# tidbcloud-provider

`tidbcloud-provider` is the Crossplane infrastructure provider for [TiDB Cloud](https://tidbcloud.com)

## Develop

```
# Test locally
$ make

# Build and push
$ make docker-build
$ make docker-push

# Deploy to Kubernetes
$ kubectl apply -k config/default
$ kubectl get po -n system --watch
$ kubectl explain clusters.core.tidbcloud.com

# Deploy a TiDB Cloud cluster
$ cp -R config/samples tmp
# modify the sample yamls
$ kubectl apply -f tmp
$ watch kubectl get cluster
```

## Usage Example

### Deploy

```
$ NS=<namespace-provided-by-dbaas-team>
$ cat <<EOF > cluster.yaml
apiVersion: core.tidbcloud.com/v1alpha1
kind: Cluster
metadata:
 name: test
spec:
 parameters:
   # generateName specify the name prefix of the cluster, required
   generateName: test

   # options: [aws, gcp], required
   provider: aws

   # options: aws - [us-west-2], gcp - [us-west1], required
   region: us-west-2

   # options: [t1.tiny, t1.standard], required
   tier: t1.tiny

   # sql interface whitelist ips, optional, default to deny all public access
   sourceRanges:
   - 0.0.0.0/0

   # cluster version, optional, default to TiDB Cloud's default
   version: v4.0.7

   tidb:

     # TiDB replicas, required, must > 1
     replicas: 2

     # TiDB config, optional, this config will overlay to TiDB Cloud's defaults, DO NOT edit any configuration related
     # to TLS
     # rawConfig: ""

     # optional, default to pingcap/tidb
     # baseImage: pingcap/tidb

     # optional, default to .spec.version
     # version: v4.0.7

   tikv:
     # TiKV replicas, required, must be a multiple of 3
     replicas: 3

     # TiKV config, optional, this config will overlay to TiDB Cloud's defaults, DO NOT edit any configuration related
     # to TLS and TDE
     # rawConfig: |
     #   [raftstore]
     #   apply-pool-size = 2
     #   store-pool-size = 2

     # optional, default to pingcap/tikv
     # baseImage: pingcap/tikv

     # optional, default to .spec.version, can be any valid image tag
     # version: v4.0.7
   pd:
     # PD config, optional, this config will overlay to TiDB Cloud's defaults
     # rawConfig: ""

     # optional, default to pingcap/pd
     # baseImage: pingcap/pd

     # optional, default to .spec.version, can be any valid image tag
     # version: v4.0.7

 providerConfigRef:
   name: dbaas-stability
 writeConnectionSecretToRef:
   name: password
   namespace: $NS
EOF
# customize your cluster as documented above
$ vim cluster.yaml
# create cluster
$ kubectl -n $NS apply -f cluster.yaml
# wait cluster to be created and updated to your desired version/config
$ kubectl -n $NS wait --timeout=20m --for=~~~~condition=Ready -f cluster.yaml
```

### Access SQL Interface

```
$ TIDB_HOST=$(kubectl -n $NS get -f cluster.yaml --template='{{.status.host}}')
$ TIDB_PORT=$(kubectl -n $NS get -f cluster.yaml --template='{{.status.port}}')
$ PWD_SECRET_NAME=$(kubectl -n $NS get -f cluster.yaml --template='{{.spec.writeConnectionSecretToRef.name}}')
$ TIDB_PWD=$(kubectl -n $NS get secret $PWD_SECRET_NAME --template='{{.data.password}}' | base64 -d)
$ mysql -h$TIDB_HOST -P$TIDB_PORT -uroot -p$TIDB_PWD
```

### Access the Cluster

```
$ TIDB_NS=tidb$(kubectl -n $NS get -f cluster.yaml --template='{{.status.id}}')
$ KUBECONFIG_SECRET_NAME=$(kubectl -n $NS get -f cluster.yaml --template='{{.status.kubeconfigSecret.name}}')
$ TEMP=$(mktemp)
$ kubectl -n $NS get secret $KUBECONFIG_SECRET_NAME --template='{{.data.kubeconfig}}' | base64 -d > $TEMP
$ export KUBECONFIG=$TEMP

# verify the above processes
$ kubectl -n $TIDB_NS get pod

# inspect the final configuration
$ kubectl -n $TIDB_NS get configmap -o yaml

# DNS names inside the kubernetes cluster
$ kubectl -n $TIDB_NS run --rm nslookup -it --image=nicolaka/netshoot -- /bin/bash
> nslookup db-pd
> nslookup db-tidb
> nslookup db-tikv-0.db-tikv-peer
> nslookup db-tikv-1.db-tikv-peer
> nslookup db-tikv-2.db-tikv-peer
```

Run a Pod as bastion:

```
# you may replace the image with your favored image that has more tools installed
$ cat <<EOF | kubectl -n $TIDB_NS create -f -
apiVersion: v1
kind: Pod
metadata:
 name: agent
spec:
 containers:
 - command:
   - /bin/sh
   - -c
   - tail -f /dev/null
   image: ubuntu
   imagePullPolicy: IfNotPresent
   name: main
   volumeMounts:
   - mountPath: /var/lib/tls
     name: tls
     readOnly: true
 volumes:
   - name: tls
     secret:
       secretName: db-cluster-client-secret
EOF
$ kubectl -n $TIDB_NS exec -it agent -- bash

# All internal interfaces require the client certificates
> /pd-ctl --cacert /var/lib/tls/ca.crt --key /var/lib/tls/tls.key --cert /var/lib/tls/tls.crt store https://db-pd:2379
```