##############################################################################
# Deployment Script: Managed Kubernetes cluster (OVHcloud)
#
# Thin root calling the provisioner owned "kubernetes" catalog module. The
# module provisions an OVH Managed Kubernetes (MKS) cluster with one node
# pool and generates the access credentials: the consumer receives a scoped
# ServiceAccount kubeconfig with a non expiring token, valid until a
# credential renewal is requested; day 2 renewal uses a dedicated root
# kubeconfig. All credential material is written by the
# module to Vault under the existing path contract; only the Vault path is
# returned in the provisioning response. The OVH admin certificates are
# never delivered.
#
# No terraform/required_providers and no provider blocks are needed: the
# catalog module carries its own provider requirements, the cloud provider
# is configured from the runner environment and the Vault provider file is
# generated by the provisioner.
#
# Placeholders (all filled by the provisioner, never typed by the user):
#   - the module source placeholder resolves to the kubernetes module of the
#     cloudProvider sent in the request headers
#   - 8765 is the scriptTriggerId of the request
#   - development-test is the value of the cloudAccount header
#   - 25bd0789-a301-465b-a45d-bf624732e842 is the value of the requesterUniqueId header
##############################################################################

module "kubernetes" {
  source              = "git::http://gitea-http.dataprovider01.svc.cluster.local:3000/gitops_test/tfmodules.git//kubernetes/ovh?ref=3.2.0-F-feature-simpl-31671.660.aaad53cc"
  deployment_id       = "8765"
  cloud_account       = "development-test"
  requester_unique_id = "25bd0789-a301-465b-a45d-bf624732e842"

  # OVHcloud region. Must support Managed Kubernetes (OVH API:
  # /cloud/project/{id}/capabilities/kube/regions). The project itself is not
  # set here: the provider resolves it from the cloud account configuration
  # of the environment (OVH_CLOUD_PROJECT_SERVICE in the runner environment).
  region = "SBG5"

  # Cluster: version must be one of the versions currently supported by OVH
  # MKS; update_policy is ALWAYS_UPDATE, MINIMAL_DOWNTIME or NEVER_UPDATE.
  k8s_version       = "1.32"
  k8s_update_policy = "ALWAYS_UPDATE"

  # Node pool sizing. Set nodepool_autoscale = true to enable the OVH managed
  # cluster autoscaler between min and max nodes.
  nodepool_flavor        = "b3-8"
  nodepool_desired_nodes = 3
  nodepool_min_nodes     = 1
  nodepool_max_nodes     = 5
  nodepool_autoscale     = false

  # Optional private mode: attach the worker nodes to an existing vRack
  # network of the same project. Leave unset for a public cluster.
  # private_network_id = "<openstack network id>"
  # nodes_subnet_id    = "<subnet id>"
  # gateway_ip         = "<vrack gateway ip>"
}

output "cluster_id" {
  value = module.kubernetes.cluster_id
}

output "cluster_name" {
  value = module.kubernetes.cluster_name
}

output "cluster_url" {
  value = module.kubernetes.cluster_url
}

output "cluster_version" {
  value = module.kubernetes.cluster_version
}

output "credentials_ref" {
  value = module.kubernetes.credentials_ref
}