# NOTE: These S3 buckets must be emptied (all objects, versions, and delete markers
# removed) manually before running `terraform destroy`. AWS will refuse to delete
# a non-empty bucket, causing the destroy to fail.
resource "aws_s3_bucket" "shared" {
  bucket        = "o11y-${var.env}-shared-${var.logical_region_name}"
  force_destroy = true

  tags = merge({
    tidbcloud-auto-deploy-owner = local.eks.name
  }, var.tags)
}

resource "aws_s3_bucket_policy" "shared" {
  bucket = aws_s3_bucket.shared.id
  policy = jsonencode({
    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Sid" : "DenyInsecureConnections",
        "Effect" : "Deny",
        "Principal" : "*",
        "Action" : "s3:*",
        "Resource" : [
          "arn:aws:s3:::${aws_s3_bucket.shared.id}",
          "arn:aws:s3:::${aws_s3_bucket.shared.id}/*"
        ],
        "Condition" : {
          "Bool" : {
            "aws:SecureTransport" : "false"
          }
        }
      }
    ]
  })
}

resource "aws_s3_bucket" "loki" {
  bucket        = "loki-${var.env}-${var.logical_region_name}-o11y"
  force_destroy = true

  tags = merge({
    tidbcloud-auto-deploy-owner = local.eks.name
  }, var.tags)
}

resource "aws_s3_bucket_policy" "loki" {
  bucket = aws_s3_bucket.loki.id
  policy = jsonencode({
    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Sid" : "DenyInsecureConnections",
        "Effect" : "Deny",
        "Principal" : "*",
        "Action" : "s3:*",
        "Resource" : [
          "arn:aws:s3:::${aws_s3_bucket.loki.id}",
          "arn:aws:s3:::${aws_s3_bucket.loki.id}/*"
        ],
        "Condition" : {
          "Bool" : {
            "aws:SecureTransport" : "false"
          }
        }
      }
    ]
  })
}

module "o11y-dataplane" {
  depends_on = [
    module.cloud-addon-cd,
    kubernetes_secret_v1.clinic_alert_proxy_basic_auth_default,
  ]
  source = "../../../modules/app"

  workflow = "new-region-dataplane.yaml"
  gh_repo  = "tidbcloud/observability"
  parameters = {
    vendor            = "aws"
    region            = var.aws_region
    logicalRegionName = var.logical_region_name
    env               = var.env
    cluster           = local.eks.name
    args = jsonencode({
      vmclusterBucketName    = aws_s3_bucket.shared.bucket
      vmclusterRoleARN       = local.o11y_control_plane_role_arn
      lokiBucketName         = aws_s3_bucket.loki.bucket
      lokiRoleARN            = local.o11y_control_plane_role_arn
      nginxReadIngressClass  = "nginx-read"
      nginxWriteIngressClass = "nginx-write"
      imageRegistry          = var.byoc_ecr
      hostedZoneName         = var.o11y_hosted_zone_name
      clinicPrivateDNS       = local.clinic_dns_entry
      clinicSecretName       = local.clinic_secret_name
      byoc                   = true
    })
  }
  wait_workflow_success = true
  finalizer = {
    workflow = "destroy-region-dataplane.yaml"
    parameters = {
      vendor            = "aws"
      region            = var.aws_region
      logicalRegionName = var.logical_region_name
      env               = var.env
    }
  }
}

module "o11y-dataplane-cd" {
  depends_on = [module.o11y-dataplane]
  source     = "../../../modules/app"

  kubeconfig_path = module.kubeconfig.path
  workflow        = "dataplane-cd.yaml"
  gh_repo         = "tidbcloud/observability"
  parameters = {
    vendor       = "aws"
    region       = var.logical_region_name
    env          = var.env
    git-ref      = "main"
    aws-role-arn = "arn:aws:iam::${local.aws_account_id}:role/auto-deploy-cli"
    bootstrap    = "true"
  }
  services = [
    {
      name      = "sts/vmstorage-vmcluster"
      namespace = "observability"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "sts/vmselect-vmcluster"
      namespace = "observability"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "deploy/vminsert-vmcluster"
      namespace = "observability"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "sts/alertmanager-alert-regional"
      namespace = "default"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    }
  ]
  wait_workflow_success = true
  check_before_destroy  = false
}