variable "kubeconfig_path" {
  type        = string
  description = "Kubeconfig used by the Kubernetes provider for Atlas day-zero/declarative resources."
  default     = "~/.kube/config"
}

variable "kubeconfig_context" {
  type        = string
  description = "Optional kubeconfig context. Leave null to use the kubeconfig current-context."
  default     = null
}

variable "default_ssh_user" {
  type        = string
  description = "Default SSH user emitted into the generated Ananke inventory fragment."
  default     = "atlas"
}

variable "default_ssh_port" {
  type        = number
  description = "Default SSH port emitted into the generated Ananke inventory fragment."
  default     = 2277
}

variable "default_ssh_config_file" {
  type        = string
  description = "Default SSH config file emitted into the generated Ananke inventory fragment."
  default     = "/home/atlas/.ssh/config"
}

variable "default_ssh_identity_file" {
  type        = string
  description = "Default SSH identity file emitted into the generated Ananke inventory fragment."
  default     = "/home/atlas/.ssh/id_ed25519"
}

variable "ananke_inventory_fragment_path" {
  type        = string
  description = "Where Terraform writes the generated non-secret Ananke inventory fragment."
  default     = "generated/ananke.inventory.yaml"
}

variable "node_label_field_manager" {
  type        = string
  description = "Kubernetes server-side apply field manager for Terraform-owned node labels."
  default     = "terraform-atlas-node-labels"
}

variable "force_node_label_conflicts" {
  type        = bool
  description = "Set true only during a deliberate node-label adoption if Kubernetes field ownership conflicts."
  default     = false
}

variable "nodes" {
  type = map(object({
    ip                 = string
    role               = string
    managed            = optional(bool, true)
    ignore_unavailable = optional(bool, false)
    ssh_user           = optional(string)
    ssh_port           = optional(number)
    ssh_config_file    = optional(string)
    ssh_identity_file  = optional(string)
    labels             = optional(map(string), {})
  }))
  description = "Atlas host and Kubernetes node inventory. role is control-plane, worker, or recovery."

  validation {
    condition = alltrue([
      for node in values(var.nodes) : contains(["control-plane", "worker", "recovery"], node.role)
    ])
    error_message = "Each node role must be one of: control-plane, worker, recovery."
  }
}

variable "render_flux_day_zero_manifests" {
  type        = bool
  description = "Render day-zero Flux manifests from the existing clusters/atlas/flux-system artifacts."
  default     = false
}

variable "apply_flux_day_zero_manifests" {
  type        = bool
  description = "Dangerous: apply rendered day-zero Flux manifests with kubectl. Keep false for steady state."
  default     = false
}

variable "flux_day_zero_output_path" {
  type        = string
  description = "Rendered Flux day-zero manifest path when render_flux_day_zero_manifests is true."
  default     = "generated/flux-day-zero.yaml"
}