variable "gcp_project_id" {
  type        = string
  description = "The GCP Project ID where the Service Account should be created. If empty, a new project named 'velero-backup-xxxx' will be created."
  default     = ""
}

resource "random_id" "project_suffix" {
  byte_length = 4
}

resource "google_project" "backup_project" {
  count      = var.gcp_project_id == "" ? 1 : 0
  name       = "velero-backup"
  project_id = "velero-backup-${random_id.project_suffix.hex}"
}

locals {
  project_id = var.gcp_project_id == "" ? google_project.backup_project[0].project_id : var.gcp_project_id
}

resource "google_project_service" "drive_api" {
  project            = local.project_id
  service            = "drive.googleapis.com"
  disable_on_destroy = false
}

resource "google_project_organization_policy" "allow_key_creation" {
  project    = local.project_id
  constraint = "iam.disableServiceAccountKeyCreation"

  boolean_policy {
    enforced = false
  }
}

resource "google_service_account" "velero_backup_sa" {
  project      = local.project_id
  account_id   = "velero-backup-sa"
  display_name = "Velero GDrive Backup Service Account"
  depends_on   = [google_project_service.drive_api]
}

resource "google_service_account_key" "velero_backup_sa_key" {
  service_account_id = google_service_account.velero_backup_sa.name
  depends_on         = [google_project_organization_policy.allow_key_creation]
}

resource "local_file" "gdrive_sa_key_file" {
  content  = base64decode(google_service_account_key.velero_backup_sa_key.private_key)
  filename = "${path.module}/../k8s/velero/gdrive_sa.json.secret"
}

output "velero_backup_sa_email" {
  value       = google_service_account.velero_backup_sa.email
  description = "The email address of the Google Cloud Service Account. Share your Google Drive backup folder with this email address and grant it Editor access."
}