locals = {
  apic_certificates = [
    for v in lookup(local.pod, "apic_certificates") : {
      activate_certificate = v.activate_certificate
      modulus              = v.modulus
      name                 = v.name
      trustpoint           = v.trustpoint
      var_identity         = v.var_identity
    }
  ]
}
/*_____________________________________________________________________________________________________________________

API Information:
 - Class: "pkiTP"
 - Distinguished Name: "uni/userext/pkiext/keyring-{{name}}"
GUI Location:
 - Fabric > Fabric Policies > Policies > Pod > Management Access: default
_______________________________________________________________________________________________________________________
*/
resource "aci_rest_managed" "apic_trustpoint" {
  for_each   = { for v in local.apic_certificates : v.trustpoint => v if length(regexall("[1-2]", v.var_identifier)) > 0 }
  class_name = "pkiTP"
  dn         = "uni/userext/pkiext/tp-${each.key}"
  content = {
    certChain = length(regexall("1", each.value.var_identity)
      ) > 0 ? "${var.apic_intermediate_plus_root_ca_1}" : length(
      regexall("2", each.value.var_identity)
    ) > 0 ? "${var.apic_intermediate_plus_root_ca_2}" : ""
    descr = ""
    name  = each.key
  }
}

resource "aci_rest_managed" "apic_keyring" {
  for_each   = { for v in local.apic_certificates : v.name => v if length(regexall("[1-2]", v.var_identifier)) > 0 }
  class_name = "pkiKeyRing"
  dn         = "uni/userext/pkiext/keyring-${each.key}"
  content = {
    adminState = "completed"
    cert = length(regexall("1", each.value.var_identity)
      ) > 0 ? "${var.apic_certificate_1}" : length(
      regexall("2", each.value.var_identity)
    ) > 0 ? "${var.apic_certificate_2}" : ""
    descr = ""
    key = length(regexall("1", each.value.var_identity)
      ) > 0 ? "${var.apic_private_key_1}" : length(
      regexall("2", each.value.var_identity)
    ) > 0 ? "${var.apic_private_key_2}" : ""
    modulus = "mod${each.value.modulus}"
    name    = each.key
    regen   = "no"
    tp      = each.value.trustpoint
  }
}

resource "aci_rest_managed" "apic_oper_keyring" {
  for_each   = { for v in local.apic_certificates : v.name => v if v.activate_certificate == true }
  class_name = "commRsKeyRing"
  dn         = "uni/fabric/comm-default/https/rsKeyRing"
  content = {
    tnPkiKeyRingName = each.key
  }
}