locals {
  o11y_control_plane_role_name = "tidbcloud-o11y-control-plane-role"
  o11y_control_plane_role_arn  = "arn:aws:iam::${local.aws_account_id}:role/${local.o11y_control_plane_role_name}"
}

resource "null_resource" "control-plane-role-policy" {
  triggers = {
    role_name      = local.o11y_control_plane_role_name
    aws_account_id = local.aws_account_id
    oidc_issuer    = trimprefix(local.eks.oidc_issuer_url, "https://")
    oidc_issuer_arn = join("/", [
      "arn:aws:iam::${local.aws_account_id}:oidc-provider",
      trimprefix(local.eks.oidc_issuer_url, "https://"),
    ])
  }

  provisioner "local-exec" {
    when        = create
    interpreter = ["uv", "run", "-w", "boto3", "python", "-c"]
    environment = {
      AWS_PROFILE     = self.triggers.aws_account_id
      ROLE_NAME       = self.triggers.role_name
      OIDC_ISSUER     = self.triggers.oidc_issuer
      OIDC_ISSUER_ARN = self.triggers.oidc_issuer_arn
      PYTHONPATH      = path.module
    }
    command = <<-EOT
      import os
      from lib import insert_oidc_into_role

      insert_oidc_into_role(
        aws_profile=os.environ['AWS_PROFILE'],
        role_name=os.environ['ROLE_NAME'],
        oidc_issuer=os.environ['OIDC_ISSUER'],
        oidc_issuer_arn=os.environ['OIDC_ISSUER_ARN']
      )
    EOT
  }

  provisioner "local-exec" {
    when        = destroy
    interpreter = ["uv", "run", "-w", "boto3", "python", "-c"]
    environment = {
      AWS_PROFILE     = self.triggers.aws_account_id
      ROLE_NAME       = self.triggers.role_name
      OIDC_ISSUER     = self.triggers.oidc_issuer
      OIDC_ISSUER_ARN = self.triggers.oidc_issuer_arn
      PYTHONPATH      = path.module
    }
    command = <<-EOT
      import os
      from lib import remove_oidc_from_role

      remove_oidc_from_role(
        aws_profile=os.environ['AWS_PROFILE'],
        role_name=os.environ['ROLE_NAME'],
        oidc_issuer=os.environ['OIDC_ISSUER'],
        oidc_issuer_arn=os.environ['OIDC_ISSUER_ARN']
      )
    EOT
  }
}