resource "google_compute_network" "main" {
  name                    = "${local.name_prefix}-vpc"
  auto_create_subnetworks = false
  routing_mode            = "REGIONAL"
}

# One regional subnet with secondary IP ranges for pods + services — this
# is the VPC-native ("alias-IP") setup GKE Autopilot requires. Public IPs
# never get assigned to pods; egress goes through Cloud NAT below.
resource "google_compute_subnetwork" "main" {
  name          = "${local.name_prefix}-subnet"
  network       = google_compute_network.main.id
  region        = var.region
  ip_cidr_range = var.vpc_cidr

  private_ip_google_access = true

  secondary_ip_range {
    range_name    = "pods"
    ip_cidr_range = var.pods_cidr
  }
  secondary_ip_range {
    range_name    = "services"
    ip_cidr_range = var.services_cidr
  }
}

resource "google_compute_router" "main" {
  name    = "${local.name_prefix}-router"
  network = google_compute_network.main.id
  region  = var.region
}

# Autopilot nodes have no external IPs by default — they need NAT to pull
# container images, reach external APIs, etc.
resource "google_compute_router_nat" "main" {
  name                               = "${local.name_prefix}-nat"
  router                             = google_compute_router.main.name
  region                             = var.region
  nat_ip_allocate_option             = "AUTO_ONLY"
  source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"

  log_config {
    enable = true
    filter = "ERRORS_ONLY"
  }
}