terraform {
  required_providers {
    azuread = {
      source  = "hashicorp/azuread"
      version = "~> 3.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.58"
    }
  }
}

variable "env" {
  type = string
}

variable "cloud_region" {
  type = string
}

variable "logical_region_name" {
  type = string
}

variable "cluster_name" {
  type = string
}

variable "resource_group_name" {
  type = string
}

variable "oidc_issuer" {
  type = string
}

variable "key_vault_id" {
  type = string
}

variable "dns_zone_id" {
  type = string
}

variable "pingcap_subscription_id" {
  type = string
}

variable "multi_tenant_app_client_id" {
  type = string
}

variable "metering_container_scope" {
  type = string
}

variable "tags" {
  type    = map(string)
  default = {}
}

locals {
  dataplane_manager_subjects = [
    "system:serviceaccount:dataplane-manager:dataplane-manager",
    "system:serviceaccount:cluster-ng-service:cluster-ng-server",
    "system:serviceaccount:crossplane-system:azure-provider",
    "system:serviceaccount:observability:o11y-agent-control-server",
    "system:serviceaccount:ticdc-service:ticdc-service",
  ]
}

module "cert_manager" {
  source = "../../../azure_modules/workload-identity/cert-manager/controlplane"

  env                 = var.env
  cloud_region        = var.cloud_region
  logical_region_name = var.logical_region_name
  resource_group_name = var.resource_group_name
  oidc_issuer         = var.oidc_issuer
  dns_zone_id         = var.dns_zone_id
  tags                = var.tags
}

module "external_secrets_operator" {
  source = "../../../azure_modules/workload-identity/external-secrets-operator/controlplane"

  env                 = var.env
  cloud_region        = var.cloud_region
  logical_region_name = var.logical_region_name
  resource_group_name = var.resource_group_name
  oidc_issuer         = var.oidc_issuer
  key_vault_id        = var.key_vault_id
  tags                = var.tags
}

module "dataplane_manager" {
  source = "../../../azure_modules/workload-identity/dataplane-manager/controlplane-byoc"

  multi_tenant_app_client_id      = var.multi_tenant_app_client_id
  display_name_prefix             = var.cluster_name
  oidc_issuer                     = var.oidc_issuer
  controlplane_subscription_scope = "/subscriptions/${var.pingcap_subscription_id}"
  metering_container_scope        = var.metering_container_scope
  service_account_subjects        = local.dataplane_manager_subjects
}

module "metering" {
  source = "../../../azure_modules/workload-identity/metering/controlplane"

  env                      = var.env
  cloud_region             = var.cloud_region
  logical_region_name      = var.logical_region_name
  resource_group_name      = var.resource_group_name
  oidc_issuer              = var.oidc_issuer
  metering_container_scope = var.metering_container_scope
  tags                     = var.tags
}

output "cert_manager_client_id" {
  value = module.cert_manager.client_id
}

output "cert_manager_principal_id" {
  value = module.cert_manager.principal_id
}

output "external_secrets_operator_client_id" {
  value = module.external_secrets_operator.client_id
}

output "external_secrets_operator_principal_id" {
  value = module.external_secrets_operator.principal_id
}

output "dataplane_manager_client_id" {
  value = module.dataplane_manager.client_id
}

output "dataplane_manager_principal_id" {
  value = module.dataplane_manager.principal_id
}

output "metering_client_id" {
  value = module.metering.client_id
}

output "metering_principal_id" {
  value = module.metering.principal_id
}