# This scenario (cluster linked to its encryption protection resource by an
# unresolved "${tencentcloud_kubernetes_cluster.<name>.id}" reference) has no
# pre-apply plan-JSON equivalent test: on a create plan both resource.id and
# encryption_protection.cluster_id are absent from planned_values.values
# entirely - they only appear in resource_changes[].change.after_unknown,
# which this repo's plan-JSON parser never reads. There is no way to link
# the two resources in that shape, so the rule can't tell "linked but
# unresolved" apart from "not linked at all" and correctly stays silent
# either way, matching how a real pre-apply scan of this HCL would behave.
# The equivalent post-apply (no-op) fixture, where both ids are resolved and
# comparable, lives at test/negative2.json and covers the plan-JSON case
# instead. See test/known_gap_unresolved_reference_pre_apply.json for the
# now-excluded fixture that used to (incorrectly) exercise this file's HCL
# shape as if it were a directly testable plan-JSON scenario.
data "tencentcloud_vpc_subnets" "vpc" {
  is_default        = true
  availability_zone = "ap-guangzhou-3"
}

resource "tencentcloud_kubernetes_cluster" "has_encryption_protection" {
  vpc_id                  = data.tencentcloud_vpc_subnets.vpc.instance_list.0.vpc_id
  cluster_cidr            = "10.32.0.0/16"
  cluster_max_pod_num     = 32
  cluster_name            = "tf_example_cluster"
  cluster_desc            = "a tf example cluster for the kms test"
  cluster_max_service_num = 32
  cluster_deploy_type     = "MANAGED_CLUSTER"
}


resource "tencentcloud_kms_key" "example" {
  alias       = "tf-example-kms-key"
  description = "example of kms key instance"
  key_usage   = "ENCRYPT_DECRYPT"
  is_enabled  = true
}

resource "tencentcloud_kubernetes_encryption_protection" "example" {
  cluster_id = tencentcloud_kubernetes_cluster.has_encryption_protection.id
  kms_configuration {
    key_id     = tencentcloud_kms_key.example.id
    kms_region = "ap-guangzhou"
  }
}

data "tencentcloud_vpc_subnets" "vpc" {
  is_default        = true
  availability_zone = "ap-guangzhou-3"
}

resource "tencentcloud_kubernetes_cluster" "none_encryption_protection" {
  vpc_id                  = data.tencentcloud_vpc_subnets.vpc.instance_list.0.vpc_id
  cluster_cidr            = "10.32.0.0/16"
  cluster_max_pod_num     = 32
  cluster_name            = "tf_example_cluster"
  cluster_desc            = "a tf example cluster for the kms test"
  cluster_max_service_num = 32
  cluster_deploy_type     = "MANAGED_CLUSTER"
}