locals {
  # Safely extract the region from the BYOC ECR registry hostname. If the
  # value does not match the expected pattern, this will evaluate to null
  # instead of causing an opaque "index out of range" error.
  byoc_ecr_region = try(regex("\\.ecr\\.([a-z0-9-]+)\\.amazonaws\\.com", var.byoc_ecr)[0], null)
}

# Validate that var.byoc_ecr is a valid AWS ECR registry hostname when
# ECR PrivateLink is enabled, and fail with a clear, actionable message
# if it is not.
resource "null_resource" "validate_byoc_ecr" {
  count = var.enable_ecr_privatelink ? 1 : 0

  lifecycle {
    precondition {
      condition     = can(regex("\\.ecr\\.([a-z0-9-]+)\\.amazonaws\\.com", var.byoc_ecr)[0])
      error_message = "Invalid value for var.byoc_ecr: when var.enable_ecr_privatelink is true, byoc_ecr must be an AWS ECR registry hostname like '123456789012.dkr.ecr.eu-west-1.amazonaws.com'."
    }
  }
}

module "dataplane-manager" {
  source = "../../../modules/app"

  kubeconfig_path = module.kubeconfig.path
  workflow        = "deploy-new-region-next-gen-dataplane-manager.yaml"
  parameters = {
    env               = var.env
    logicalRegionName = var.logical_region_name
    cluster           = module.argocd_cluster.name
    region            = var.aws_region
    cloud             = "aws"
    additionalArgs = jsonencode({
      awsIrsaRoleArn              = module.iam-dataplane-manager.role_arn
      defaultAwsDp4DrsRole        = "tidbcloud-dataplane-manager-assumed-role"
      eksServiceRoleName          = "tidbcloud-eks-service-role"
      nodeRoleName                = "tidbcloud-eks-node-role"
      availabilityZones           = var.dataplane_zone_names
      nodeZones                   = var.dataplane_node_zones
      imageRegistry               = "${local.seed_account}.dkr.ecr.us-west-2.amazonaws.com"
      tidbImageRegistry           = var.byoc_ecr
      enableEcrInterfaceEndpoints = var.enable_ecr_privatelink
      ecrServiceRegion            = local.byoc_ecr_region
      dataplaneAccounts           = [var.dataplane_account]
      auth0Audience               = "${var.env}-proxy-service"
      auth0Domain                 = var.env == "prod" ? "tidb.auth0.com" : "tidb-${var.env}.us.auth0.com"
      globalControlplaneIPs       = formatlist("%s/32", local.base_outputs.public_ips.value)
      regionalControlplaneIPs     = formatlist("%s/32", local.eks.public_ips)
      o11yRegionalServiceIPs      = []
      clinicIPs                   = formatlist("%s/32", local.clinic_outputs.public_ips.value)
      bastionIPs                  = formatlist("%s/32", local.devops_outputs.public_ips.value)
      authorizedSubjects = [
        module.iam-dataplane-manager.role_arn,
        "arn:aws:iam::${local.seed_account}:role/tidbcloud-dataplane-manager-assumed-role",
      ]
      publicHostedZoneDomain   = var.shoot_hosted_zone_name
      publicHostedZoneID       = var.shoot_hosted_zone_id
      pcaArn                   = var.pca_arn
      enableKongPlugin         = true
      dnsAccountId             = var.dataplane_account
      dnsManagerRoleArn        = "arn:aws:iam::${var.dataplane_account}:role/tidbcloud-dataplane-manager-assumed-role"
      sliDeliveryStreamRoleArn = local.clinic_outputs.sli_delivery_stream_role_arn.value
      byoc = {
        nodeRoleName = "tidbcloud-eks-node-role"
        privateLink = {
          controlPlaneVPCID            = module.vpc.vpc_id
          controlPlaneSubnetIDs        = module.vpc.private_subnets
          controlPlaneSecurityGroupIDs = [module.eks.cluster_security_group_id]
        }
      }
      o11y = {
        vpcID     = var.o11y_vpc_id
        vpcCIDR   = var.o11y_vpc_cidr
        accountID = var.dataplane_account
        region    = var.aws_region
      }
    })
  }
  services = [
    {
      name      = "deploy/dataplane-controller"
      namespace = "dataplane-manager"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "deploy/dataplane-server"
      namespace = "dataplane-manager"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    }
  ]
}