vpc.tf

#Store eks name for avoid clicle error
locals {
  # Defina o nome do cluster como uma variável local estática
  cluster_name_static = "eks-git-cicd"
}


# Data to fetch Availability Zones (AZs)
data "aws_availability_zones" "available" {
  state = "available"
}

# EKS VPC Creation
resource "aws_vpc" "eks_vpc" {
  cidr_block             = "192.190.0.0/16" # New IP range, separate from your previous VPC
  enable_dns_support     = true
  enable_dns_hostnames = true
  tags = {
    Name = "EKS-VPC"
    # Essential tag for EKS and Load Balancers to function
    "kubernetes.io/cluster/${local.cluster_name_static}" = "owned"
  }
}

# Create Public Subnets for Load Balancers and access (in 2 different AZs)
resource "aws_subnet" "public_subnets" {
  count              = 2
  vpc_id             = aws_vpc.eks_vpc.id
  cidr_block         = cidrsubnet(aws_vpc.eks_vpc.cidr_block, 8, count.index)
  # map_public_ip_on_launch is mandatory for EKS/ALB public subnets
  map_public_ip_on_launch = true 
  availability_zone = data.aws_availability_zones.available.names[count.index]
  tags = {
    Name = "EKS-Public-Subnet-${count.index + 1}"
    # Tag required for the EKS Cluster
    "kubernetes.io/cluster/${local.cluster_name_static}" = "owned"
    # Tag required for the AWS Load Balancer Controller
    "kubernetes.io/role/elb" = 1 
  }
}

# Create Private Subnets for Worker Nodes (in 2 different AZs)
resource "aws_subnet" "private_subnets" {
  count              = 2
  vpc_id             = aws_vpc.eks_vpc.id
  # Subnet blocks that start after the public ones (indices 2 and 3)
  cidr_block         = cidrsubnet(aws_vpc.eks_vpc.cidr_block, 8, count.index + 2)
  availability_zone = data.aws_availability_zones.available.names[count.index]
  tags = {
    Name = "EKS-Private-Subnet-${count.index + 1}"
    "kubernetes.io/cluster/${local.cluster_name_static}" = "owned"
    # Tag required for the Worker Node Group
    "kubernetes.io/role/internal-elb" = 1 
  }
}



# ----------------------------------------------------
# 🛡️  SECURITY GROUPS 
# ----------------------------------------------------

# SG 1: Security Group do Control Plane EKS (Para Comunicação Interna)
resource "aws_security_group" "eks_cluster_sg" {
  name        = "${local.cluster_name_static}-cluster-sg"
  description = "Security Group for EKS Control Plane"
  vpc_id      = aws_vpc.eks_vpc.id

  # Regras de saída (Outbound): Permite toda a saída
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "${local.cluster_name_static}-cluster-sg"
    # Tag necessária para o EKS saber qual SG usar
    "kubernetes.io/cluster/${local.cluster_name_static}" = "owned"
  }
}

# SG 2: Security Group dos Worker Nodes
resource "aws_security_group" "eks_node_sg" {
  name        = "${local.cluster_name_static}-node-sg"
  description = "Security Group for EKS Worker Nodes"
  vpc_id      = aws_vpc.eks_vpc.id

  # Regras de entrada (Inbound)

  # 1. Comunicação interna entre Nodes (CNI e NodePorts)
  ingress {
    from_port = 0
    to_port   = 0
    protocol  = "-1"
    self      = true # Permite comunicação entre instâncias neste mesmo SG
  }

  # 2. Comunicação do Control Plane para os Nodes (necessária)
  ingress {
    from_port       = 10250 # Kubelet/Node communication
    to_port         = 65535 # Range comum para CNI
    protocol        = "tcp"
    security_groups = [aws_security_group.eks_cluster_sg.id]
    description     = "Allow Control Plane to Node communication"
  }
  
  # 3. TRÁFEGO DO LOAD BALANCER PARA OS NODES (HTTP - Porta 80)
  # Esta é a regra CRÍTICA que estava faltando para o seu Load Balancer
  ingress {
    from_port   = 80 # Porta da aplicação (Service targetPort)
    to_port     = 80
    protocol    = "tcp"
    # Permite acesso de QUALQUER IP na VPC (incluindo o LB),
    # ou de qualquer Load Balancer criado na VPC.
    cidr_blocks = [aws_vpc.eks_vpc.cidr_block] 
    description = "Allow HTTP access from within the VPC (e.g., Load Balancer)"
  }

  # Regras de saída (Outbound) - Permite toda a saída
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "${local.cluster_name_static}-node-sg"
  }
}

### END OF SECURITY GROUP

# Internet Gateway for public access (Load Balancers)
resource "aws_internet_gateway" "eks_gw" {
  vpc_id = aws_vpc.eks_vpc.id
  tags = {
    Name = "gitcicd-GW"
  }
}
# 1. Allocate an Elastic IP (EIP) for the NAT Gateway
resource "aws_eip" "nat_gateway_eip" {
  depends_on = [aws_internet_gateway.eks_gw] # Depends on the IGW
}

# 2. Create the NAT Gateway (in a Public Subnet)
resource "aws_nat_gateway" "eks_nat_gateway" {
  allocation_id = aws_eip.nat_gateway_eip.id
  # The NAT Gateway must be placed in ONE of the public subnets
  subnet_id       = aws_subnet.public_subnets[0].id 
  depends_on      = [aws_internet_gateway.eks_gw]

  tags = {
    Name = "EKS-NAT-GW"
  }
}

# 3. Create the Route Table for the Private Subnets
resource "aws_route_table" "private_route_table" {
  vpc_id = aws_vpc.eks_vpc.id
  tags = {
    Name = "EKS-Private-Route-Table"
  }
}

# 4. Add the outbound route (0.0.0.0/0) through the NAT Gateway
resource "aws_route" "private_internet_route" {
  route_table_id         = aws_route_table.private_route_table.id
  destination_cidr_block = "0.0.0.0/0"
  nat_gateway_id         = aws_nat_gateway.eks_nat_gateway.id
}

# 5. Associate the Route Table with the Private Subnets
# Association 1
resource "aws_route_table_association" "private_subnet_association_0" {
  subnet_id      = aws_subnet.private_subnets[0].id
  route_table_id = aws_route_table.private_route_table.id
}
# Association 2
resource "aws_route_table_association" "private_subnet_association_1" {
  subnet_id      = aws_subnet.private_subnets[1].id
  route_table_id = aws_route_table.private_route_table.id
}

# 6. Ensure Public Subnets use the IGW for the Internet
resource "aws_route_table" "public_route_table" {
  vpc_id = aws_vpc.eks_vpc.id
  tags = {
    Name = "EKS-Public-Route-Table"
  }
}


resource "aws_route" "public_internet_route" {
  route_table_id         = aws_route_table.public_route_table.id
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = aws_internet_gateway.eks_gw.id
}
resource "aws_route_table_association" "public_subnet_association_0" {
  subnet_id      = aws_subnet.public_subnets[0].id
  route_table_id = aws_route_table.public_route_table.id
}
resource "aws_route_table_association" "public_subnet_association_1" {
  subnet_id      = aws_subnet.public_subnets[1].id
  route_table_id = aws_route_table.public_route_table.id
}