module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "20.36.0"

  cluster_name    = var.eks_cluster_name
  cluster_version = "1.32"

  cluster_addons = {
    coredns = {
      most_recent = true
    }

    kube-proxy = {
      most_recent = true
    }

    vpc-cni = {
      most_recent = true
    }

    aws-ebs-csi-driver = {
      most_recent = true
    }
  }

  vpc_id     = var.vpc_id
  subnet_ids = var.private_subnets

  create_cni_ipv6_iam_policy = false
  cluster_ip_family          = "ipv4"

  cluster_enabled_log_types              = ["audit", "api", "authenticator", "controllerManager", "scheduler"]
  create_cloudwatch_log_group            = true
  cloudwatch_log_group_retention_in_days = 365

  create_node_security_group = true
  cluster_security_group_additional_rules = {
    tailscale = {
      cidr_blocks = [var.vpc_cidr_block]
      description = "Allow all traffic from private VPC"
      from_port   = 443
      to_port     = 443
      protocol    = "all"
      type        = "ingress"
    }
  }

  cluster_endpoint_private_access = true

  enable_cluster_creator_admin_permissions = true

  access_entries = local.access_entries

  eks_managed_node_groups = {

    (var.eks_cluster_name) = {
      min_size     = 1
      max_size     = 1
      desired_size = 1

      use_name_prefix = true
      instance_types  = [var.instance_type]

      update_config = {
        max_unavailable = 1
      }

      pre_bootstrap_user_data = <<-EOT
      #!/bin/bash
      set -ex
      curl -fsSL https://tailscale.com/install.sh | sh
      tailscale up --accept-dns=false --authkey='${data.aws_secretsmanager_secret_version.tailscale_oauth_eks.secret_string}?ephemeral=true&preauthorized=true'
      tailscale set --ssh
      EOT

      ebs_optimized = true

      block_device_mappings = {
        xvda = {
          device_name = "/dev/xvda"
          ebs = {
            volume_size           = 100
            volume_type           = "gp3"
            delete_on_termination = true
          }
        }
      }
    }
  }
}