locals {
  jumpserver_role_arn = "acs:ram::${local.seed_account}:role/jump-service-role"
}

module "jumpserver" {
  source = "../../modules/app"

  kubeconfig_path = module.kubeconfig.path
  workflow        = "new-jump-server-dst.yaml"
  parameters = {
    env  = var.env
    name = "seed-${var.logical_region_name}"
    destination = templatefile("${path.module}/jumpserver_destination.yml.tpl", {
      name       = "seed-${var.logical_region_name}"
      cluster    = local.cluster_name
      endpoint   = module.ack.endpoint
      cluster_id = module.ack.cluster_id
      profile    = "jump-service-role-for-${local.seed_account}"
    })
  }
  services = []
}

data "alicloud_ram_roles" "jump_service_role" {
  name_regex = "jump-service-role"

  lifecycle {
    postcondition {
      condition     = contains([for role in self.roles : role.arn], local.jumpserver_role_arn)
      error_message = "jump-service-role not found"
    }
  }
}

locals {
  suspicious_roles = data.alicloud_ram_roles.jump_service_role.roles
  role_ids = [
    for role in local.suspicious_roles : role.id if role.arn == local.jumpserver_role_arn
  ]
  jumpserver_role_id = local.role_ids.0
}

resource "kubectl_manifest" "ram_identity_mapping" {
  yaml_body = <<-EOT
    apiVersion: ramauthenticator.k8s.alibabacloud/v1alpha1
    kind: RAMIdentityMapping
    metadata:
      name: jump-service
    spec:
      arn: "acs:ram::${local.seed_account}:role/jump-service-role"
      username: jump-service
      groups:
        - system:masters
  EOT
}

resource "kubernetes_cluster_role_binding_v1" "jump_service_role_binding" {
  metadata {
    name = "jump-service-clusterrolebinding"
  }
  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = "cs:admin"
  }
  subject {
    api_group = "rbac.authorization.k8s.io"
    kind      = "User"
    name      = "jump-service"
  }
}