terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~>4.11"
    }
  }
}

variable "location" {
  type = string
}
variable "aks_oidc_issuer" {
  type = string
}
variable "namespace" {
  type = string
}
variable "service_account" {
  type = string
}
variable "identity_name" {
  type = string
}
variable "resource_group_name" {
  type = string
}

resource "azurerm_user_assigned_identity" "identity" {
  location            = var.location
  name                = var.identity_name
  resource_group_name = var.resource_group_name
}

resource "azurerm_federated_identity_credential" "federated_identity" {
  name      = var.identity_name
  issuer    = var.aks_oidc_issuer
  parent_id = azurerm_user_assigned_identity.identity.id
  subject   = "system:serviceaccount:${var.namespace}:${var.service_account}"
  audience  = ["api://AzureADTokenExchange"]
}

output "principal_id" {
  value = azurerm_user_assigned_identity.identity.principal_id
}

output "client_id" {
  value = azurerm_user_assigned_identity.identity.client_id
}