locals {
  aks_identity_names = {
    control_plane = trimspace(var.o11y_aks_control_plane_identity_name)
    kubelet       = trimspace(var.o11y_aks_kubelet_identity_name)
  }

  valid_aks_identity_names = {
    for name, identity_name in local.aks_identity_names : name => identity_name
    if identity_name != "" && !strcontains(identity_name, "/")
  }

  aks_identity_resource_ids = {
    for name in keys(local.aks_identity_names) : name => try(data.azurerm_user_assigned_identity.aks[name].id, "")
  }
}

data "azurerm_user_assigned_identity" "aks" {
  for_each = local.valid_aks_identity_names

  name                = each.value
  resource_group_name = var.o11y_identity_resource_group
}

resource "null_resource" "o11y_aks_identity_prerequisites" {
  triggers = merge(
    { for name, identity_name in local.aks_identity_names : "name_${name}" => identity_name },
    { for name, resource_id in local.aks_identity_resource_ids : "resource_id_${name}" => resource_id },
    { for name, identity in data.azurerm_user_assigned_identity.aks : "client_id_${name}" => identity.client_id },
    { for name, identity in data.azurerm_user_assigned_identity.aks : "principal_id_${name}" => identity.principal_id },
    {
      resource_group_name = var.o11y_identity_resource_group
    },
  )

  lifecycle {
    precondition {
      condition = alltrue([
        for identity_name in values(local.aks_identity_names) : identity_name != "" && !strcontains(identity_name, "/")
      ])
      error_message = "Azure BYOC O11Y AKS control-plane and kubelet identity names are required and must be Azure user-assigned managed identity names, not ARM resource IDs."
    }

    precondition {
      condition = alltrue([
        for name in ["control_plane", "kubelet"] : try(data.azurerm_user_assigned_identity.aks[name].client_id, "") != "" && try(data.azurerm_user_assigned_identity.aks[name].principal_id, "") != ""
      ])
      error_message = "Azure BYOC O11Y AKS identity client IDs and principal IDs could not be resolved from the provided user-assigned managed identity names and O11Y managed identity resource group."
    }
  }
}