# The old script resolved the subnet by tag filter (vpc + zone + *Private*);
# here it is read back from the node-group subnet so the Name tag always
# matches what the VPC module created.
data "aws_subnet" "node_group" {
  id = local.node_group_subnet_ids[0]
}

module "cloud-addon" {
  source = "../../modules/app"
  depends_on = [
    module.o11y-infra-cd,
    module.register-region-meta,
    null_resource.k8s_cleanup,
  ]

  workflow = "new-region-cloud-addon.yaml"
  gh_repo  = "tidbcloud/observability"
  gh_ref   = "main"
  parameters = {
    vendor            = "aws"
    region            = var.aws_region
    logicalRegionName = var.logical_region_name
    env               = var.env
    cluster           = local.cluster_name
    args = jsonencode({
      hostedZoneName = local.hosted_zone_name
      # The old script passed the full "/hostedzone/<id>" form (used as
      # external-dns txtOwnerId); keep it byte-identical.
      hostedZoneId             = "/hostedzone/${data.aws_route53_zone.this.zone_id}"
      imageRegistry            = local.image_registry
      clusterAutoscalerRoleArn = aws_iam_role.aws_ca.arn
      albControllerRoleArn     = aws_iam_role.alb_controller.arn
      externalDNSRoleArn       = aws_iam_role.external_dns.arn
      dsWAFID                  = aws_wafv2_web_acl.ds.arn
      dsCertID                 = local.ds_certificate_arn
      dsLogsBucketName         = aws_s3_bucket.ds_logs.bucket
      subnetName               = data.aws_subnet.node_group.tags["Name"]
    })
  }
  wait_workflow_success = true
  finalizer = {
    workflow = "destroy-region-cloud-addon.yaml"
    parameters = {
      vendor            = "aws"
      region            = var.aws_region
      logicalRegionName = var.logical_region_name
      env               = var.env
    }
  }
}

module "cloud-addon-cd" {
  source     = "../../modules/app"
  depends_on = [module.cloud-addon]

  kubeconfig_path = module.kubeconfig.path
  workflow        = "cloud-addon-cd.yaml"
  gh_repo         = "tidbcloud/observability"
  gh_ref          = "main"
  parameters = {
    vendor  = "aws"
    region  = var.logical_region_name
    env     = var.env
    git-ref = "main"
  }
  services = [
    {
      name      = "deploy/ingress-nginx-read-controller"
      namespace = "kube-system"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "deploy/ingress-nginx-write-controller"
      namespace = "kube-system"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "deploy/external-dns"
      namespace = "kube-system"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "deploy/cluster-autoscaler"
      namespace = "kube-system"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "deploy/aws-load-balancer-controller"
      namespace = "kube-system"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
  ]
  wait_workflow_success = true
  check_before_destroy  = false
}