output "cluster_endpoint" {
  description = "EKS cluster API server endpoint"
  value       = module.eks.cluster_endpoint
}

output "cluster_certificate_authority_data" {
  description = "Base64-encoded certificate authority data for the cluster"
  value       = module.eks.cluster_certificate_authority_data
  sensitive   = true
}

output "cluster_name" {
  description = "EKS cluster name"
  value       = module.eks.cluster_name
}

output "cluster_oidc_issuer_url" {
  description = "OIDC issuer URL for the EKS cluster (used for IRSA)"
  value       = module.eks.cluster_oidc_issuer_url
}

output "node_group_arns" {
  description = "ARNs of the managed node groups"
  value = {
    az_a = module.eks.eks_managed_node_groups["veylant-az-a"].node_group_arn
    az_b = module.eks.eks_managed_node_groups["veylant-az-b"].node_group_arn
    az_c = module.eks.eks_managed_node_groups["veylant-az-c"].node_group_arn
  }
}

output "vpc_id" {
  description = "VPC ID"
  value       = module.vpc.vpc_id
}

output "private_subnet_ids" {
  description = "Private subnet IDs (one per AZ)"
  value       = module.vpc.private_subnets
}

output "backup_bucket_name" {
  description = "S3 backup bucket name"
  value       = aws_s3_bucket.backups.id
}

output "backup_role_arn" {
  description = "IAM role ARN for the backup service account (IRSA)"
  value       = module.irsa_backup.iam_role_arn
}

output "kubeconfig_command" {
  description = "AWS CLI command to update kubeconfig"
  value       = "aws eks update-kubeconfig --region ${var.aws_region} --name ${module.eks.cluster_name}"
}