config-service", "conditions": [ "Always during TiCDC reconcile" ], "operations": [ { "operation": "FETCH CLUSTER CONFIGURATION", "trigger": "Resolve topology and manifest values for TiCDC deployment", "conditions": [ "Always" ], "implementation": "cmd/infra-provider/main.go:344-352, controllers/ticdc/ticdc_controller.go:678-711" } ] } ] }, "HTTP POST /mutate-cloud-pingcap-com-v1-account": { "infrastructure": {}, "services": [] }, "HTTP POST /validate-cloud-pingcap-com-v1-account": { "infrastructure": {}, "services": [] }, "HTTP POST /mutate-cloud-pingcap-com-v1-providertype": { "infrastructure": {}, "services": [] }, "HTTP POST /validate-cloud-pingcap-com-v1-providertype": { "infrastructure": {}, "services": [] }, "HTTP POST /mutate-cloud-pingcap-com-v1-provider": { "infrastructure": {}, "services": [] }, "HTTP POST /validate-cloud-pingcap-com-v1-provider": { "infrastructure": { "kubernetes_api": [ { "operation": "GET", "target": "ProviderType named by spec.type", "conditions": [ "Always during Provider create/update validation" ], "implementation": "api/v1/provider_webhook.go:42-80" } ] }, "services": [] }, "HTTP POST /mutate-cloud-pingcap-com-v1-networkpeer": { "infrastructure": { "kubernetes_api": [ { "operation": "GET", "target": "source Network referenced by spec.source", "conditions": [ "Always during defaulting" ], "implementation": "api/v1/networkpeer_webhook.go:29-43" } ] }, "services": [] }, "HTTP POST /validate-cloud-pingcap-com-v1-networkpeer": { "infrastructure": { "kubernetes_api": [ { "operation": "GET", "target": "source Network and optional target Network referenced by the peering request", "conditions": [ "Always during create validation" ], "implementation": "api/v1/networkpeer_webhook.go:55-118" } ] }, "services": [] }, "HTTP POST /mutate-cloud-pingcap-com-v1-import": { "infrastructure": { "kubernetes_api": [ { "operation": "GET", "target": "Cluster referenced by spec.clusterName", "conditions": [ "Only when the Import resource is not marked as migrated" ], "implementation": "api/v1/import_webhook.go:54-72" } ] }, "services": [] }, "HTTP POST /validate-cloud-pingcap-com-v1-import": { "infrastructure": { "kubernetes_api": [ { "operation": "GET", "target": "Cluster and Network objects used to validate source storage compatibility", "conditions": [ "Only when the Import resource is not marked as migrated" ], "implementation": "api/v1/import_webhook.go:118-221" } ] }, "services": [] }, "HTTP POST /mutate-cloud-pingcap-com-v1-network": { "infrastructure": { "kubernetes_api": [ { "operation": "GET", "target": "Provider referenced by spec.provider", "conditions": [ "Always during defaulting" ], "implementation": "api/v1/network_webhook.go:33-50" } ] }, "services": [] }, "HTTP POST /validate-cloud-pingcap-com-v1-network": { "infrastructure": { "kubernetes_api": [ { "operation": "GET/LIST", "target": "Provider plus Networks in the same project/region used to detect shoot-name collisions", "conditions": [ "Always during create/update validation" ], "implementation": "api/v1/network_webhook.go:57-212" } ] }, "services": [] }, "HTTP POST /mutate-cloud-pingcap-com-v1-cluster": { "infrastructure": { "kubernetes_api": [ { "operation": "GET", "target": "Network referenced by the Cluster", "conditions": [ "Always during defaulting" ], "implementation": "api/v1/cluster_webhook.go:29-44" } ] }, "services": [] }, "HTTP POST /validate-cloud-pingcap-com-v1-cluster": { "infrastructure": { "kubernetes_api": [ { "operation": "GET", "target": "Network and Provider objects used to validate topology, storage classes, and provider labels", "conditions": [ "Always during create/update validation" ], "implementation": "api/v1/cluster_webhook.go:51-223" } ] }, "services": [] }, "HTTP POST /mutate-cloud-pingcap-com-v1-backup": { "infrastructure": { "kubernetes_api": [ { "operation": "GET", "target": "Cluster referenced by spec.clusterName", "conditions": [ "Always during defaulting" ], "implementation": "api/v1/backup_webhook.go:28-39" } ] }, "services": [] }, "HTTP POST /validate-cloud-pingcap-com-v1-backup": { "infrastructure": { "kubernetes_api": [ { "operation": "GET", "target": "Cluster referenced by spec.clusterName", "conditions": [ "Only when the Backup resource is not marked as migrated" ], "implementation": "api/v1/backup_webhook.go:47-81" } ] }, "services": [] }, "HTTP POST /mutate-cloud-pingcap-com-v1-restore": { "infrastructure": { "kubernetes_api": [ { "operation": "GET", "target": "Cluster referenced by spec.clusterName", "conditions": [ "Always during defaulting" ], "implementation": "api/v1/restore_webhook.go:26-37" } ] }, "services": [] }, "HTTP POST /validate-cloud-pingcap-com-v1-restore": { "infrastructure": { "kubernetes_api": [ { "operation": "GET", "target": "Cluster and Backup referenced by the restore request", "conditions": [ "Cluster lookup is skipped for migrated resources but Backup lookup is always required" ], "implementation": "api/v1/restore_webhook.go:44-103" } ] }, "services": [] }, "HTTP POST /mutate-cloud-pingcap-com-v1-ticdc": { "infrastructure": { "kubernetes_api": [ { "operation": "GET", "target": "Network referenced by the TiCDC resource", "conditions": [ "Always during defaulting" ], "implementation": "api/v1/ticdc_webhook.go:23-38" } ] }, "services": [] }, "HTTP POST /validate-cloud-pingcap-com-v1-ticdc": { "infrastructure": {}, "services": [] }, "HTTP GET /metrics": { "infrastructure": {}, "services": [] }, "HTTP GET /healthz": { "infrastructure": {}, "services": [] }, "HTTP GET /readyz": { "infrastructure": {}, "services": [] }, "HTTP GET /debug/pprof/": { "infrastructure": {}, "services": [] }, "HTTP GET /debug/pprof/cmdline": { "infrastructure": {}, "services": [] }, "HTTP GET /debug/pprof/profile": { "infrastructure": {}, "services": [] }, "HTTP GET /debug/pprof/symbol": { "infrastructure": {}, "services": [] }, "HTTP GET /debug/pprof/trace": { "infrastructure": {}, "services": [] } }, "notes": [ "The old scan missed that gardenerEnv.Start() and metrics.RegisterMetrics(...) only happen after mgr.Elected() fires; those leader-gated side effects are now captured explicitly.", "Webhook dependencies are intentionally separated from controller dependencies. Some webhook handlers only do local field validation, while others use webhookClient to read Cluster, Network, ProviderType, Provider, or Backup objects through the manager's cached/direct readers.", "The controller-runtime metrics listener also hosts the optional pprof handlers through AddMetricsExtraHandler; they are not separate servers." ] }