module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 20.0"

  cluster_name    = "${local.name_prefix}-eks"
  cluster_version = var.eks_cluster_version

  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets

  cluster_endpoint_public_access = true

  enable_cluster_creator_admin_permissions = true

  cluster_addons = {
    coredns = {
      most_recent = true
    }
    kube-proxy = {
      most_recent = true
    }
    vpc-cni = {
      most_recent = true
    }
  }

  eks_managed_node_groups = {
    web = {
      name           = "${local.name_prefix}-web"
      instance_types = var.web_node_instance_types

      min_size     = var.web_node_min_size
      max_size     = var.web_node_max_size
      desired_size = var.web_node_desired_size

      labels = {
        role = "web"
      }

      taints = []

      tags = {
        NodeGroup = "web"
      }
    }

    worker = {
      name           = "${local.name_prefix}-worker"
      instance_types = var.worker_node_instance_types

      min_size     = var.worker_node_min_size
      max_size     = var.worker_node_max_size
      desired_size = var.worker_node_desired_size

      labels = {
        role = "worker"
      }

      taints = [{
        key    = "workload"
        value  = "email-worker"
        effect = "NO_SCHEDULE"
      }]

      tags = {
        NodeGroup = "worker"
      }
    }
  }
}

# IRSA for AWS Load Balancer Controller (install via Helm in CI)
module "aws_load_balancer_controller_irsa" {
  source  = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
  version = "~> 5.0"

  role_name                              = "${local.name_prefix}-aws-lbc"
  attach_load_balancer_controller_policy = true
  oidc_providers = {
    main = {
      provider_arn               = module.eks.oidc_provider_arn
      namespace_service_accounts = ["kube-system:aws-load-balancer-controller"]
    }
  }
}