output "cluster_name" {
  description = "EKS cluster name."
  value       = aws_eks_cluster.main.name
}

output "cluster_arn" {
  description = "EKS cluster ARN."
  value       = aws_eks_cluster.main.arn
}

output "cluster_endpoint" {
  description = "EKS API server endpoint."
  value       = aws_eks_cluster.main.endpoint
}

output "cluster_certificate_authority_data" {
  description = "Base64-encoded cluster CA cert (for clients that don't use the rendered kubeconfig)."
  value       = aws_eks_cluster.main.certificate_authority[0].data
  sensitive   = true
}

output "oidc_provider_arn" {
  description = "IAM OIDC provider ARN; bind workload IAM roles to this via IRSA."
  value       = aws_iam_openid_connect_provider.cluster.arn
}

output "oidc_provider_url" {
  description = "OIDC issuer URL (without the leading `https://`) for IRSA trust policies."
  value       = replace(aws_eks_cluster.main.identity[0].oidc[0].issuer, "https://", "")
}

output "ebs_csi_role_arn" {
  description = "IRSA role ARN for the EBS CSI driver addon. Pass to `aws eks create-addon --service-account-role-arn` so PVCs can attach EBS volumes."
  value       = aws_iam_role.ebs_csi.arn
}

output "vpc_id" {
  description = "Dedicated VPC the cluster runs in."
  value       = aws_vpc.main.id
}

output "private_subnet_ids" {
  description = "Subnets the managed node group runs in."
  value       = [for s in aws_subnet.private : s.id]
}

output "public_subnet_ids" {
  description = "Public subnets (host NAT and external LBs)."
  value       = [for s in aws_subnet.public : s.id]
}

output "node_security_group_id" {
  description = "Primary security group EKS attached to worker nodes."
  value       = aws_eks_cluster.main.vpc_config[0].cluster_security_group_id
}

output "kubeconfig_path" {
  description = "Path to the rendered kubeconfig (relative to the working dir)."
  value       = local_sensitive_file.kubeconfig.filename
}

output "region" {
  description = "AWS region the cluster lives in."
  value       = var.region
}

# The Tier-3 service plane reads this to construct its `ServiceTarget(kubernetes)`.
output "service_target" {
  description = "Tier-2 → Tier-3 hand-off shape. The CLI projects this into ~/.aries/cluster/<name>/cluster.yaml."
  value = {
    kind          = "kubernetes"
    cloud         = "aws"
    cluster_name  = aws_eks_cluster.main.name
    region        = var.region
    namespace     = "aries-datalake"
    ingress_class = "nginx"
    storage_class = "gp3"
    kubeconfig    = local_sensitive_file.kubeconfig.filename
  }
}