{% set config = merged_configs.get('google_container_cluster', {}) %}
# Compliance: {{ compliance_comments.get('google_container_cluster', []) | join(', ') }}
resource "google_container_cluster" "main" {
  name     = "{{ config.get('name', '${var.project_id}-gke') }}"
  project  = var.project_id
  location = var.region

  # Use separately managed node pool
  remove_default_node_pool = true
  initial_node_count       = 1

  networking_mode = "{{ config.get('networking_mode', 'VPC_NATIVE') }}"
  datapath_provider = "{{ config.get('datapath_provider', 'ADVANCED_DATAPATH') }}"

  private_cluster_config {
    enable_private_nodes    = {{ config.get('enable_private_nodes', true) | lower }}
    enable_private_endpoint = {{ config.get('enable_private_endpoint', false) | lower }}
    master_ipv4_cidr_block  = "{{ config.get('master_ipv4_cidr_block', '172.16.0.0/28') }}"
  }

  master_authorized_networks_config {
    gcp_public_cidrs_access_enabled = {{ config.get('gcp_public_cidrs_access_enabled', false) | lower }}
  }

  ip_allocation_policy {}

  workload_identity_config {
    workload_pool = "${var.project_id}.svc.id.goog"
  }

  binary_authorization {
    evaluation_mode = "{{ config.get('binary_authorization_mode', 'PROJECT_SINGLETON_POLICY_ENFORCE') }}"
  }

  release_channel {
    channel = "{{ config.get('release_channel', 'REGULAR') }}"
  }

  addons_config {
    network_policy_config {
      disabled = {{ config.get('network_policy_disabled', false) | lower }}
    }
  }

  logging_config {
    enable_components = ["SYSTEM_COMPONENTS", "WORKLOADS"]
  }

  monitoring_config {
    enable_components = ["SYSTEM_COMPONENTS"]
    managed_prometheus {
      enabled = {{ config.get('managed_prometheus', true) | lower }}
    }
  }
}
