resource "ovh_cloud_project_kube" "this" {
  service_name  = var.project_id
  name          = "${var.name_prefix}-${var.deployment_id}"
  region        = var.region
  version       = var.k8s_version
  update_policy = var.k8s_update_policy

  # Only set when deploying in private mode, null keeps the cluster public
  private_network_id = var.private_network_id
  nodes_subnet_id    = var.nodes_subnet_id

  dynamic "private_network_configuration" {
    for_each = var.private_network_id != null ? [1] : []
    content {
      default_vrack_gateway              = coalesce(var.gateway_ip, "")
      private_network_routing_as_default = var.gateway_ip != null
    }
  }
}

resource "ovh_cloud_project_kube_nodepool" "this" {
  service_name = var.project_id
  kube_id      = ovh_cloud_project_kube.this.id
  name         = "${var.name_prefix}-pool-${var.deployment_id}"
  flavor_name  = var.nodepool_flavor

  desired_nodes = var.nodepool_desired_nodes
  min_nodes     = var.nodepool_min_nodes
  max_nodes     = var.nodepool_max_nodes

  autoscale      = var.nodepool_autoscale
  anti_affinity  = var.nodepool_anti_affinity
  monthly_billed = var.nodepool_monthly_billed
}

// Chained on the freshly created cluster: client certificate auth from the
// OVH generated admin credentials. Used only to manage the access objects,
// the material itself never reaches an output, a repository or Kafka.
provider "kubernetes" {
  host                   = ovh_cloud_project_kube.this.kubeconfig_attributes[0].host
  cluster_ca_certificate = base64decode(ovh_cloud_project_kube.this.kubeconfig_attributes[0].cluster_ca_certificate)
  client_certificate     = base64decode(ovh_cloud_project_kube.this.kubeconfig_attributes[0].client_certificate)
  client_key             = base64decode(ovh_cloud_project_kube.this.kubeconfig_attributes[0].client_key)
}