locals {
  name = "${var.env}-seed-${var.logical_region_name}"
  states = {
    "base"   = "aws/base/${var.env}.json"
    "seed"   = "aws/account/seed/${var.env}.json"
    "clinic" = var.env == "dev" ? "aws/clinic/staging.json" : "aws/clinic/${var.env}.json"
    "devops" = var.env == "dev" ? "aws/devops/staging.json" : "aws/devops/${var.env}.json"
    "argocd" = "gke/argocd/${var.env}.json"
    "runner" = "gke/runner/prod.json"
    # we always use prod o11y global regardless of current deployment env
    "o11y" = "aws/o11y-global/prod.json"
  }
}

data "aws_s3_object" "states" {
  for_each = local.states
  bucket   = "autonomous-deployment-terraform-state"
  key      = each.value

  provider = aws.tf_state
}

locals {
  base_outputs           = jsondecode(data.aws_s3_object.states["base"].body).outputs
  seed_outputs           = jsondecode(data.aws_s3_object.states["seed"].body).outputs
  clinic_outputs         = jsondecode(data.aws_s3_object.states["clinic"].body).outputs
  devops_outputs         = jsondecode(data.aws_s3_object.states["devops"].body).outputs
  argocd_outputs         = jsondecode(data.aws_s3_object.states["argocd"].body).outputs
  runner_outputs         = jsondecode(data.aws_s3_object.states["runner"].body).outputs
  o11y_outputs           = jsondecode(data.aws_s3_object.states["o11y"].body).outputs
  base_account           = local.seed_outputs.base_account.value
  seed_account           = local.seed_outputs.seed_account.value
  o11y_account           = local.o11y_outputs.account.value
  base_public_ips        = local.base_outputs.public_ips.value
  hosted_zone_name       = local.seed_outputs.hosted_zone_name.value
  hosted_zone_id         = local.seed_outputs.hosted_zone_id.value
  pca_arn                = local.base_outputs.pca_arn.value
  billing_sqs_arn        = local.base_outputs.billing_sqs_arn.value
  devops_server_role_arn = local.devops_outputs.devops_server_role_arn.value
  public_access_cidrs = var.env == "dev" ? ["0.0.0.0/0"] : concat(
    formatlist("%s/32", local.base_outputs.public_ips.value),
    formatlist("%s/32", local.devops_outputs.public_ips.value),
    formatlist("%s/32", local.argocd_outputs.public_ips.value),
    formatlist("%s/32", local.runner_outputs.public_ips.value),
  )
}

module "argocd_cluster" {
  source = "../../modules/argocd_cluster"

  env    = var.env
  name   = "${var.env}-seed-${var.logical_region_name}"
  server = local.eks.endpoint
  data = jsonencode({
    execProviderConfig = {
      apiVersion = "client.authentication.k8s.io/v1beta1"
      command    = "argocd-k8s-auth"
      args = [
        "aws",
        "--cluster-name",
        local.eks.name,
      ]
      env = {
        AWS_ROLE_ARN = "arn:aws:iam::${local.seed_account}:role/argocd-oidc-role"
      }
    }
    tlsClientConfig = {
      insecure = false
      caData   = local.eks.certificate_authority_data
    }
  })
}

module "kubeconfig" {
  source     = "../../modules/kubeconfig"
  kubeconfig = local.eks.kubeconfig
  path       = "/tmp/${local.eks.name}-kubeconfig"

  depends_on = [module.eks, module.vpc, module.argocd_cluster]
}

module "region_registration" {
  depends_on          = [time_sleep.wait_for_dns_regional_api, module.dataplane-manager, module.falco]
  source              = "../../modules/global_registration"
  env                 = var.env
  cloud_provider      = "aws"
  cloud_region        = var.aws_region
  logical_region_name = var.logical_region_name
  deploy_type         = "DEPLOY_TYPE_NEXTGEN"
  service_plan        = "Premium"
  dataplane_accounts  = var.dataplane_accounts
  service_address     = "https://${var.logical_region_name}.regional-api.${local.hosted_zone_name}"
  audit_log_bucket    = "tidbcloud-${var.env}-${var.logical_region_name}-nextgen-audit"
  shared_bucket       = "tidbcloud-sli-data-${var.env}-${var.logical_region_name}"
}