diff --git a/conf/pd.yml b/conf/pd.yml
index 05438cde6..f475c4ec8 100644
--- a/conf/pd.yml
+++ b/conf/pd.yml
@@ -44,3 +44,21 @@ replication:
   # For example, ["zone", "rack"] means that we should place replicas to
   # different zones first, then to different racks if we don't have enough zones.
   # location-labels: []
+
+dashboard:
+  ## Configurations below are for the TiDB Dashboard embedded in the PD.
+  ## The path of the CA certificate used to verify the TiDB server in TLS.
+  # tidb-cacert-path: ""
+  ## The path of the certificate used to connect to TiDB server in TLS.
+  # tidb-cert-path: ""
+  ## The path of the certificate private key.
+  # tidb-key-path: ""
+  ## The public path prefix to serve Dashboard urls. It can be set when Dashboard
+  ## is running behind a reverse proxy. Do not configure it if you access
+  ## Dashboard directly.
+  # public-path-prefix: "/dashboard"
+  ## When enabled, request will be proxied to the instance running Dashboard
+  ## internally instead of result in a 307 redirection.
+  # internal-proxy: false
+  ## When not disabled, usage data will be sent to PingCAP for improving user experience.
+  # disable-telemetry: false
diff --git a/conf/tidb.yml b/conf/tidb.yml
index 6f90e5f45..fdeaf2841 100644
--- a/conf/tidb.yml
+++ b/conf/tidb.yml
@@ -44,6 +44,11 @@ global:
   # Whether new collations are enabled, as indicated by its name, this configuration entry take effect ONLY when a TiDB cluster bootstraps for the first time.
   new_collations_enabled_on_first_bootstrap: false
 
+  # When enabled, usage data (for example, instance versions) will be reported to PingCAP periodically for user experience analytics.
+  # If this config is set to `false` on all TiDB servers, telemetry will be always disabled regardless of the value of the global variable `tidb_enable_telemetry`.
+  # See PingCAP privacy policy for details: https://pingcap.com/en/privacy-policy/
+  # enable-telemetry: true
+
 log:
   # Log level: debug, info, warn, error, fatal.
   # level: "info"
diff --git a/roles/pd/templates/pd.toml.j2 b/roles/pd/templates/pd.toml.j2
index 85a2c3ee4..cf56b3900 100644
--- a/roles/pd/templates/pd.toml.j2
+++ b/roles/pd/templates/pd.toml.j2
@@ -40,3 +40,8 @@ enable-placement-rules = true
 {% for item, value in pd_conf.replication | dictsort -%}
 {{ item }} = {{ value | to_json}}
 {% endfor %}
+
+[dashboard]
+{% for item, value in pd_conf.dashboard | dictsort -%}
+{{ item }} = {{ value | to_json}}
+{% endfor %}
diff --git a/roles/pd/vars/default.yml b/roles/pd/vars/default.yml
index 4caa7f384..9171a518a 100644
--- a/roles/pd/vars/default.yml
+++ b/roles/pd/vars/default.yml
@@ -57,3 +57,8 @@ replication:
   # For example, ["zone", "rack"] means that we should place replicas to
   # different zones first, then to different racks if we don't have enough zones.
   location-labels: []
+
+dashboard:
+  public-path-prefix: "/dashboard"
+  internal-proxy: false
+  disable-telemetry: false
diff --git a/roles/tidb/vars/default.yml b/roles/tidb/vars/default.yml
index 3e5ec29bf..56edbef30 100644
--- a/roles/tidb/vars/default.yml
+++ b/roles/tidb/vars/default.yml
@@ -56,6 +56,11 @@ global:
   # Whether new collations are enabled, as indicated by its name, this configuration entry take effect ONLY when a TiDB cluster bootstraps for the first time.
   new_collations_enabled_on_first_bootstrap: false
 
+  # When enabled, usage data (for example, instance versions) will be reported to PingCAP periodically for user experience analytics.
+  # If this config is set to `false` on all TiDB servers, telemetry will be always disabled regardless of the value of the global variable `tidb_enable_telemetry`.
+  # See PingCAP privacy policy for details: https://pingcap.com/en/privacy-policy/
+  enable-telemetry: true
+
 log:
   # Log level: debug, info, warn, error, fatal.
   level: "info"