module "o11y-infra" {
  source = "../../modules/app"
  depends_on = [
    module.register-region-meta,
    null_resource.k8s_cleanup,
    # The old deploy DAG (deploy-jobs/o11y-aws-region-control/infra.yaml) waits
    # for basic-dms before infra; keep the edge so the dms role exists before
    # the self-monitoring alertmanager assumes it.
    aws_iam_role.dms,
  ]

  workflow = "new-region-infra.yaml"
  gh_repo  = "tidbcloud/observability"
  gh_ref   = "main"
  parameters = {
    vendor            = "aws"
    region            = var.aws_region
    logicalRegionName = var.logical_region_name
    env               = var.env
    cluster           = local.cluster_name
    args = jsonencode({
      alertmanagerRoleArn    = aws_iam_role.alertmanager.arn
      o11yBackupRoleArn      = aws_iam_role.o11y_backup.arn
      o11yBackupBucket       = aws_s3_bucket.o11y_backups.bucket
      nginxReadIngressClass  = "nginx-read"
      nginxWriteIngressClass = "nginx-write"
      regionalServerRoleARN  = aws_iam_role.regional_server.arn
      imageRegistry          = local.image_registry
      hostedZoneName         = local.hosted_zone_name
      certificateARN         = local.rs_certificate_arn
      wafACLARN              = aws_wafv2_web_acl.rs.arn
    })
  }
  wait_workflow_success = true
  finalizer = {
    workflow = "destroy-region-infra.yaml"
    parameters = {
      vendor            = "aws"
      region            = var.aws_region
      logicalRegionName = var.logical_region_name
      env               = var.env
    }
  }
}

data "kubernetes_nodes" "this" {
  depends_on = [module.kubeconfig, module.eks]
}

module "o11y-infra-cd" {
  source     = "../../modules/app"
  depends_on = [module.o11y-infra]

  kubeconfig_path = module.kubeconfig.path
  workflow        = "infra-cd-v2.yaml"
  gh_repo         = "tidbcloud/observability"
  gh_ref          = "main"
  parameters = {
    vendor  = "aws"
    region  = var.logical_region_name
    env     = var.env
    git-ref = "main"
  }
  services = [
    {
      name      = "deploy/eventrouter"
      namespace = "kube-system"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "deploy/volume-autoscaler"
      namespace = "self-monitoring"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "deploy/victoria-metrics-operator"
      namespace = "self-monitoring"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "sts/prometheus-self-monitoring-kube-prome-prometheus"
      namespace = "self-monitoring"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "sts/alertmanager-self-monitoring-kube-prome-alertmanager"
      namespace = "self-monitoring"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "ds/self-vector"
      namespace = "self-monitoring"
      wait_for  = "jsonpath='{.status.numberReady}'=${length(data.kubernetes_nodes.this.nodes)}"
    },
    # cert-manager is deployed on AWS only (the old infra script adds it when vendor == aws)
    {
      name      = "deploy/cert-manager"
      namespace = "kube-system"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
  ]
  wait_workflow_success = true
  check_before_destroy  = false
}