# =============================================================================
# Network Resources: VPC, VSwitches, Security Group
# =============================================================================

resource "alicloud_vpc" "this" {
  vpc_name   = local.cluster_name
  cidr_block = var.vpc_cidr
  tags       = local.common_tags
}

# Three node vswitches, one per availability zone
resource "alicloud_vswitch" "node" {
  count        = length(var.zone_ids)
  vpc_id       = alicloud_vpc.this.id
  zone_id      = var.zone_ids[count.index]
  cidr_block   = cidrsubnet(var.vpc_cidr, 8, count.index)
  vswitch_name = "${local.cluster_name}-node-${substr(var.zone_ids[count.index], -1, -1)}"
  tags         = local.common_tags
}

# One dedicated Pod vswitch in zone_ids[0] with a large CIDR for many pod IPs
resource "alicloud_vswitch" "pod" {
  vpc_id  = alicloud_vpc.this.id
  zone_id = var.zone_ids[0]
  # /17 gives 32766 usable addresses dedicated to pods
  cidr_block   = cidrsubnet(var.vpc_cidr, 1, 1)
  vswitch_name = "${local.cluster_name}-pod-${substr(var.zone_ids[0], -1, -1)}"
  tags         = local.common_tags
}

resource "alicloud_security_group" "this" {
  security_group_name = "${local.cluster_name}-sg"
  vpc_id              = alicloud_vpc.this.id
  description         = "ACK cluster security group for ${local.cluster_name}"
  tags                = local.common_tags
}

# =============================================================================
# NAT Gateway
# =============================================================================

resource "alicloud_nat_gateway" "this" {
  vpc_id           = alicloud_vpc.this.id
  vswitch_id       = alicloud_vswitch.node[0].id
  nat_gateway_name = "o11y-regional-nat-global"
  nat_type         = "Enhanced"
  payment_type     = "PayAsYouGo"
  tags             = local.common_tags
}

resource "alicloud_eip_address" "nat" {
  address_name         = "${local.cluster_name}-nat-eip"
  bandwidth            = tostring(var.nat_bandwidth)
  internet_charge_type = "PayByTraffic"
  payment_type         = "PayAsYouGo"
  tags                 = local.common_tags
}

resource "alicloud_eip_association" "nat" {
  allocation_id = alicloud_eip_address.nat.id
  instance_id   = alicloud_nat_gateway.this.id
  instance_type = "Nat"
}

# SNAT rules for all node vswitches so nodes can reach the Internet
resource "alicloud_snat_entry" "node" {
  count             = length(var.zone_ids)
  depends_on        = [alicloud_eip_association.nat]
  snat_table_id     = alicloud_nat_gateway.this.snat_table_ids
  source_vswitch_id = alicloud_vswitch.node[count.index].id
  snat_ip           = alicloud_eip_address.nat.ip_address
  snat_entry_name   = "${local.cluster_name}-snat-node-${count.index}"
}

# SNAT rule for the pod vswitch
resource "alicloud_snat_entry" "pod" {
  depends_on        = [alicloud_eip_association.nat]
  snat_table_id     = alicloud_nat_gateway.this.snat_table_ids
  source_vswitch_id = alicloud_vswitch.pod.id
  snat_ip           = alicloud_eip_address.nat.ip_address
  snat_entry_name   = "${local.cluster_name}-snat-pod"
}