locals {
  jumpserver_role_arn = "acs:ram::${local.alicloud_account}:role/jump-service-role"
}

module "jumpserver" {
  source = "../../modules/app"

  kubeconfig_path = module.kubeconfig.path
  workflow        = "new-jump-server-dst.yaml"
  parameters = {
    env  = var.env
    name = "o11y-${var.env}-regional-${var.logical_region_name}"
    destination = templatefile("${path.module}/jumpserver_destination.yml.tpl", {
      name       = "o11y-${var.env}-regional-${var.logical_region_name}"
      cluster    = local.cluster_name
      endpoint   = data.external.kubeconfig.result.server
      cluster_id = alicloud_cs_managed_kubernetes.this.id
      profile    = "jump-service-role-for-${local.alicloud_account}"
    })
  }
  services = []
}

resource "kubectl_manifest" "ram_identity_mapping" {
  yaml_body = <<-EOT
    apiVersion: ramauthenticator.k8s.alibabacloud/v1alpha1
    kind: RAMIdentityMapping
    metadata:
      name: jump-service
    spec:
      arn: "acs:ram::${local.alicloud_account}:role/jump-service-role"
      username: jump-service
      groups:
        - system:masters
  EOT
}

resource "kubernetes_cluster_role_binding_v1" "jump_service_role_binding" {
  metadata {
    name = "jump-service-clusterrolebinding"
  }
  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = "cs:admin"
  }
  subject {
    api_group = "rbac.authorization.k8s.io"
    kind      = "User"
    name      = "jump-service"
  }
}