terraform {
  required_version = ">= 1.0"

  required_providers {
    alicloud = {
      source  = "aliyun/alicloud"
      version = "~> 1.224"
    }
    local = {
      source  = "hashicorp/local"
      version = "~> 2.4"
    }
  }

  backend "local" {
    path = "terraform.tfstate"
  }
}

provider "alicloud" {
  region     = var.region
  access_key = var.access_key
  secret_key = var.secret_key
}

data "alicloud_zones" "sgp" {
  available_resource_creation = "VSwitch"
}

resource "alicloud_vpc" "this" {
  vpc_name  = "${var.project}-vpc"
  cidr_block = var.vpc_cidr

  tags = var.tags
}

resource "alicloud_vswitch" "this" {
  count      = 3

  name       = "${var.project}-vswitch-${count.index}"
  vpc_id     = alicloud_vpc.this.id
  cidr_block = cidrsubnet(var.vpc_cidr, 8, count.index)
  zone_id    = data.alicloud_zones.sgp.zones[count.index].id

  tags = var.tags
}

resource "alicloud_security_group" "this" {
  security_group_name = "${var.project}-sg"
  vpc_id             = alicloud_vpc.this.id

  tags = var.tags
}

resource "alicloud_security_group_rule" "allow_ssh" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "22/22"
  cidr_ip           = "0.0.0.0/0"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_http" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "80/80"
  cidr_ip           = "0.0.0.0/0"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_https" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "443/443"
  cidr_ip           = "0.0.0.0/0"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_k8s_api" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "6443/6443"
  cidr_ip           = "0.0.0.0/0"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_arangodb" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "8529/8529"
  cidr_ip           = "10.0.0.0/16"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_mongodb" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "27017/27017"
  cidr_ip           = "10.0.0.0/16"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_mysql" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "3306/3306"
  cidr_ip           = "10.0.0.0/16"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_postgres" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "5432/5432"
  cidr_ip           = "10.0.0.0/16"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_redis" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "6379/6379"
  cidr_ip           = "10.0.0.0/16"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_elasticsearch" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "9200/9200"
  cidr_ip           = "10.0.0.0/16"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_rabbitmq" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "5672/15672"
  cidr_ip           = "10.0.0.0/16"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_kafka" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "9092/9092"
  cidr_ip           = "10.0.0.0/16"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_kafka_zookeeper" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "2181/2181"
  cidr_ip           = "10.0.0.0/16"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_kibana" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "5601/5601"
  cidr_ip           = "0.0.0.0/0"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_prometheus" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "9090/9090"
  cidr_ip           = "10.0.0.0/16"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_grafana" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "3000/3000"
  cidr_ip           = "0.0.0.0/0"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_kubernetes_dashboard" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "8443/8443"
  cidr_ip           = "10.0.0.0/16"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_security_group_rule" "allow_nodeports" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "30000/32767"
  cidr_ip           = "0.0.0.0/0"
  security_group_id = alicloud_security_group.this.id
}

resource "alicloud_cs_managed_kubernetes" "this" {
  name_prefix = "${var.project}-k8s"
  cluster_spec = var.k8s_cluster_spec
  vswitch_ids            = alicloud_vswitch.this[*].id
  security_group_id      = alicloud_security_group.this.id

  service_cidr         = "172.20.0.0/16"
  pod_cidr            = "172.21.0.0/16"

  new_nat_gateway = true

  timeouts {
    delete = "60m"
  }

  tags = var.tags
}

resource "alicloud_cs_kubernetes_node_pool" "workers" {
  cluster_id              = alicloud_cs_managed_kubernetes.this.id
  name                   = "${var.project}-workers"
  node_pool_name         = "${var.project}-workers"
  instance_types          = [var.k8s_worker_instance_type]
  vswitch_ids             = alicloud_vswitch.this[*].id
  desired_size            = var.k8s_worker_count
  system_disk_category    = var.k8s_worker_disk_category
  system_disk_size        = var.k8s_worker_disk_size

  scaling_config {
    min_size = var.k8s_worker_count
    max_size = var.k8s_max_worker_count
  }

  data_disks {
    category = var.k8s_data_disk_category
    size     = var.k8s_data_disk_size
  }

  tags = var.tags
}

resource "alicloud_slb" "this" {
  name              = "${var.project}-slb"
  address_type      = "internet"
  vswitch_id        = alicloud_vswitch.this[0].id
  load_balancer_spec = "slb.s2.small"

  tags = var.tags
}

resource "alicloud_slb_listener" "http" {
  load_balancer_id = alicloud_slb.this.id
  frontend_port    = 80
  backend_port     = 80
  protocol         = "http"
}

resource "alicloud_slb_listener" "https" {
  count             = var.ssl_certificate_id != "" ? 1 : 0
  load_balancer_id  = alicloud_slb.this.id
  frontend_port    = 443
  backend_port     = 443
  protocol         = "https"
}

resource "local_file" "kubeconfig" {
  content  = alicloud_cs_managed_kubernetes.this.kube_config
  filename = "${path.module}/kubeconfig"
}

output "cluster_id" {
  value = alicloud_cs_managed_kubernetes.this.id
}

output "cluster_name" {
  value = alicloud_cs_managed_kubernetes.this.name
}

output "slb_public_ip" {
  value = alicloud_slb.this.address
}

output "vpc_id" {
  value = alicloud_vpc.this.id
}

output "vswitch_ids" {
  value = alicloud_vswitch.this[*].id
}

output "worker_node_count" {
  value = var.k8s_worker_count
}

output "api_server_endpoint" {
  value = "https://${alicloud_cs_managed_kubernetes.this.id}.${var.region}.alicloud.com:6443"
}