variable "aws_region" {
  description = "AWS region for the EKS cluster"
  type        = string
}

variable "cluster_name" {
  description = "Name of the EKS cluster"
  type        = string
}

variable "cluster_version" {
  description = "Kubernetes version for EKS cluster"
  type        = string
  default     = "1.35"
}

variable "vpc_id" {
  description = "VPC ID where EKS cluster will be deployed"
  type        = string
}

variable "subnet_ids" {
  description = "List of subnet IDs for EKS cluster"
  type        = list(string)
}

variable "enable_irsa" {
  description = "Enable IAM Roles for Service Accounts"
  type        = bool
  default     = true
}

variable "cluster_endpoint_private_access" {
  description = "Enable private API server endpoint"
  type        = bool
  default     = true
}

variable "cluster_endpoint_public_access" {
  description = "Enable public API server endpoint"
  type        = bool
  default     = true
}

variable "cluster_endpoint_public_access_cidrs" {
  # EKS public API endpoint is IPv4-only — even on IPv6-only clusters the
  # control-plane public endpoint cannot serve IPv6 clients. Adding ::/0 is
  # meaningless and rejected by EKS. IPv4-only CIDRs only.
  description = "List of IPv4 CIDR blocks that can access the public API server endpoint (EKS public endpoint is IPv4-only)"
  type        = list(string)
  default     = ["0.0.0.0/0"]
}

variable "base_node_count" {
  description = "Fixed number of base infrastructure nodes"
  type        = number
  default     = 5
}

variable "coredns_replicas" {
  description = "Number of CoreDNS replicas (pinned; autoscaling disabled). Per-cluster via clusters.yaml."
  type        = number
  default     = 6

  validation {
    condition     = var.coredns_replicas >= 2
    error_message = "coredns_replicas must be >= 2 (single-replica CoreDNS deadlocks the PDB; zero replicas means no DNS)."
  }
}

variable "base_node_instance_type" {
  description = "Instance type for base infrastructure nodes"
  type        = string
  default     = "m5.xlarge"
}

variable "base_node_max_unavailable_percentage" {
  description = "Maximum percentage of base nodes to update simultaneously (100 = all at once, no drainage)"
  type        = number
  default     = 100
}

variable "base_node_ami_version" {
  description = "EKS-optimized AMI version suffix (e.g. 'v20260318'). Use 'v*' for latest (not recommended). Must update when changing eks_version."
  type        = string
  default     = "v*"

  validation {
    condition     = can(regex("^v([0-9]{8}|\\*)$", var.base_node_ami_version))
    error_message = "base_node_ami_version must be 'v*' or 'vYYYYMMDD' (e.g. 'v20260318')"
  }
}

variable "enable_secrets_encryption" {
  description = "Enable KMS envelope encryption for Kubernetes secrets at rest"
  type        = bool
  default     = true
}

variable "authentication_mode" {
  description = "EKS cluster authentication mode (API, API_AND_CONFIG_MAP, or CONFIG_MAP)"
  type        = string
  default     = "CONFIG_MAP"
}

variable "bootstrap_cluster_creator_admin_permissions" {
  description = "Whether to grant cluster creator admin permissions (immutable after creation)"
  type        = bool
  default     = true
}

variable "cluster_admin_role_names" {
  description = "Comma-separated IAM role names to grant EKS cluster admin access via access entries (requires API or API_AND_CONFIG_MAP authentication mode)"
  type        = string
  default     = ""
}

variable "tags" {
  description = "Tags to apply to all resources"
  type        = map(string)
  default     = {}
}
