data "aws_eks_cluster" "cluster" {
  name = module.wordpress-cluster.cluster_id
}

data "aws_eks_cluster_auth" "cluster" {
  name = module.wordpress-cluster.cluster_id
}

provider "kubernetes" {
  host                   = data.aws_eks_cluster.cluster.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
  token                  = data.aws_eks_cluster_auth.cluster.token
}

/*
module "wordpress-cluster" {
  source  = "terraform-aws-modules/eks/aws"
  version = "17.24.0"

  cluster_name = var.k8s_cluster_name
  cluster_version = 1.21

  vpc_id  = module.app_vpc.vpc_id
  subnets = module.app_vpc.private_subnets

  worker_groups = [
    {
      instance_type = "c5.xlarge"
      asg_desired_capacity = length(module.app_vpc.private_subnets)
      asg_min_size  = length(module.app_vpc.private_subnets)
      asg_max_size  = 4
      tags = [{
        key                 = "Name"
        value               = "wordpress-worker"
        propagate_at_launch = true
      }]
    }
  ]

  map_roles = [
    {
      rolearn = aws_iam_role.eks_admin_role.arn
      groups = ["system:masters"]
      username = "eks-admin"
    }
  ]

  cluster_enabled_log_types = [
    "api",
    "audit",
    "controllerManager"
  ]

  tags = {
    environment = "prod"
  }
}
*/

resource "aws_iam_role" "eks_admin_role" {
  name = "eks-admin-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole",
        Effect = "Allow"
        Principal = {
          AWS = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
        }
        Condition = {}
      },
    ]
  })

  max_session_duration = 10800
}

resource "aws_iam_role_policy_attachment" "eks_admin_attach" {
  role = aws_iam_role.eks_admin_role.name
  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
}

resource "aws_iam_policy" "eks_admin_assume_role_policy" {
  name = "eks-admin-assume-role-policy"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole",
        Effect = "Allow"
        Sid = "AllowAssumeOrganizationAccountRole"
        Resource = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${aws_iam_role.eks_admin_role.name}"
      },
    ]
  })
}

resource "aws_iam_group" "website_admin" {
  name = "website-admin"
}

resource "aws_iam_group_policy_attachment" "website_admin_attach" {
  group      = aws_iam_group.website_admin.name
  policy_arn = aws_iam_policy.eks_admin_assume_role_policy.arn
}

resource "kubernetes_namespace_v1" "wordpress" {
  metadata {
    name = var.namespace
  }
}