import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import { Cluster } from "@pulumi/eks";

export const createProdEksArgocdIamRole = (cluster: Cluster) => {
  const role = new aws.iam.Role("argocd", {
    name: "argocd",
    assumeRolePolicy: pulumi
      .all([cluster.core.oidcProvider?.url, cluster.core.oidcProvider?.arn])
      .apply(([url, arn]) => {
        return JSON.stringify({
          Version: "2012-10-17",
          Statement: [
            {
              Effect: "Allow",
              Principal: {
                Federated: arn,
              },
              Action: "sts:AssumeRoleWithWebIdentity",
              Condition: {
                StringLike: {
                  [`${url}:sub`]: ["system:serviceaccount:argocd:*"],
                  [`${url}:aud`]: "sts.amazonaws.com",
                },
              },
            },
          ],
        });
      }),
  });

  const policy = new aws.iam.Policy("argocd-policy", {
    policy: {
      Version: "2012-10-17",
      Statement: [
        {
          Action: ["sts:AssumeRole"],
          Effect: "Allow",
          Resource: "*",
        },
      ],
    },
  });

  new aws.iam.RolePolicyAttachment("argocd-policy-attachment", {
    policyArn: policy.arn,
    role: role.name,
  });

  return { role, policy };
};