locals {
  issuers_additional_args = {
    dnsZone                    = var.issuer_dns_zone
    controlplaneSubscriptionID = var.pingcap_subscription_id
    hostedZoneResourceGroup    = var.issuer_hosted_zone_resource_group
    certManagerClientID        = module.iam.cert_manager_client_id
  }
}

module "cert_manager" {
  source = "../../../modules/app"

  kubeconfig_path = module.kubeconfig.path
  workflow        = "deploy-new-region-next-gen-cert-manager.yaml"
  parameters = {
    cloud               = "azure"
    env                 = var.env
    region              = var.cloud_region
    logicalRegionName   = var.logical_region_name
    cluster             = module.argocd_cluster.name
    certManagerClientID = module.iam.cert_manager_client_id
  }
  services = [
    {
      name      = "deploy/cert-manager"
      namespace = "cert-manager"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    }
  ]
}

module "issuers" {
  depends_on = [module.cert_manager]
  source     = "../../../modules/app"

  kubeconfig_path = module.kubeconfig.path
  workflow        = "deploy-new-region-next-gen-issuers.yaml"
  parameters = {
    cloud             = "azure"
    env               = var.env
    region            = var.cloud_region
    logicalRegionName = var.logical_region_name
    cluster           = module.argocd_cluster.name
    additionalArgs    = jsonencode(local.issuers_additional_args)
  }
  services = [
    {
      name     = "ClusterIssuer/letsencrypt-issuer"
      wait_for = "condition=Ready"
    }
  ]
}

module "external_secrets_operator" {
  depends_on = [module.issuers]
  source     = "../../../modules/app"

  kubeconfig_path = module.kubeconfig.path
  workflow        = "deploy-new-region-next-gen-external-secrets-operator.yaml"
  parameters = {
    cloud                         = "azure"
    env                           = var.env
    region                        = var.cloud_region
    logicalRegionName             = var.logical_region_name
    cluster                       = module.argocd_cluster.name
    azureKeyVaultURL              = var.region_key_vault_uri
    azureWorkloadIdentityClientID = module.iam.external_secrets_operator_client_id
    azureWorkloadIdentityTenantID = var.pingcap_tenant_id
  }
  services = [
    {
      name      = "deploy/external-secrets"
      namespace = "external-secrets"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "deploy/external-secrets-cert-controller"
      namespace = "external-secrets"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
    {
      name      = "deploy/external-secrets-webhook"
      namespace = "external-secrets"
      wait_for  = "jsonpath='{.status.availableReplicas}'=REPLICAS"
    },
  ]
}