// =============================================================================
// Terraform Variables Example
// =============================================================================
// Copy to terraform.tfvars and customize:  cp terraform.tfvars.example terraform.tfvars
// Full variable reference: variables.tf
// =============================================================================

// Core Configuration (REQUIRED)
environment     = "dev"
location        = "westus3"
resource_prefix = "yourprefix"
instance        = "001"

// Resource Group
should_create_resource_group = true

// AKS System Node Pool
system_node_pool_vm_size    = "Standard_D8ds_v5"
system_node_pool_node_count = 1

// GPU Node Pools
//
// gpu_driver options:
//   "Install" - AKS installs the NVIDIA datacenter driver on the node
//   "None"    - No AKS-managed driver; use GPU Operator or custom installation
//
// node_labels: Kubernetes labels applied to nodes at provisioning time.
//   Set nvidia.com/gpu.deploy.driver=false on vGPU nodes (RTX PRO 6000) to
//   skip GPU Operator driver management. The GRID driver DaemonSet in
//   infrastructure/setup/manifests/gpu-grid-driver-installer.yaml handles these nodes.

// Single GPU pool (Spot A10 — simplest configuration)
node_pools = {
  gpu = {
    vm_size                 = "Standard_NV36ads_A10_v5"
    subnet_address_prefixes = ["10.0.7.0/24"]
    node_taints             = ["nvidia.com/gpu:NoSchedule", "kubernetes.azure.com/scalesetpriority=spot:NoSchedule"]
    gpu_driver              = "Install"
    node_labels = {
      "kubernetes.azure.com/scalesetpriority" = "spot"
    }
    priority                   = "Spot"
    should_enable_auto_scaling = true
    min_count                  = 1
    max_count               = 1
    zones                   = []
    eviction_policy         = "Delete"
  }
}

// Multi-GPU pool example (RTX PRO 6000 + H100):
//
// node_pools = {
//   rtxprogpu = {
//     vm_size                 = "Standard_NC128ds_xl_RTXPRO6000BSE_v6"
//     subnet_address_prefixes = ["10.0.7.0/24"]
//     node_taints             = ["nvidia.com/gpu:NoSchedule"]
//     gpu_driver              = "None"
//     node_labels = {
//       "nvidia.com/gpu.deploy.driver" = "false"
//     }
//     priority                   = "Regular"
//     should_enable_auto_scaling = true
//     min_count                  = 1
//     max_count           = 1
//     zones               = []
//   }
//   h100gpu = {
//     vm_size                 = "Standard_NC40ads_H100_v5"
//     subnet_address_prefixes = ["10.0.8.0/24"]
//     node_taints = [
//       "nvidia.com/gpu:NoSchedule",
//       "kubernetes.azure.com/scalesetpriority=spot:NoSchedule"
//     ]
//     gpu_driver = "None"
//     node_labels = {
//       "kubernetes.azure.com/scalesetpriority" = "spot"
//     }
//     priority            = "Spot"
//     eviction_policy            = "Delete"
//     should_enable_auto_scaling = true
//     min_count                  = 1
//     max_count           = 1
//     zones               = []
//   }
// }

// NAT Gateway Availability Zones
// Set to ["1"] in AZ-supported regions (e.g. westus3, eastus2)
// Leave empty for regions without AZ support (e.g. westus)
// NOTE: Changing zones on an existing deployment forces replacement of both the NAT Gateway
// and its Public IP. To preserve existing zonal behavior, set nat_gateway_zones to your current
// zone (e.g. ["1"]) explicitly before applying. Run `terraform plan` to confirm no unintended
// NAT/Public IP recreation.
nat_gateway_zones = ["1"]

// OSMO Backend Services
should_deploy_postgresql = true
should_deploy_redis      = true

// Network Security
// Three modes available (see README.md for details):
//   Full Private (default): Both true - VPN required for all access
//   Hybrid:                 private_endpoint=true, private_aks_cluster=false - No VPN for kubectl
//   Full Public:            Both false - Not recommended without additional security
should_enable_private_endpoint    = true
should_enable_private_aks_cluster = true

// Public network access: Controls public access to Azure ML, Storage, Key Vault, ACR,
// Redis, PostgreSQL, and observability resources. When true, also creates a PostgreSQL
// firewall rule to allow Azure services (required for AKS-to-PostgreSQL connectivity
// without private endpoints).
should_enable_public_network_access     = true
should_add_current_user_key_vault_admin = true
should_enable_microsoft_defender        = true

// Storage Lifecycle Management
// Configure automatic deletion and tiering policies for blob storage

// Data Lake Storage (ADLS Gen2): Optional dedicated storage account with hierarchical namespace
// for domain data (datasets, model checkpoints). When enabled, lifecycle policies move to the data lake account.
// should_create_data_lake_storage = false

// Raw ROS bags: Auto-delete after 30 days (configurable)
should_enable_raw_bags_lifecycle_policy = true
raw_bags_retention_days                 = 30  # Set to -1 to disable auto-delete

// Converted datasets: Tier to cool storage after 90 days
should_enable_converted_datasets_lifecycle_policy = true
converted_datasets_cool_tier_days                 = 90  # Set to -1 to disable tiering

// Validation reports: Tier to cool (30 days), then archive (180 days)
should_enable_reports_lifecycle_policy = true
reports_cool_tier_days                 = 30
reports_archive_tier_days              = 180

// Model checkpoints: No lifecycle policy (retained indefinitely in Hot tier)

// Observability
// All observability components deploy by default. Disable individually to reduce cost.
// should_deploy_grafana            = true
// grafana_major_version            = "12"
// should_deploy_monitor_workspace  = true
// should_deploy_ampls              = true
// should_deploy_dce                = true
// should_enable_aml_diagnostic_logs = false

// AzureML workspace managed network isolation is independent from private endpoints.
// Valid values: Disabled, AllowInternetOutbound, AllowOnlyApprovedOutbound.
aml_managed_network_isolation_mode = "AllowOnlyApprovedOutbound"

// AzureML Managed Compute
// Empty map deploys no AzureML managed compute clusters.
// Keys are Azure ML compute cluster names.
aml_compute_clusters = {}
// aml_compute_clusters = {
//   "nc4as-T4-v3-lowprio" = {
//     vm_size                   = "Standard_NC4as_T4_v3"
//     vm_priority               = "LowPriority"
//     min_node_count            = 0
//     max_node_count            = 1
//     scale_down_after_idle     = "PT5M"
//     node_public_ip_enabled    = false
//     ssh_public_access_enabled = false
//     identity_type             = "UserAssigned"
//     // location               = "eastus"
//   }
// }

// DNS Zones
// should_include_aks_dns_zone = true

// VM Subnet
// If you plan to add a Virtual Machine with Isaac Sim we need to enable the creating of the subnet
// should_create_vm_subnet = true