{% set config = merged_configs.get('azurerm_kubernetes_cluster', {}) %}
{% set comments = compliance_comments.get('azurerm_kubernetes_cluster', []) %}
# ------------------------------------------------------------------------------
# Azure Kubernetes Service (AKS)
# ------------------------------------------------------------------------------
{% for comment in comments %}
# {{ comment }}
{% endfor %}

resource "azurerm_kubernetes_cluster" "this" {
  name                = "{{ config.get('name', project_id ~ '-aks') }}"
  resource_group_name = var.resource_group_name
  location            = var.region
  dns_prefix          = "{{ config.get('dns_prefix', project_id) }}"

  kubernetes_version = {{ config.get('kubernetes_version', 'null') }}

  # Default node pool
  default_node_pool {
    name                = "{{ config.get('default_node_pool_name', 'default') }}"
    node_count          = {{ config.get('node_count', 3) }}
    vm_size             = "{{ config.get('vm_size', 'Standard_D2s_v3') }}"
    os_disk_size_gb     = {{ config.get('os_disk_size_gb', 128) }}
    os_disk_type        = "{{ config.get('os_disk_type', 'Managed') }}"
    vnet_subnet_id      = {{ config.get('vnet_subnet_id', 'null') }}
    max_pods            = {{ config.get('max_pods', 110) }}
    enable_auto_scaling = {{ config.get('enable_auto_scaling', true) | lower }}

    {% if config.get('enable_auto_scaling', true) %}
    min_count = {{ config.get('min_count', 1) }}
    max_count = {{ config.get('max_count', 5) }}
    {% endif %}
  }

  # Identity
  identity {
    type = "{{ config.get('identity_type', 'SystemAssigned') }}"
  }

  # Network profile
  network_profile {
    network_plugin    = "{{ config.get('network_plugin', 'azure') }}"
    network_policy    = "{{ config.get('network_policy', 'calico') }}"
    load_balancer_sku = "{{ config.get('load_balancer_sku', 'standard') }}"
    outbound_type     = "{{ config.get('outbound_type', 'loadBalancer') }}"
  }

  # Azure AD RBAC
  azure_active_directory_role_based_access_control {
    azure_rbac_enabled = {{ config.get('azure_rbac_enabled', true) | lower }}
    managed            = true
  }

  # API server access
  {% if config.get('private_cluster_enabled', true) %}
  private_cluster_enabled = true
  {% endif %}

  {% if config.get('api_server_authorized_ip_ranges') %}
  api_server_access_profile {
    authorized_ip_ranges = {{ config.api_server_authorized_ip_ranges }}
  }
  {% endif %}

  # Key Vault secrets provider
  key_vault_secrets_provider {
    secret_rotation_enabled  = {{ config.get('secret_rotation_enabled', true) | lower }}
    secret_rotation_interval = "{{ config.get('secret_rotation_interval', '2m') }}"
  }

  # OMS Agent (monitoring)
  oms_agent {
    log_analytics_workspace_id = {{ config.get('log_analytics_workspace_id', 'null') }}
  }

  # Microsoft Defender
  {% if config.get('microsoft_defender_enabled', false) %}
  microsoft_defender {
    log_analytics_workspace_id = {{ config.get('defender_workspace_id', 'null') }}
  }
  {% endif %}

  # Auto-upgrade
  automatic_upgrade_channel = "{{ config.get('automatic_upgrade_channel', 'patch') }}"

  # Disk encryption
  {% if config.get('disk_encryption_set_id') %}
  disk_encryption_set_id = "{{ config.disk_encryption_set_id }}"
  {% endif %}

  # Local account disabled for security
  local_account_disabled = {{ config.get('local_account_disabled', true) | lower }}

  tags = {
    Name      = "{{ config.get('name', project_id ~ '-aks') }}"
    ManagedBy = "complyform"
  }
}
