terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~>4.11"
    }
  }
  backend "azurerm" {}
}
provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}
data "azurerm_subscription" "primary" {}

variable "env" {
  type = string
}
variable "location" {
  type = string
}
variable "logical_region_name" {
  type = string
}
variable "aks_oidc_issuer" {
  type = string
}

module "dm" {
  source = "../../modules/controlplane"

  location        = var.location
  aks_oidc_issuer = var.aks_oidc_issuer
  # azure-workload-identity does not support wildcard https://github.com/Azure/azure-workload-identity/issues/373
  # namespace and service_account should be exact match
  namespace           = "tcidm"
  service_account     = "dm-controller"
  identity_name       = "dm-controller"
  resource_group_name = "${var.env}-${var.logical_region_name}-controlplane"
}

module "import" {
  source = "../../modules/controlplane"

  location        = var.location
  aks_oidc_issuer = var.aks_oidc_issuer
  # azure-workload-identity does not support wildcard https://github.com/Azure/azure-workload-identity/issues/373
  # namespace and service_account should be exact match
  namespace           = "tcidm"
  service_account     = "import-controller"
  identity_name       = "import-controller"
  resource_group_name = "${var.env}-${var.logical_region_name}-controlplane"
}

resource "azurerm_role_assignment" "role_assignment_dm" {
  scope                = data.azurerm_subscription.primary.id
  role_definition_name = "Owner"
  principal_id         = module.dm.principal_id
}

resource "azurerm_role_assignment" "role_assignment_import" {
  scope                = data.azurerm_subscription.primary.id
  role_definition_name = "Owner"
  principal_id         = module.import.principal_id
}

# azure ad group settings
data "azuread_group" "control-plane-services" {
  display_name     = "${var.env}-control-plane-services"
  security_enabled = true
}

resource "null_resource" "wait_for_identity" {
  provisioner "local-exec" {
    command = "sleep 20" # wait 20 seconds for identity to be ready
  }

  depends_on = [module.dm.principal_id, module.import.principal_id]
}

resource "azuread_group_member" "control-plane-services-dm-controller" {
  group_object_id  = data.azuread_group.control-plane-services.object_id
  member_object_id = module.dm.principal_id

  depends_on = [null_resource.wait_for_identity]
}

resource "azuread_group_member" "control-plane-services-import-controller" {
  group_object_id  = data.azuread_group.control-plane-services.object_id
  member_object_id = module.import.principal_id

  depends_on = [null_resource.wait_for_identity]
}

output "dm_principal_id" {
  value = module.dm.principal_id
}

output "import_principal_id" {
  value = module.import.principal_id
}

output "dm_client_id" {
  value = module.dm.client_id
}

output "import_client_id" {
  value = module.import.client_id
}