#!/usr/bin/env node
import * as cdk from 'aws-cdk-lib';
import * as eks from 'aws-cdk-lib/aws-eks';
import * as iam from 'aws-cdk-lib/aws-iam';
import { KubectlV32Layer } from '@aws-cdk/lambda-layer-kubectl-v32'; //npm install @aws-cdk/lambda-layer-kubectl-v32

const app = new cdk.App();

const stack_config: cdk.StackProps = {
  env: {
      account: process.env.CDK_DEFAULT_ACCOUNT!, //<-- process.env pulls value from CLI env,
      region: process.env.CDK_DEFAULT_REGION! //<-- ! after var, tells TS it won't be null.
  }
}

const stack: cdk.Stack = new cdk.Stack(app, 'example', stack_config);

//UX convienence similar to EKS Blueprints
const assumableEKSAdminAccessRole = new iam.Role(stack, 'assumableEKSAdminAccessRole', {
  assumedBy: new iam.AccountRootPrincipal(), //<-- root as is root of the account,
                                             // so assumable by any principle/identity in the account.
});

const cluster = new eks.Cluster(stack, 'eks', {
    clusterName: 'example',
    version: eks.KubernetesVersion.V1_32,
    kubectlLayer: new KubectlV32Layer(stack, 'kubectl'),
    authenticationMode: eks.AuthenticationMode.API_AND_CONFIG_MAP,
    mastersRole: assumableEKSAdminAccessRole, //<-- adds aws eks update-kubeconfig output
});

const ALBC_kube_SA = new eks.ServiceAccount(stack, 'aws-load-balancer-controller_kube-sa', {
  cluster: cluster,
  name: 'aws-load-balancer-controller',
  namespace: 'kube-system',
  identityType: eks.IdentityType.POD_IDENTITY, //depends on eks-pod-identity-agent addon
  //Note: It's not documented, but this generates 4 things:
  //1. A kube SA in the namespace of the cluster
  //2. An IAM role paired to the Kube SA
  //3. An EKS Pod Identity Association
  //4. The eks-pod-identity-agent addon (dependency)
});

const app2_kube_SA = new eks.ServiceAccount(stack, 'app2_kube-sa', {
  cluster: cluster,
  name: 'app2',
  namespace: 'default',
  identityType: eks.IdentityType.POD_IDENTITY,
  //^-- Just adding a 2nd to show that this has limited logic to detect if addon already exists
  //    If you have at least 1 of these typescript objects it triggers deploy of eks-pod-identity-agent
  //    but if you have more than 1 it's smart enough to not fail from trying to deploy it twice.
});

    ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
    // NOTICE: Don't add eks-pod-identity-agent
    // It's purposefully left out to work around CDK bug https://github.com/aws/aws-cdk/issues/32580
    // The cdk bug relates to an error where there's a complaint about it already being present, if 2 things try to install it.
    // The AWS Load Balancer Controller installation logic, will trigger the installation of eks-pod-identity-agent addon.
    // https://github.com/aws/aws-cdk/pull/33891
    // ^-- A WIP fix exists
    // Note the IaC will deploy default (which isn't latest)
    // but if you manually update in GUI it'll stay updated
    ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

/*To see official names of all eks add-ons:
aws eks describe-addon-versions  \
--kubernetes-version=1.31 \
--query 'sort_by(addons  &owner)[].{owner: owner, addonName: addonName}' \
--output table
*/

// v-- UNCOMMENT THIS to experience the bug (or test any WIP changes)
// const eks_pod_identity_agent_addon = new eks.CfnAddon(stack, 'eks-pod-identity-agent', {
//   clusterName: cluster.clusterName,
//   addonName: 'eks-pod-identity-agent',
//   addonVersion: 'v1.3.5-eksbuild.2', //v--query for latest
//   // aws eks describe-addon-versions --kubernetes-version=1.32 --addon-name=eks-pod-identity-agent --query='addons[].addonVersions[].addonVersion' | jq '.[0]'
//   resolveConflicts: 'OVERWRITE',
//   configurationValues: `{}`,
// });