variable "env" {
  type = string
}
variable "location" {
  type = string
}
variable "aks_oidc_issuer" {
  type = string
}
variable "resource_group_name" {
  type = string
}
variable "logical_region_name" {
  type = string
}
variable "auto_deploy_cli_principal_id" {
  type = string
}
variable "controlplane_root_dns" {
  type = string
}
variable "controlplane_root_dns_rg" {
  type = string
}
variable "dataplane_root_dns" {
  type = string
}
variable "dataplane_root_dns_rg" {
  type = string
}

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~>4.11"
    }
  }
  backend "azurerm" {}
}
provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}
data "azurerm_client_config" "current" {}

resource "azurerm_dns_zone" "controlplane" {
  name                = "${var.logical_region_name}.${var.controlplane_root_dns}"
  resource_group_name = var.resource_group_name
}
resource "azurerm_dns_ns_record" "controlplane_delegation" {
  name                = "${var.logical_region_name}"
  zone_name           = "${var.controlplane_root_dns}"
  resource_group_name = "${var.controlplane_root_dns_rg}"
  ttl                 = 3600

  records = azurerm_dns_zone.controlplane.name_servers
}

resource "azurerm_dns_zone" "dataplane" {
  name                = "clusters.${var.logical_region_name}.${var.dataplane_root_dns}"
  resource_group_name = var.resource_group_name
}
resource "azurerm_dns_ns_record" "dataplane_delegation" {
  name                = "clusters.${var.logical_region_name}"
  zone_name           = "${var.dataplane_root_dns}"
  resource_group_name = "${var.dataplane_root_dns_rg}"
  ttl                 = 3600

  records = azurerm_dns_zone.dataplane.name_servers
}

resource "random_string" "random" {
  length  = 16
  upper   = false
  special = false
}

resource "azurerm_key_vault" "keyvault" {
  name                        = "${var.env}${random_string.random.result}"
  location                    = var.location
  resource_group_name         = var.resource_group_name
  enabled_for_disk_encryption = true
  tenant_id                   = data.azurerm_client_config.current.tenant_id
  soft_delete_retention_days  = 7
  purge_protection_enabled    = false
  enable_rbac_authorization   = true

  sku_name = "standard"
}

resource "azurerm_role_assignment" "role_assignment" {
  scope                = azurerm_key_vault.keyvault.id
  role_definition_name = "Key Vault Administrator"
  principal_id         = var.auto_deploy_cli_principal_id
}

resource "azuread_application_registration" "cmek_broker" {
  display_name     = "TiDB Cloud CMK Broker - ${var.logical_region_name}"
  description  = ""
  sign_in_audience = "AzureADMultipleOrgs"
}

resource "azurerm_user_assigned_identity" "uami_cmek_broker" {
  location            = var.location
  name                = "uami-cmek-broker-${var.logical_region_name}"
  resource_group_name = var.resource_group_name
}

resource "azuread_application_federated_identity_credential" "cmek_broker_fic" {
  application_id = azuread_application_registration.cmek_broker.id
  display_name   = "cluster-control-server-${var.logical_region_name}"
  description    = "Allow cluster-control-server to run as this App registration"
  issuer         = "${var.aks_oidc_issuer}"
  subject        = "system:serviceaccount:cluster-service:cluster-control-server"
  audiences      = ["api://AzureADTokenExchange"]
}

resource "azuread_application_federated_identity_credential" "cmek_broker_fic_uami" {
  application_id = azuread_application_registration.cmek_broker.id
  display_name   = azurerm_user_assigned_identity.uami_cmek_broker.name
  description    = "Allow UAMI to impersonate as this App registration"
  issuer         = "https://login.microsoftonline.com/${data.azurerm_client_config.current.tenant_id}/v2.0"
  subject        = azurerm_user_assigned_identity.uami_cmek_broker.principal_id
  audiences      = ["api://AzureADTokenExchange"]
}

output "keyvault_name" {
  value = azurerm_key_vault.keyvault.name
}
output "keyvault_uri" {
  value = azurerm_key_vault.keyvault.vault_uri
}
output "keyvault_id" {
  value = azurerm_key_vault.keyvault.id
}
output "controlplane_dns_zone_name" {
  value = azurerm_dns_zone.controlplane.name
}
output "controlplane_dns_zone_id" {
  value = azurerm_dns_zone.controlplane.id
}
output "controlplane_dns_zone_nameservers" {
  value = azurerm_dns_zone.controlplane.name_servers
}
output "dataplane_dns_zone_name" {
  value = azurerm_dns_zone.dataplane.name
}
output "dataplane_dns_zone_id" {
  value = azurerm_dns_zone.dataplane.id
}
output "dataplane_dns_zone_rg" {
  value = azurerm_dns_zone.dataplane.resource_group_name
}
output "dataplane_dns_zone_nameservers" {
  value = azurerm_dns_zone.dataplane.name_servers
}

output "cmek_app_id" {
  value = azuread_application_registration.cmek_broker.client_id
}

output "cmek_app_name" {
  value = azuread_application_registration.cmek_broker.display_name
}

output "cmek_uami_resource_id" {
  value = azurerm_user_assigned_identity.uami_cmek_broker.id
}