resource "aws_s3_bucket" "o11y-backups" {
  bucket = "o11y-${var.env}-${var.logical_region_name}-backups"

  tags = merge({
    tidbcloud-auto-deploy-owner = local.eks.name
  }, var.tags)
}

resource "aws_s3_bucket_policy" "o11y-backups-policy" {
  bucket = aws_s3_bucket.o11y-backups.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "DenyInsecureConnections"
        Effect    = "Deny"
        Principal = "*"
        Action    = "s3:*"
        Resource = [
          "arn:aws:s3:::${aws_s3_bucket.o11y-backups.id}",
          "arn:aws:s3:::${aws_s3_bucket.o11y-backups.id}/*"
        ]
        Condition = {
          Bool = {
            "aws:SecureTransport" = "false"
          }
        }
      }
    ]
  })
}

module "o11y-infra" {
  source = "../../../modules/app"
  depends_on = [
    module.register-region-meta,
    kubernetes_secret_v1.clinic_alert_proxy_basic_auth_self_monitoring,
  ]

  workflow = "new-region-infra.yaml"
  gh_repo  = "tidbcloud/observability"
  parameters = {
    vendor            = "aws"
    region            = var.aws_region
    logicalRegionName = var.logical_region_name
    env               = var.env
    cluster           = local.eks.name
    args = jsonencode({
      alertmanagerRoleArn    = local.o11y_control_plane_role_arn
      regionalServerRoleARN  = local.o11y_control_plane_role_arn
      o11yBackupRoleArn      = local.o11y_control_plane_role_arn
      o11yBackupBucket       = aws_s3_bucket.o11y-backups.bucket
      nginxReadIngressClass  = "nginx-read"
      nginxWriteIngressClass = "nginx-write"
      imageRegistry          = var.byoc_ecr
      hostedZoneName         = var.o11y_hosted_zone_name
      clinicPrivateDNS       = local.clinic_dns_entry
      clinicSecretName       = local.clinic_secret_name
      tenantID               = var.byoc_tenant_id
      byoc                   = true
    })
  }
  wait_workflow_success = true
  finalizer = {
    workflow = "destroy-region-infra.yaml"
    parameters = {
      vendor            = "aws"
      region            = var.aws_region
      logicalRegionName = var.logical_region_name
      env               = var.env
    }
  }
}

data "kubernetes_nodes" "this" {
  depends_on = [module.kubeconfig, module.eks]
}

module "o11y-infra-cd" {
  depends_on = [module.o11y-infra]
  source     = "../../../modules/app"

  kubeconfig_path = module.kubeconfig.path
  workflow        = "infra-cd-v2.yaml"
  gh_repo         = "tidbcloud/observability"
  parameters = {
    vendor       = "aws"
    region       = var.logical_region_name
    env          = var.env
    git-ref      = "main"
    aws-role-arn = "arn:aws:iam::${local.aws_account_id}:role/auto-deploy-cli"
    bootstrap    = "true"
  }
  services = [
    {
      name      = "deploy/eventrouter"
      namespace = "kube-system"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "deploy/volume-autoscaler"
      namespace = "self-monitoring"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "deploy/victoria-metrics-operator"
      namespace = "self-monitoring"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "sts/prometheus-self-monitoring-kube-prome-prometheus"
      namespace = "self-monitoring"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "sts/alertmanager-self-monitoring-kube-prome-alertmanager"
      namespace = "self-monitoring"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "ds/self-vector"
      namespace = "self-monitoring"
      wait_for  = "jsonpath='{.status.numberReady}'=${length(data.kubernetes_nodes.this.nodes)}"
    }
  ]
  wait_workflow_success = true
  check_before_destroy  = false
}