resource "devzero_node_policy" "minimal" {
  name            = "minimal-policy"
  node_pool_name  = "default-pool"
  node_class_name = "default-class"
}

resource "devzero_node_policy" "aws" {
  name            = "aws-production"
  description     = "Production-ready AWS node policy"
  node_pool_name  = "production-pool"
  node_class_name = "production-class"
  weight          = 15

  instance_categories = {
    match_expressions = [{
      key      = "instanceCategories"
      operator = "In"
      values   = ["c", "m", "r"]
    }]
  }

  instance_generations = {
    match_expressions = [{
      key      = "instanceGenerations"
      operator = "Gt"
      values   = ["5"]
    }]
  }

  architectures = {
    match_expressions = [{
      key      = "architectures"
      operator = "In"
      values   = ["amd64"]
    }]
  }

  capacity_types = {
    match_expressions = [{
      key      = "capacityTypes"
      operator = "In"
      values   = ["spot", "on-demand"]
    }]
  }

  operating_systems = {
    match_expressions = [{
      key      = "operatingSystems"
      operator = "In"
      values   = ["linux"]
    }]
  }

  labels = {
    "workload-type" = "general"
    "managed-by"    = "karpenter"
  }

  limits = {
    cpu    = "1000"
    memory = "1000Gi"
  }

  disruption = {
    consolidation_policy = "WhenEmptyOrUnderutilized"
    consolidate_after    = "15m"
    expire_after         = "720h"

    budgets = [
      {
        reasons = ["Underutilized", "Empty"]
        nodes   = "10%"
      }
    ]
  }

  aws = {
    role             = "KarpenterNodeRole-production"
    instance_profile = "KarpenterNodeInstanceProfile-production"
    ami_family       = "AL2023"

    ami_selector_terms = [
      { alias = "al2023@latest" }
    ]

    subnet_selector_terms = [
      {
        tags = {
          "karpenter.sh/discovery" = "production-cluster"
        }
      }
    ]

    security_group_selector_terms = [
      {
        tags = {
          "karpenter.sh/discovery" = "production-cluster"
        }
      }
    ]

    block_device_mappings = [
      {
        device_name = "/dev/xvda"
        ebs = {
          volume_size           = "100Gi"
          volume_type           = "gp3"
          encrypted             = true
          delete_on_termination = true
        }
      }
    ]

    metadata_options = {
      http_endpoint               = "enabled"
      http_protocol_ipv6          = "disabled"
      http_put_response_hop_limit = 2
      http_tokens                 = "required"
    }

    tags = {
      "Environment" = "production"
      "ManagedBy"   = "Karpenter"
    }
  }
}

resource "devzero_node_policy" "azure" {
  name            = "azure-production"
  node_pool_name  = "production-pool"
  node_class_name = "production-class"

  capacity_types = {
    match_expressions = [{
      key      = "capacityTypes"
      operator = "In"
      values   = ["spot", "on-demand"]
    }]
  }

  disruption = {
    consolidate_after    = "5m"
    consolidation_policy = "WhenEmptyOrUnderutilized"
    expire_after         = "168h"
  }

  azure = {
    vnet_subnet_id  = "/subscriptions/xxx/resourceGroups/yyy/providers/Microsoft.Network/virtualNetworks/zzz/subnets/aaa"
    os_disk_size_gb = 128
    image_family    = "Ubuntu2204"
    fips_mode       = "Disabled"
    max_pods        = 110
  }
}

terraform import devzero_node_policy.example <node_policy_id>

resource "devzero_node_policy_target" "cluster_nodes" {
  name        = "cluster-nodes"
  description = "Apply standard node policy to production clusters"
  policy_id   = devzero_node_policy.aws.id
  cluster_ids = [devzero_cluster.production.id]
  enabled     = true
}

terraform import devzero_node_policy_target.example <node_policy_target_id>