resource "azurerm_resource_group" "rg" {
  location = var.location
  name     = "${var.env}-${var.location}-controlplane"
}

resource "azurerm_virtual_network" "vnet" {
  name                = "${var.env}-${var.location}-controlplane-vnet"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  address_space       = ["10.0.0.0/16"]
}

resource "azurerm_public_ip" "nat_ip" {
  name                = "${var.env}-${var.location}-controlplane-nat-ip"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  allocation_method   = "Static"
  sku                 = "Standard"
}

resource "azurerm_nat_gateway" "nat_gateway" {
  name                = "${var.env}-${var.location}-controlplane-nat-gateway"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  sku_name            = "Standard"
}

resource "azurerm_nat_gateway_public_ip_association" "nat_gateway_public_ip_association" {
  nat_gateway_id       = azurerm_nat_gateway.nat_gateway.id
  public_ip_address_id = azurerm_public_ip.nat_ip.id
}


resource "azurerm_subnet" "subnet" {
  name                 = "${var.env}-${var.location}-controlplane-subnet"
  resource_group_name  = azurerm_resource_group.rg.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes     = ["10.0.0.0/16"]
}


resource "azurerm_subnet_nat_gateway_association" "nat_gateway_association" {
  subnet_id      = azurerm_subnet.subnet.id
  nat_gateway_id = azurerm_nat_gateway.nat_gateway.id
}

data "azurerm_kubernetes_service_versions" "aks_version" {
  location        = azurerm_resource_group.rg.location
  include_preview = false
}

resource "azurerm_kubernetes_cluster" "k8s" {
  location                  = azurerm_resource_group.rg.location
  name                      = "${var.env}-${var.location}-controlplane"
  resource_group_name       = azurerm_resource_group.rg.name
  node_resource_group       = "${var.env}-${var.location}-controlplane-node-rg"
  dns_prefix                = "${var.env}-${var.location}-controlplane"
  kubernetes_version        = var.k8s_version
  oidc_issuer_enabled       = true
  workload_identity_enabled = true
  # it's node_os_channel_upgrade in terraform module 3.112.0, and it's node_os_upgrade_channel in the module > v4
  node_os_channel_upgrade = "None"
  sku_tier                = "Standard"
  api_server_access_profile {
    authorized_ip_ranges = var.authorized_ip_ranges
  }
  tags = {
    usedby      = "dbaas-control-plane-seed"
    tenant      = "admin"
    project     = "admin"
    component   = "dbaas-control-plane-seed"
    cluster     = "admin"
    servicetype = "dedicated"
    environment = var.env
  }

  default_node_pool {
    name                        = "control"
    temporary_name_for_rotation = "temporary"
    vm_size                     = var.vm_size
    # zones                       = ["1", "2", "3"]
    # os_disk_type                = "Managed"
    # os_disk_size_gb             = 32
    # type   = "VirtualMachineScaleSets"
    os_sku = "AzureLinux"
    upgrade_settings {
      max_surge = "10%"
    }

    node_count     = var.nodepool_size
    vnet_subnet_id = azurerm_subnet.subnet.id
    tags = {
      usedby      = "dbaas-control-plane-seed"
      tenant      = "admin"
      project     = "admin"
      component   = "regional-control-plane"
      cluster     = "admin"
      servicetype = "dedicated"
      environment = var.env
    }
  }

  network_profile {
    network_plugin    = "azure"
    network_policy    = "azure"
    dns_service_ip    = "172.16.0.10"
    service_cidr      = "172.16.0.0/16"
    load_balancer_sku = "standard"
    outbound_type     = "userAssignedNATGateway"
    nat_gateway_profile {
      idle_timeout_in_minutes = 4
    }
  }

  identity {
    type = "SystemAssigned"
  }

  azure_active_directory_role_based_access_control {
    managed                = true
    admin_group_object_ids = [var.admin_group_id]
  }

  local_account_disabled = false

  lifecycle {
    ignore_changes = [
      network_profile[0].nat_gateway_profile
    ]
  }

}

resource "azurerm_role_assignment" "aks_network_contributor" {
  scope                = azurerm_subnet.subnet.id
  role_definition_name = "Network Contributor"
  principal_id         = azurerm_kubernetes_cluster.k8s.identity[0].principal_id

  depends_on = [azurerm_kubernetes_cluster.k8s]
}

resource "azurerm_role_assignment" "acr_pull" {
  scope                = "${var.acr_id_scope}"
  role_definition_name = "AcrPull"
  principal_id         = azurerm_kubernetes_cluster.k8s.kubelet_identity[0].object_id
}

data "azurerm_client_config" "current" {}

resource "azurerm_dns_zone" "controlplane" {
  name                = "${var.location}.${var.env}.azure.tidbcloud.com"
  resource_group_name = azurerm_resource_group.rg.name
}

resource "azurerm_dns_zone" "dataplane" {
  name                = "clusters.${var.location}.${var.env}.azure.tidb-cloud.com"
  resource_group_name = azurerm_resource_group.rg.name
}