---
- name: Check for cert-manager CRD
  ansible.builtin.command: k3s kubectl get crd certificates.cert-manager.io
  register: k3s_certmgr_crd
  changed_when: false
  failed_when: false
  run_once: true

- name: Apply cert-manager (CRDs + controller)
  ansible.builtin.command: >-
    k3s kubectl apply -f
    https://github.com/cert-manager/cert-manager/releases/download/{{ k3s_cert_manager_version }}/cert-manager.yaml
  run_once: true

- name: Wait for cert-manager deployment to have a ready replica
  ansible.builtin.command: >-
    k3s kubectl -n cert-manager get deployment cert-manager
    -o jsonpath='{.status.readyReplicas}'
  register: _k3s_certmgr_ready
  changed_when: false
  retries: 90
  delay: 10
  until: (_k3s_certmgr_ready.stdout | default('0') | int) >= 1
  run_once: true

- name: Wait for cert-manager-cainjector deployment to have a ready replica
  ansible.builtin.command: >-
    k3s kubectl -n cert-manager get deployment cert-manager-cainjector
    -o jsonpath='{.status.readyReplicas}'
  register: _k3s_certmgr_cainjector_ready
  changed_when: false
  retries: 90
  delay: 10
  until: (_k3s_certmgr_cainjector_ready.stdout | default('0') | int) >= 1
  run_once: true

- name: Wait for cert-manager-webhook deployment to have a ready replica
  ansible.builtin.command: >-
    k3s kubectl -n cert-manager get deployment cert-manager-webhook
    -o jsonpath='{.status.readyReplicas}'
  register: _k3s_certmgr_webhook_ready
  changed_when: false
  retries: 90
  delay: 10
  until: (_k3s_certmgr_webhook_ready.stdout | default('0') | int) >= 1
  run_once: true