# Render the cluster's admin kubeconfig into the working dir. AKS produces
# two kubeconfigs:
#
#   - `kube_admin_config_raw` — local-account auth with embedded certs.
#     Works out of the box without `kubelogin` or `az` exec plugins.
#   - `kube_config_raw` — Azure AD auth via `kubelogin`. Requires the
#     AAD-RBAC block on the cluster and `kubelogin` on the user's PATH.
#
# MVP uses the admin kubeconfig. Production should flip
# `local_account_disabled = true` on the cluster and switch to
# `kube_config_raw` plus a `kubelogin` install.

resource "local_sensitive_file" "kubeconfig" {
  filename             = "${path.cwd}/kubeconfig"
  content              = azurerm_kubernetes_cluster.main.kube_admin_config_raw
  file_permission      = "0600"
  directory_permission = "0700"
}