{
  "repo": "tidbcloud/shared-provider",
  "binary": "manager",
  "binary_path": "cmd/manager/main.go",
  "dependencies": {
    "HealthService.healthz": {
      "infrastructure": {},
      "services": []
    },
    "HealthService.readyz": {
      "infrastructure": {},
      "services": []
    },
    "MetricsService.metrics": {
      "infrastructure": {},
      "services": []
    },
    "NetworkReconciler.Reconcile": {
      "infrastructure": {
        "aws-iam": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "IAM CreateRole/GetRole/DeleteRole",
              "trigger": "Manage backup role for network",
              "conditions": [
                "Always"
              ],
              "implementation": "r.AwsClient.IAM() via iamutil"
            },
            {
              "operation": "IAM PutRolePolicy",
              "trigger": "Attach policy to backup role",
              "conditions": [
                "Always"
              ],
              "implementation": "iamutil.EnsureRole() calls PutRolePolicy"
            }
          ]
        },
        "kubernetes": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Kubernetes API Get Namespace",
              "trigger": "Fetch namespace for network",
              "conditions": [
                "Always"
              ],
              "implementation": "r.Cache.Get(ctx, nsKey, ns)"
            },
            {
              "operation": "Kubernetes API Create Namespace",
              "trigger": "Create namespace for network",
              "conditions": [
                "Namespace not found"
              ],
              "implementation": "r.Client.Create(ctx, ns)"
            },
            {
              "operation": "Kubernetes API Get ServiceAccount",
              "trigger": "Manage TiDB operator and backup manager ServiceAccounts",
              "conditions": [
                "Always"
              ],
              "implementation": "r.Cache.Get(ctx, key, sa)"
            },
            {
              "operation": "Kubernetes API Create ServiceAccount",
              "trigger": "Create ServiceAccount for TiDB operator or backup manager",
              "conditions": [
                "ServiceAccount not found"
              ],
              "implementation": "r.Client.Create(ctx, sa)"
            },
            {
              "operation": "Kubernetes API Get Role",
              "trigger": "Manage TiDB operator and backup manager Roles",
              "conditions": [
                "Always"
              ],
              "implementation": "r.Cache.Get(ctx, key, role)"
            },
            {
              "operation": "Kubernetes API Create Role",
              "trigger": "Create Role for TiDB operator or backup manager",
              "conditions": [
                "Role not found"
              ],
              "implementation": "r.Client.Create(ctx, role)"
            },
            {
              "operation": "Kubernetes API Update Role",
              "trigger": "Update Role rules if changed",
              "conditions": [
                "Role exists and rules differ"
              ],
              "implementation": "r.Client.Update(ctx, role)"
            },
            {
              "operation": "Kubernetes API Get RoleBinding",
              "trigger": "Manage TiDB operator and backup manager RoleBindings",
              "conditions": [
                "Always"
              ],
              "implementation": "r.Cache.Get(ctx, key, rb)"
            },
            {
              "operation": "Kubernetes API Create RoleBinding",
              "trigger": "Create RoleBinding for TiDB operator or backup manager",
              "conditions": [
                "RoleBinding not found"
              ],
              "implementation": "r.Client.Create(ctx, rb)"
            },
            {
              "operation": "Kubernetes API Update RoleBinding",
              "trigger": "Update RoleBinding if subjects or roleRef changed",
              "conditions": [
                "RoleBinding exists and differs"
              ],
              "implementation": "r.Client.Update(ctx, rb)"
            },
            {
              "operation": "Kubernetes API Get Deployment",
              "trigger": "Manage TiDB operator deployment",
              "conditions": [
                "Always"
              ],
              "implementation": "r.Cache.Get(ctx, key, deploy)"
            },
            {
              "operation": "Kubernetes API Create Deployment",
              "trigger": "Deploy TiDB operator",
              "conditions": [
                "Deployment not found"
              ],
              "implementation": "r.Client.Create(ctx, deploy)"
            },
            {
              "operation": "Kubernetes API Update Deployment",
              "trigger": "Update TiDB operator deployment",
              "conditions": [
                "Deployment exists"
              ],
              "implementation": "r.Client.Update(ctx, deploy)"
            },
            {
              "operation": "Kubernetes API Delete Deployment",
              "trigger": "Delete TiDB operator deployment during cleanup",
              "conditions": [
                "Network resource cleaned"
              ],
              "implementation": "r.Client.Delete(ctx, deploy) in tryToDeleteTiDBOperator()"
            },
            {
              "operation": "Kubernetes API Get ConfigMap",
              "trigger": "Read addon templates for TiDB operator resources",
              "conditions": [
                "Always"
              ],
              "implementation": "r.Client.Get(ctx, addonCmKey, cm) in initTiDBOperatorTemplate()"
            },
            {
              "operation": "Kubernetes API Update ServiceAccount (default)",
              "trigger": "Disable automountServiceAccountToken for default SA",
              "conditions": [
                "Always"
              ],
              "implementation": "r.Client.Update(ctx, sa) in syncDefaultSA()"
            },
            {
              "operation": "Kubernetes API Get IAMServiceAccount",
              "trigger": "Check GCP service account for import",
              "conditions": [
                "Provider is GCP shared-tier"
              ],
              "implementation": "r.Cache.Get(ctx, objectKey, gsa) in ensureGCPImportResource()"
            },
            {
              "operation": "Kubernetes API Create IAMServiceAccount",
              "trigger": "Create GCP service account for import",
              "conditions": [
                "Provider is GCP shared-tier"
              ],
              "implementation": "r.Client.Create(ctx, gsa) in ensureGCPImportResource()"
            },
            {
              "operation": "Kubernetes API Get IAMServiceAccountKey",
              "trigger": "Check GCP service account key for import",
              "conditions": [
                "Provider is GCP shared-tier"
              ],
              "implementation": "r.Cache.Get(ctx, objectKey, gsak) in ensureGCPImportResource()"
            },
            {
              "operation": "Kubernetes API Create IAMServiceAccountKey",
              "trigger": "Create GCP service account key for import",
              "conditions": [
                "Provider is GCP shared-tier"
              ],
              "implementation": "r.Client.Create(ctx, gsak) in ensureGCPImportResource()"
            },
            {
              "operation": "Kubernetes API Get Secret (GCP SA key)",
              "trigger": "Wait for GCP service account key secret",
              "conditions": [
                "Provider is GCP shared-tier"
              ],
              "implementation": "r.Client.Get(ctx, objectKey, &secret) in ensureGCPImportResource()"
            },
            {
              "operation": "Kubernetes API Delete IAMServiceAccount",
              "trigger": "Delete GCP service account during cleanup",
              "conditions": [
                "Provider is GCP shared-tier"
              ],
              "implementation": "r.Client.Delete(ctx, gsa) in cleanUpGCPImportResource()"
            },
            {
              "operation": "Kubernetes API Delete IAMServiceAccountKey",
              "trigger": "Delete GCP service account key during cleanup",
              "conditions": [
                "Provider is GCP shared-tier"
              ],
              "implementation": "r.Client.Delete(ctx, gsak) in cleanUpGCPImportResource()"
            },
            {
              "operation": "Kubernetes API Delete Namespace",
              "trigger": "Delete namespace during finalizer cleanup",
              "conditions": [
                "Network being deleted"
              ],
              "implementation": "r.Client.Delete(ctx, ns) in tryToFinalize()"
            }
          ]
        },
        "kubernetes-infra": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Kubernetes API Get Network",
              "trigger": "Fetch Network from infra cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "r.InfraCache.Get(ctx, req.NamespacedName, net)"
            },
            {
              "operation": "Kubernetes API List Clusters",
              "trigger": "List clusters in network",
              "conditions": [
                "Always"
              ],
              "implementation": "r.InfraCache.List(ctx, clusterList)"
            },
            {
              "operation": "Kubernetes API Update Network (finalizer)",
              "trigger": "Add/remove finalizer on Network",
              "conditions": [
                "Always"
              ],
              "implementation": "r.InfraClient.Update(ctx, net) in syncFinalizer()"
            },
            {
              "operation": "Kubernetes API Update Network Status (backup bucket)",
              "trigger": "Set backup bucket name in network status",
              "conditions": [
                "Always"
              ],
              "implementation": "r.InfraClient.Status().Update(ctx, net) in ensureBackupBucket()"
            },
            {
              "operation": "Kubernetes API Update Network Status (backup role)",
              "trigger": "Set backup role ARN in network status",
              "conditions": [
                "Always"
              ],
              "implementation": "r.InfraClient.Status().Update(ctx, net) in ensureBackupRole()"
            },
            {
              "operation": "Kubernetes API Update Network Status (GCP SA)",
              "trigger": "Set GCP service account email in network status",
              "conditions": [
                "Provider is GCP shared-tier"
              ],
              "implementation": "r.InfraClient.Status().Update(ctx, network) in ensureGCPImportResource()"
            },
            {
              "operation": "Kubernetes API Create Bucket (Crossplane S3)",
              "trigger": "Create backup bucket for network",
              "conditions": [
                "Provider is AWS shared-tier"
              ],
              "implementation": "kubeapi.CreateIgnoreExists(ctx, r.InfraClient, bucket) in ensureBackupBucket()"
            },
            {
              "operation": "Kubernetes API Get Bucket (Crossplane S3)",
              "trigger": "Observe backup bucket status",
              "conditions": [
                "Provider is AWS shared-tier"
              ],
              "implementation": "r.InfraClient.Get(ctx, bucketKey, bucket) in observeBucketStatus()"
            },
            {
              "operation": "Kubernetes API Delete Bucket (Crossplane S3)",
              "trigger": "Delete backup bucket during cleanup",
              "conditions": [
                "Provider is AWS shared-tier"
              ],
              "implementation": "r.InfraClient.Delete(ctx, bucket) in deleteBackupBucket()"
            }
          ]
        }
      },
      "services": []
    },
    "ClusterReconciler.Reconcile": {
      "infrastructure": {
        "aws-kms": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "KMS DisableKeyRotation",
              "trigger": "Disable key rotation for TiKV encryption key",
              "conditions": [
                "Creating KMS key"
              ],
              "implementation": "r.AwsClient.KMS().DisableKeyRotation(ctx, input)"
            },
            {
              "operation": "KMS CreateGrant",
              "trigger": "Grant TiKV permission to use encryption key",
              "conditions": [
                "KMS key created"
              ],
              "implementation": "r.AwsClient.KMS().CreateGrant(ctx, input)"
            },
            {
              "operation": "KMS ScheduleKeyDeletion",
              "trigger": "Delete KMS key during cluster deletion",
              "conditions": [
                "Cluster being deleted"
              ],
              "implementation": "r.AwsClient.KMS().ScheduleKeyDeletion(ctx, input)"
            }
          ]
        },
        "aws-ec2": {
          "conditions": [
            "PrivateLink enabled"
          ],
          "operations": [
            {
              "operation": "EC2 DescribeVpcEndpointConnections",
              "trigger": "Check PrivateLink endpoint status",
              "conditions": [
                "PrivateLink annotation present"
              ],
              "implementation": "r.AwsClient.Ec2().DescribeVpcEndpointConnections(ctx, input)"
            },
            {
              "operation": "EC2 AcceptVpcEndpointConnections",
              "trigger": "Accept PrivateLink connection",
              "conditions": [
                "Endpoint pending acceptance"
              ],
              "implementation": "r.AwsClient.Ec2().AcceptVpcEndpointConnections(ctx, input)"
            },
            {
              "operation": "EC2 RejectVpcEndpointConnections",
              "trigger": "Reject PrivateLink connection",
              "conditions": [
                "Endpoint should be rejected"
              ],
              "implementation": "r.AwsClient.Ec2().RejectVpcEndpointConnections(ctx, input)"
            }
          ]
        },
        "kubernetes": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Kubernetes API Create TidbCluster",
              "trigger": "Create TiDB cluster CR",
              "conditions": [
                "tc == nil"
              ],
              "implementation": "r.Client.Create(ctx, tc)"
            },
            {
              "operation": "Kubernetes API Update TidbCluster",
              "trigger": "Update TiDB cluster CR",
              "conditions": [
                "tc != nil"
              ],
              "implementation": "r.Client.Update(ctx, tc)"
            },
            {
              "operation": "Kubernetes API Create TidbInitializer",
              "trigger": "Create TiDB initializer for SQL setup",
              "conditions": [
                "ti == nil"
              ],
              "implementation": "r.createOrGetWithOwnerLabel(ti)"
            },
            {
              "operation": "Kubernetes API Create TidbMonitor",
              "trigger": "Create TiDB monitor for Prometheus",
              "conditions": [
                "tm == nil"
              ],
              "implementation": "r.createOrGetWithOwnerLabel(tm)"
            },
            {
              "operation": "Kubernetes API Create Secret",
              "trigger": "Create TLS certificates for cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "r.Client.Create(ctx, secret)"
            }
          ]
        },
        "kubernetes-infra": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Kubernetes API Get Cluster",
              "trigger": "Fetch Cluster from infra cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "r.InfraCache.Get(ctx, req.NamespacedName, cluster)"
            },
            {
              "operation": "Kubernetes API Update Cluster Status",
              "trigger": "Update cluster phase and status",
              "conditions": [
                "Always"
              ],
              "implementation": "r.InfraClient.Update(ctx, cluster)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "config-service",
          "target_interface": "POST /api/v1/cluster/configuration",
          "operation_type": "http_post",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "HTTP DescribeClusterConfiguration",
              "trigger": "Get TiDB cluster configuration",
              "conditions": [
                "Always"
              ],
              "implementation": "r.ConfigService.DescribeClusterConfiguration(input)"
            }
          ]
        },
        {
          "name": "prometheus",
          "target_interface": "GET /api/v1/query",
          "operation_type": "http_get",
          "conditions": [
            "TidbMonitor exists"
          ],
          "operations": [
            {
              "operation": "HTTP Prometheus Query",
              "trigger": "Query cluster activity metrics",
              "conditions": [
                "tm != nil"
              ],
              "implementation": "querier.Query(ctx, '/api/v1/query', values)"
            }
          ]
        }
      ]
    },
    "NetworkPolicyReconciler.Reconcile": {
      "infrastructure": {
        "kubernetes": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Kubernetes API Get Namespace",
              "trigger": "Fetch Namespace to check ownership",
              "conditions": [
                "Always"
              ],
              "implementation": "r.Get(ctx, types.NamespacedName{Name: ns.Name}, &ns)"
            },
            {
              "operation": "Kubernetes API Get Endpoints",
              "trigger": "Fetch Kubernetes Endpoints for CIDR calculation",
              "conditions": [
                "Policy requires API server/Thanos/AWS service access"
              ],
              "implementation": "r.Get(ctx, client.ObjectKey{Name: types.KubernetesEndpointName, Namespace: corev1.NamespaceDefault}, ep)"
            },
            {
              "operation": "Kubernetes API CreateOrUpdate NetworkPolicy",
              "trigger": "Apply NetworkPolicy with calculated CIDRs",
              "conditions": [
                "Always"
              ],
              "implementation": "controllerutil.CreateOrUpdate(ctx, r.Client, policy, func() error { policy.Spec = expect.Spec; return nil })"
            }
          ]
        }
      },
      "services": []
    },
    "PodReconciler.Reconcile": {
      "infrastructure": {
        "kubernetes": {
          "conditions": [
            "EvictPodDuration > 0 and pod age exceeds duration"
          ],
          "operations": [
            {
              "operation": "Kubernetes API Delete Pod",
              "trigger": "Evict old pods",
              "conditions": [
                "EvictPodDuration > 0"
              ],
              "implementation": "r.Client.Delete(ctx, pod)"
            }
          ]
        }
      },
      "services": []
    },
    "S3CleanReconciler.Reconcile": {
      "infrastructure": {
        "aws-s3": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "S3 ListObjects/DeleteObjects",
              "trigger": "Clean up S3 objects",
              "conditions": [
                "Always"
              ],
              "implementation": "r.AwsClient.S3() operations"
            }
          ]
        },
        "kubernetes-infra": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Kubernetes API Get Cluster",
              "trigger": "Fetch cluster to check S3 cleanup",
              "conditions": [
                "Always"
              ],
              "implementation": "r.InfraCache.Get(ctx, key, cluster)"
            }
          ]
        }
      },
      "services": []
    },
    "BackupReconciler.Reconcile": {
      "infrastructure": {
        "kubernetes": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Kubernetes API Get Backup",
              "trigger": "Fetch Backup CR",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterCli.Get(ctx, key, backup)"
            }
          ]
        },
        "kubernetes-infra": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Kubernetes API Get Backup (infra)",
              "trigger": "Fetch Backup from infra cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "infraMgr.GetClient().Get(ctx, key, backup)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "config-service",
          "target_interface": "POST /api/v1/backup/configuration",
          "operation_type": "http_post",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "HTTP DescribeBackupConfiguration",
              "trigger": "Get backup configuration",
              "conditions": [
                "Always"
              ],
              "implementation": "configService.DescribeBackupConfiguration(input)"
            }
          ]
        }
      ]
    },
    "RestoreReconciler.Reconcile": {
      "infrastructure": {
        "kubernetes": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Kubernetes API Get Restore",
              "trigger": "Fetch Restore CR",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterCli.Get(ctx, key, restore)"
            }
          ]
        },
        "kubernetes-infra": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Kubernetes API Get Restore (infra)",
              "trigger": "Fetch Restore from infra cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "infraMgr.GetClient().Get(ctx, key, restore)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "config-service",
          "target_interface": "POST /api/v1/restore/configuration",
          "operation_type": "http_post",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "HTTP DescribeRestoreConfiguration",
              "trigger": "Get restore configuration",
              "conditions": [
                "Always"
              ],
              "implementation": "configService.DescribeRestoreConfiguration(input)"
            }
          ]
        }
      ]
    },
    "ImportReconciler.Reconcile": {
      "infrastructure": {
        "kubernetes": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Kubernetes API Get Import",
              "trigger": "Fetch Import CR",
              "conditions": [
                "Always"
              ],
              "implementation": "clusterCli.Get(ctx, key, import)"
            }
          ]
        },
        "kubernetes-infra": {
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Kubernetes API Get Import (infra)",
              "trigger": "Fetch Import from infra cluster",
              "conditions": [
                "Always"
              ],
              "implementation": "infraMgr.GetClient().Get(ctx, key, import)"
            }
          ]
        }
      },
      "services": [
        {
          "name": "config-service",
          "target_interface": "POST /api/v1/import/configuration",
          "operation_type": "http_post",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "HTTP DescribeImportConfiguration",
              "trigger": "Get import configuration",
              "conditions": [
                "Always"
              ],
              "implementation": "configService.DescribeImportConfiguration(input)"
            }
          ]
        }
      ]
    }
  },
  "notes": [
    "Connects to two Kubernetes clusters: main (shared EKS) and infra (infra API server)",
    "AWS SDK used for KMS (encryption), EC2 (PrivateLink), IAM (roles), S3 (cleanup)",
    "Config-service provides cluster/backup/restore/import configurations via HTTP",
    "Prometheus queries used for cluster activity detection",
    "Only processes GCP-shared-tier and AWS-shared-tier provider types"
  ]
}