terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  backend "s3" {}
}
provider "aws" {
  region = "us-west-2"
}

variable "eks_oidc" {
  type = string
}

variable "env" {
  type = string
}

variable "logical_region_name" {
  type = string
}

variable "controlplane_account" {
  type = string
}

variable "dataplane_accounts" {
  type = list(string)
}

variable "crossplane_role_arn" {
  type = string
}


module "cluster_server" {
  source = "../../modules/controlplane"

  controlplane_account = var.controlplane_account
  oidc                 = var.eks_oidc
  role_name            = "${var.env}-${var.logical_region_name}-cluster-server"
  service_account      = "cluster-control-server"
  policy_document = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action   = "sts:AssumeRole"
        Effect   = "Allow"
        Resource = "*"
      },
      {
        Effect = "Allow",
        Action = [
          "elasticloadbalancing:DescribeLoadBalancers"
        ],
        Resource = "*",
        Sid      = "ELBDescribePermissions"
      },
      {
        Effect = "Allow",
        Action = [
          "ec2:DescribeSecurityGroups"
        ],
        Resource = "*",
        Sid      = "EC2SecurityGroupPermissions"
      },
      {
        Effect = "Allow",
        Action = [
          "servicequotas:GetServiceQuota",
          "servicequotas:ListServiceQuotas"
        ],
        Resource = "*",
        Sid      = "ServiceQuotasPermissions"
      }
    ]
  })
}

module "cluster_controller" {
  source = "../../modules/controlplane"

  controlplane_account = var.controlplane_account
  oidc                 = var.eks_oidc
  role_name            = "${var.env}-${var.logical_region_name}-cluster-controller"
  service_account      = "cluster-controller"
  policy_document = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action   = "sts:AssumeRole"
        Effect   = "Allow"
        Resource = [for acct in var.dataplane_accounts : "arn:aws:iam::${acct}:role/${var.env}-${var.logical_region_name}-cluster-controller-assumed-role"]
      },
      { # For retrieving eks ami id
        Action   = "ssm:GetParameter"
        Effect   = "Allow"
        Resource = "*"
      }
    ]
  })
}

module "readonly_cluster_controller" {
  source = "../../modules/controlplane"

  controlplane_account = var.controlplane_account
  oidc                 = var.eks_oidc
  role_name            = "readonly-${var.env}-${var.logical_region_name}-cluster-controller"
  service_account      = "readonly-cluster-controller"
  policy_document = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action   = "sts:AssumeRole"
        Effect   = "Allow"
        Resource = [for acct in var.dataplane_accounts : "arn:aws:iam::${acct}:role/ro-${var.env}-${var.logical_region_name}-cluster-controller-assumed"]
      },
      { # For retrieving eks ami id
        Action   = "ssm:GetParameter"
        Effect   = "Allow"
        Resource = "*"
      }
    ]
  })
}

# crossplane-provider uses this role to manage global resources for cluster-controller
module "crossplane" {
  source = "../../modules/crossplane"

  assumed_role_name   = "${var.env}-${var.logical_region_name}-cluster-controller-global-role"
  crossplane_role_arn = var.crossplane_role_arn
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "route53:*",
        ]
        Effect   = "Allow"
        Resource = "*"
      }
    ]
  })
}

output "cluster_server_role_arn" {
  value = module.cluster_server.controlplane_role_arn
}

output "role_arn" {
  value = module.cluster_controller.controlplane_role_arn
}

output "readonly_role_arn" {
  value = module.readonly_cluster_controller.controlplane_role_arn
}

output "crossplane_assumed_role_arn" {
  value = module.crossplane.assumed_role_arn
}

output "assumed_role_name" {
  value = "${var.env}-${var.logical_region_name}-cluster-controller-assumed-role"
}

output "readonly_assumed_role_name" {
  value = "ro-${var.env}-${var.logical_region_name}-cluster-controller-assumed"
}