variable "project_id" {
  type        = string
  description = "GCP project id the cluster lives in. Must already exist; create with `gcloud projects create` if needed."
}

variable "region" {
  type        = string
  description = "GCP region for the GKE Autopilot cluster. Autopilot is regional only — multi-zone HA is automatic."
  default     = "us-central1"
}

variable "environment" {
  type        = string
  description = "Environment name (staging, prod, etc.). Goes into resource labels + names."
  default     = "staging"
}

variable "project" {
  type        = string
  description = "Project label (analog of AWS `Project` tag). Distinct from `project_id` — this is a human-readable category."
  default     = "aries-datalake"
}

variable "cluster_name" {
  type        = string
  description = "GKE cluster name. Defaults to `${var.project}-${var.environment}`."
  default     = ""
}

variable "release_channel" {
  type        = string
  description = "GKE release channel: RAPID / REGULAR / STABLE. REGULAR is the recommended default."
  default     = "REGULAR"
  validation {
    condition     = contains(["RAPID", "REGULAR", "STABLE"], var.release_channel)
    error_message = "release_channel must be one of RAPID, REGULAR, STABLE."
  }
}

variable "vpc_cidr" {
  type        = string
  description = "Primary subnet CIDR for the cluster's nodes. Must not overlap any existing VPC you intend to peer with — or compute-aws (10.42.0.0/16) and cluster-aws (10.43.0.0/16) if both stacks live in the same VPN/Interconnect topology."
  default     = "10.44.0.0/16"
}

variable "pods_cidr" {
  type        = string
  description = "Secondary range for pod IPs (Autopilot needs a /14 or so to scale freely)."
  default     = "10.48.0.0/14"
}

variable "services_cidr" {
  type        = string
  description = "Secondary range for Kubernetes Services."
  default     = "10.52.0.0/20"
}

variable "master_authorized_networks" {
  type = list(object({
    cidr_block   = string
    display_name = string
  }))
  description = "CIDRs allowed to reach the public GKE control plane. Defaults to anywhere; tighten to your office IP for prod."
  default = [
    { cidr_block = "0.0.0.0/0", display_name = "anywhere" },
  ]
}

variable "tfstate_passphrase" {
  type        = string
  description = "Passphrase for OpenTofu state encryption. See encryption.tofu.example."
  default     = ""
  sensitive   = true
}

locals {
  cluster_name = length(var.cluster_name) > 0 ? var.cluster_name : "${var.project}-${var.environment}"
  name_prefix  = "${var.project}-${var.environment}-cluster"

  common_labels = {
    project     = var.project
    environment = var.environment
    component   = "cluster"
    managed-by  = "opentofu"
  }
}