---
- name: Ensure cert-manager CRDs exist for ACME
  ansible.builtin.command: k3s kubectl get crd certificates.cert-manager.io
  register: k3s_acme_crd
  changed_when: false
  failed_when: k3s_acme_crd.rc != 0
  run_once: true

- name: Check for flannel DaemonSet (k3s default CNI)
  ansible.builtin.command: k3s kubectl -n kube-system get daemonset kube-flannel-ds
  register: _k3s_flannel_ds
  changed_when: false
  failed_when: false
  run_once: true

- name: Wait for flannel DaemonSet rollout (ensures pod network is routable)
  ansible.builtin.command: k3s kubectl -n kube-system rollout status daemonset/kube-flannel-ds --timeout=300s
  register: _k3s_flannel_rollout
  changed_when: false
  retries: 6
  delay: 10
  until: _k3s_flannel_rollout.rc == 0
  when: _k3s_flannel_ds.rc == 0
  run_once: true

- name: Check for kube-proxy DaemonSet
  ansible.builtin.command: k3s kubectl -n kube-system get daemonset kube-proxy
  register: _k3s_kube_proxy_ds
  changed_when: false
  failed_when: false
  run_once: true

- name: Wait for kube-proxy DaemonSet rollout
  ansible.builtin.command: k3s kubectl -n kube-system rollout status daemonset/kube-proxy --timeout=300s
  register: _k3s_kube_proxy_rollout
  changed_when: false
  retries: 6
  delay: 10
  until: _k3s_kube_proxy_rollout.rc == 0
  when: _k3s_kube_proxy_ds.rc == 0
  run_once: true

- name: Wait for cert-manager-webhook deployment (required for validating ClusterIssuer/Certificate)
  ansible.builtin.command: k3s kubectl -n cert-manager rollout status deployment/cert-manager-webhook --timeout=900s
  register: k3s_certmgr_webhook_rollout
  changed_when: false
  retries: 3
  delay: 20
  until: k3s_certmgr_webhook_rollout.rc == 0
  run_once: true

- name: Wait for cert-manager-webhook service endpoints
  ansible.builtin.command: >-
    k3s kubectl -n cert-manager get endpoints cert-manager-webhook
    -o jsonpath='{.subsets[*].addresses[*].ip}'
  register: k3s_certmgr_webhook_endpoints
  changed_when: false
  retries: 90
  delay: 10
  until:
    - k3s_certmgr_webhook_endpoints.rc == 0
    - (k3s_certmgr_webhook_endpoints.stdout | trim) | length > 0
  run_once: true

- name: Set ACME contact email (defaults to admin@prole.org)
  ansible.builtin.set_fact:
    svc_check_acme_email: "{{ letsencrypt_email | default('admin@prole.org') }}"
  run_once: true

- name: Ensure namespace exists for ACME certificate secret
  ansible.builtin.shell: |
    k3s kubectl apply -f - <<'EOF'
    apiVersion: v1
    kind: Namespace
    metadata:
      name: {{ k3s_svc_check_kong_namespace }}
    EOF
  args:
    executable: /bin/bash
  run_once: true

- name: Configure ACME ClusterIssuer and Certificate for service hostname
  ansible.builtin.shell: |
    k3s kubectl apply -f - <<'EOF'
    apiVersion: cert-manager.io/v1
    kind: ClusterIssuer
    metadata:
      name: {{ k3s_service_cluster_issuer }}
    spec:
      acme:
        email: {{ svc_check_acme_email }}
        server: https://acme-v02.api.letsencrypt.org/directory
        privateKeySecretRef:
          name: {{ k3s_service_cluster_issuer }}
        solvers:
          - http01:
              ingress:
                class: traefik
    ---
    apiVersion: cert-manager.io/v1
    kind: Certificate
    metadata:
      name: {{ k3s_service_cert_name }}
      namespace: {{ k3s_svc_check_kong_namespace }}
    spec:
      secretName: {{ k3s_service_tls_secret_name }}
      issuerRef:
        name: {{ k3s_service_cluster_issuer }}
        kind: ClusterIssuer
      dnsNames:
        - {{ k3s_service_hostname }}
    EOF
  args:
    executable: /bin/bash
  register: k3s_acme_apply
  retries: 90
  delay: 10
  until: k3s_acme_apply.rc == 0
  run_once: true