resource "kubernetes_namespace" "terraform_mcp" {
  metadata {
    name = "terraform-mcp"
  }
}

resource "kubernetes_service_account" "terraform_mcp" {
  metadata {
    name      = "terraform-mcp-sa"
    namespace = kubernetes_namespace.terraform_mcp.metadata[0].name
  }

  automount_service_account_token = false
}

resource "kubernetes_deployment" "terraform_mcp" {
  metadata {
    name      = "terraform-mcp"
    namespace = kubernetes_namespace.terraform_mcp.metadata[0].name
    labels = {
      app = "terraform-mcp"
    }
  }

  spec {
    replicas = 1

    selector {
      match_labels = {
        app = "terraform-mcp"
      }
    }

    strategy {
      type = "Recreate"
    }

    template {
      metadata {
        labels = {
          app = "terraform-mcp"
        }
      }

      spec {
        service_account_name            = kubernetes_service_account.terraform_mcp.metadata[0].name
        automount_service_account_token = false

        container {
          name  = "terraform-mcp"
          image = "hashicorp/terraform-mcp-server:${local.app_version}"

          env {
            name  = "TRANSPORT_MODE"
            value = "streamable-http"
          }

          env {
            name  = "TRANSPORT_PORT"
            value = "8084"
          }

          env {
            name  = "TRANSPORT_HOST"
            value = "0.0.0.0"
          }

          security_context {
            allow_privilege_escalation = false
            privileged                 = false

            capabilities {
              drop = ["ALL"]
            }
          }

          port {
            name           = "http"
            container_port = 8084
            protocol       = "TCP"
          }

          liveness_probe {
            http_get {
              path = "/health"
              port = "http"
            }
            initial_delay_seconds = 10
            period_seconds        = 15
          }

          readiness_probe {
            http_get {
              path = "/health"
              port = "http"
            }
            initial_delay_seconds = 5
            period_seconds        = 10
          }
        }
      }
    }
  }
}

resource "kubernetes_service" "terraform_mcp" {
  metadata {
    name      = "terraform-mcp-service"
    namespace = kubernetes_namespace.terraform_mcp.metadata[0].name
  }

  spec {
    selector = {
      app = "terraform-mcp"
    }

    port {
      name        = "http"
      port        = 80
      target_port = 8084
    }

    type = "ClusterIP"
  }

  lifecycle {
    ignore_changes = [
      metadata[0].annotations
    ]
  }
}