data "aws_caller_identity" "current" {}

locals {
  name = "${var.env}-seed-${var.logical_region_name}"
  states = {
    "base" : "aws/base/${var.env}.json",
    "clinic" : var.env == "dev" ? "aws/clinic/staging.json" : "aws/clinic/${var.env}.json",
    "devops" : var.env == "dev" ? "aws/devops/staging.json" : "aws/devops/${var.env}.json",
    "argocd" : "gke/argocd/${var.env}.json",
    "runner" : "gke/runner/prod.json",
  }
}

data "aws_s3_object" "states" {
  for_each = local.states
  bucket   = "autonomous-deployment-terraform-state"
  key      = each.value

  provider = aws.tf_state
}

data "aws_s3_object" "base_state" {
  bucket = "autonomous-deployment-terraform-state"
  key    = "aws/base/${var.env}.json"

  provider = aws.tf_state
}

locals {
  seed_account    = data.aws_caller_identity.current.account_id
  base_outputs    = jsondecode(data.aws_s3_object.states["base"].body).outputs
  clinic_outputs  = jsondecode(data.aws_s3_object.states["clinic"].body).outputs
  devops_outputs  = jsondecode(data.aws_s3_object.states["devops"].body).outputs
  argocd_outputs  = jsondecode(data.aws_s3_object.states["argocd"].body).outputs
  runner_outputs  = jsondecode(data.aws_s3_object.states["runner"].body).outputs
  base_account    = local.base_outputs.account.value
  billing_sqs_arn = local.base_outputs.billing_sqs_arn.value
  base_public_ips = local.base_outputs.public_ips.value
  public_access_cidrs = contains(["dev", "staging"], var.env) ? ["0.0.0.0/0"] : concat(
    formatlist("%s/32", local.base_outputs.public_ips.value),
    formatlist("%s/32", local.devops_outputs.public_ips.value),
    formatlist("%s/32", local.argocd_outputs.public_ips.value),
    formatlist("%s/32", local.runner_outputs.public_ips.value),
  )
}

module "argocd_cluster" {
  source = "../../../modules/argocd_cluster"

  env    = var.env
  name   = "${var.env}-seed-${var.logical_region_name}"
  server = local.eks.endpoint
  data = jsonencode({
    execProviderConfig = {
      apiVersion = "client.authentication.k8s.io/v1beta1"
      command    = "argocd-k8s-auth"
      args = [
        "aws",
        "--cluster-name",
        local.eks.name,
      ]
      env = {
        AWS_ROLE_ARN = "arn:aws:iam::${local.seed_account}:role/argocd-oidc-role"
      }
    }
    tlsClientConfig = {
      insecure = false
      caData   = local.eks.certificate_authority_data
    }
  })
}

module "kubeconfig" {
  source     = "../../../modules/kubeconfig"
  kubeconfig = local.eks.kubeconfig
  path       = "/tmp/${local.eks.name}-kubeconfig"

  depends_on = [module.eks, module.vpc, module.argocd_cluster]
}

module "region_registration" {
  depends_on          = [time_sleep.wait_for_dns_regional_api, module.dataplane-manager, module.falco]
  source              = "../../../modules/global_registration"
  env                 = var.env
  cloud_provider      = "aws"
  cloud_region        = var.aws_region
  logical_region_name = var.logical_region_name
  deploy_type         = "DEPLOY_TYPE_NEXTGEN"
  service_plan        = "BYOC"
  dataplane_accounts  = [var.dataplane_account]
  service_address     = "https://${var.logical_region_name}.regional-api.${var.hosted_zone_name}"
  audit_log_bucket    = "tidbcloud-${var.env}-${var.logical_region_name}-byoc-audit"
  shared_bucket       = "tidbcloud-sli-data-${var.env}-${var.logical_region_name}"
  tenant_ids          = var.tenant_ids
}