---
- name: Check for cert-manager CRD
  ansible.builtin.command: k3s kubectl get crd certificates.cert-manager.io
  register: k3s_certmgr_crd
  changed_when: false
  failed_when: false
  run_once: true

- name: Install cert-manager (CRDs + controller)
  ansible.builtin.command: >-
    k3s kubectl apply -f
    https://github.com/cert-manager/cert-manager/releases/download/{{ k3s_cert_manager_version }}/cert-manager.yaml
  when: k3s_certmgr_crd.rc != 0
  run_once: true

- name: Wait for cert-manager deployment
  ansible.builtin.command: k3s kubectl -n cert-manager rollout status deployment/cert-manager --timeout=180s
  when: k3s_certmgr_crd.rc != 0
  run_once: true

- name: Wait for cert-manager-cainjector deployment
  ansible.builtin.command: k3s kubectl -n cert-manager rollout status deployment/cert-manager-cainjector --timeout=180s
  when: k3s_certmgr_crd.rc != 0
  run_once: true

- name: Wait for cert-manager-webhook deployment
  ansible.builtin.command: k3s kubectl -n cert-manager rollout status deployment/cert-manager-webhook --timeout=180s
  when: k3s_certmgr_crd.rc != 0
  run_once: true