resource "kubernetes_service_account" "metrics_server" {
  metadata {
    name      = "metrics-server"
    namespace = var.namespace
    labels = {
      k8s-app = "metrics-server"
    }
  }
}

resource "kubernetes_cluster_role" "aggregated_metrics_reader" {
  metadata {
    name = "system:aggregated-metrics-reader"
    labels = {
      k8s-app                                        = "metrics-server"
      "rbac.authorization.k8s.io/aggregate-to-admin" = "true"
      "rbac.authorization.k8s.io/aggregate-to-edit"  = "true"
      "rbac.authorization.k8s.io/aggregate-to-view"  = "true"
    }
  }
  rule {
    api_groups = ["metrics.k8s.io"]
    resources  = ["pods", "nodes"]
    verbs      = ["get", "list", "watch"]
  }
}

resource "kubernetes_cluster_role" "metrics_server" {
  metadata {
    name = "system:metrics-server"
    labels = {
      k8s-app = "metrics-server"
    }
  }
  rule {
    api_groups = [""]
    resources  = ["nodes/metrics"]
    verbs      = ["get"]
  }
  rule {
    api_groups = [""]
    resources  = ["pods", "nodes"]
    verbs      = ["get", "list", "watch"]
  }
}

resource "kubernetes_role_binding" "metrics_server_auth_reader" {
  metadata {
    name      = "metrics-server-auth-reader"
    namespace = var.namespace
    labels = {
      k8s-app = "metrics-server"
    }
  }
  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "Role"
    name      = "extension-apiserver-authentication-reader"
  }
  subject {
    kind      = "ServiceAccount"
    name      = "metrics-server"
    namespace = var.namespace
  }
}

resource "kubernetes_cluster_role_binding" "metrics_server_auth_delegator" {
  metadata {
    name = "metrics-server:system:auth-delegator"
    labels = {
      k8s-app = "metrics-server"
    }
  }
  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = "system:auth-delegator"
  }
  subject {
    kind      = "ServiceAccount"
    name      = "metrics-server"
    namespace = var.namespace
  }
}

resource "kubernetes_cluster_role_binding" "metrics_server" {
  metadata {
    name = "system:metrics-server"
    labels = {
      k8s-app = "metrics-server"
    }
  }
  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = "system:metrics-server"
  }
  subject {
    kind      = "ServiceAccount"
    name      = "metrics-server"
    namespace = var.namespace
  }
}

resource "kubernetes_service" "metrics_server" {
  metadata {
    name      = "metrics-server"
    namespace = var.namespace
    labels = {
      k8s-app = "metrics-server"
    }
  }
  spec {
    selector = {
      k8s-app = "metrics-server"
    }
    port {
      name        = "https"
      port        = 443
      protocol    = "TCP"
      target_port = "https"
    }
  }
}

resource "kubernetes_deployment" "metrics_server" {
  metadata {
    name      = "metrics-server"
    namespace = var.namespace
    labels = {
      k8s-app = "metrics-server"
    }
  }
  spec {
    selector {
      match_labels = {
        k8s-app = "metrics-server"
      }
    }
    strategy {
      type = "RollingUpdate"
      rolling_update {
        max_unavailable = 0
      }
    }
    template {
      metadata {
        labels = {
          k8s-app = "metrics-server"
        }
      }
      spec {
        service_account_name = "metrics-server"
        priority_class_name  = "system-cluster-critical"
        node_selector = {
          "kubernetes.io/os"   = "linux"
          "kubernetes.io/arch" = "$ARCH"
        }
        container {
          name              = "metrics-server"
          image             = "registry.k8s.io/metrics-server/metrics-server:${local.app_version}"
          image_pull_policy = "IfNotPresent"
          args = [
            "--cert-dir=/tmp",
            "--secure-port=4443",
            "--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname",
            "--kubelet-use-node-status-port",
            "--metric-resolution=15s",
            "--kubelet-insecure-tls"
          ]
          port {
            container_port = 4443
            name           = "https"
            protocol       = "TCP"
          }
          liveness_probe {
            http_get {
              path   = "/livez"
              port   = "https"
              scheme = "HTTPS"
            }
            failure_threshold = 3
            period_seconds    = 10
          }
          readiness_probe {
            http_get {
              path   = "/readyz"
              port   = "https"
              scheme = "HTTPS"
            }
            failure_threshold     = 3
            initial_delay_seconds = 20
            period_seconds        = 10
          }
          resources {
            requests = {
              cpu    = "100m"
              memory = "200Mi"
            }
          }
          security_context {
            read_only_root_filesystem = true
            run_as_non_root           = true
            run_as_user               = 1000
          }
          volume_mount {
            name       = "tmp-dir"
            mount_path = "/tmp"
          }
        }
        volume {
          name = "tmp-dir"
          empty_dir {}
        }
      }
    }
  }
}

resource "kubernetes_manifest" "metrics_server_apiservice" {
  manifest = {
    apiVersion = "apiregistration.k8s.io/v1"
    kind       = "APIService"
    metadata = {
      name = "v1beta1.metrics.k8s.io"
      labels = {
        k8s-app = "metrics-server"
      }
    }
    spec = {
      group                 = "metrics.k8s.io"
      groupPriorityMinimum  = 100
      insecureSkipTLSVerify = true
      service = {
        name      = "metrics-server"
        namespace = var.namespace
      }
      version         = "v1beta1"
      versionPriority = 100
    }
  }
}

# resource "kubernetes_cluster_role_binding" "microk8s_admin" {
#   metadata {
#     name = "microk8s-admin"
#   }
#   role_ref {
#     api_group = "rbac.authorization.k8s.io"
#     kind      = "ClusterRole"
#     name      = "admin"
#   }
#   subject {
#     kind      = "User"
#     name      = "front-proxy-client"
#     api_group = "rbac.authorization.k8s.io"
#   }
# }