---

- name: Skip k3s configuration when disabled
  ansible.builtin.meta: end_host
  when: not (k3s_enabled | default(true) | bool)

- name: Skip k3s configuration when state is absent
  ansible.builtin.meta: end_host
  when: k3s_state == "absent"

- name: Set k3s service name
  ansible.builtin.set_fact:
    k3s_service_name: "{{ 'k3s' if k3s_role == 'server' else 'k3s-agent' }}"

- name: Load service namespace from prole.cfg (controller)
  ansible.builtin.set_fact:
    k3s_prole_service_namespace_cfg: "{{ lookup('ansible.builtin.ini', 'SERVICE_NAMESPACE section=Global file=' + playbook_dir + '/../../conf/prole.cfg', default='') }}"
  changed_when: false

- name: Resolve Kong namespaces from prole.cfg (avoid implicit default namespace)
  ansible.builtin.set_fact:
    _k3s_service_namespace_resolved: >-
      {{ (k3s_prole_service_namespace_cfg | default(''))
         if (k3s_prole_service_namespace_cfg | default('') | length > 0 and k3s_prole_service_namespace_cfg != '${SERVICE_NAMESPACE}')
         else 'default' }}
  changed_when: false

- name: Normalize Kong namespace variables
  ansible.builtin.set_fact:
    k3s_kong_namespace: >-
      {{ (k3s_kong_namespace | default(''))
         if (k3s_kong_namespace | default('') | length > 0 and k3s_kong_namespace != '${SERVICE_NAMESPACE}')
         else _k3s_service_namespace_resolved }}
  changed_when: false

- name: Normalize svc-check Kong namespace variable
  ansible.builtin.set_fact:
    k3s_svc_check_kong_namespace: >-
      {{ (k3s_svc_check_kong_namespace | default(''))
         if (k3s_svc_check_kong_namespace | default('') | length > 0 and k3s_svc_check_kong_namespace != '${SERVICE_NAMESPACE}')
         else k3s_kong_namespace }}
  changed_when: false

- name: Validate resolved Kong namespace variables
  ansible.builtin.assert:
    that:
      - k3s_kong_namespace | length > 0
      - k3s_svc_check_kong_namespace | length > 0
    fail_msg: >-
      Resolved Kong namespace variables are empty. Ensure `SERVICE_NAMESPACE` is set in `conf/prole.cfg`
      or explicitly set `k3s_kong_namespace` / `k3s_svc_check_kong_namespace` in Ansible inventory.

- name: Pre-stage critical images (registry:2, kong, etc.)
  ansible.builtin.include_tasks: prestage_images.yml
  when:
    - k3s_state == "present"
    - k3s_prestage_images | bool
  tags: [images]

- name: Create monitoring directory on pi.prole.org
  ansible.builtin.file:
    path: /var/lib/rancher/monitoring
    state: directory
    mode: "0777"
  when:
    - k3s_state == "present"
    - inventory_hostname == 'pi.prole.org'

- name: Create ArgoCD hostPath directories on myrddin.prole.org
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    mode: "0777"
  loop:
    - /prole/d001/argocd
    - /prole/d001/argocd/home
    - /prole/d001/argocd/tmp
    - /prole/d002/argocd
    - /prole/d002/argocd/data
    - /prole/d002/argocd/tmp
    - /prole/d003/argocd
    - /prole/d003/argocd/gpg-keyring
    - /prole/d003/argocd/tmp
    - /prole/d003/argocd/helm-working-dir
    - /prole/d003/argocd/var-files
    - /prole/d003/argocd/plugins
  when:
    - k3s_state == "present"
    - inventory_hostname == 'myrddin.prole.org'

- name: Apply pi-local-iscsi StorageClass
  ansible.builtin.shell: |
    k3s kubectl apply -f - <<'EOF'
    apiVersion: storage.k8s.io/v1
    kind: StorageClass
    metadata:
      name: pi-local-iscsi
    provisioner: rancher.io/local-path
    volumeBindingMode: WaitForFirstConsumer
    reclaimPolicy: Retain
    parameters:
      nodePathMap: |
        [
          {
            "node": "pi.prole.org",
            "paths": ["/var/lib/rancher/monitoring"]
          }
        ]
    EOF
  register: _pi_local_iscsi_apply
  changed_when: "'configured' in _pi_local_iscsi_apply.stdout or 'created' in _pi_local_iscsi_apply.stdout"
  when:
    - k3s_state == "present"
    - k3s_role == 'server'
  run_once: true

- name: Fetch kubeconfig to controller for controller-side installs
  ansible.builtin.include_tasks: fetch_kubeconfig.yml
  when:
    - k3s_state == "present"
    - k3s_role == 'server'
  run_once: true

- name: Ensure CloudNative-PG operator and kubectl plugin
  ansible.builtin.include_tasks: cnpg.yml
  when: k3s_state == "present"

- name: Ensure cert-manager is installed for ACME
  ansible.builtin.include_tasks: certmgr.yml
  when:
    - k3s_state == "present"
    - k3s_role == 'server'

- name: Configure ACME issuer and certificate for svc.prole.org
  ansible.builtin.include_tasks: acme_cert.yml
  when:
    - k3s_state == "present"
    - k3s_role == 'server'

- name: Ensure Kong is present and refreshed
  ansible.builtin.include_tasks: kong.yml
  when:
    - k3s_state == "present"
    - k3s_role == 'server'

- name: Deploy svc.prole.org check site through Kong
  ansible.builtin.include_tasks: svc_check.yml
  when:
    - k3s_state == "present"
    - k3s_role == 'server'

- name: Reload Kong declarative config (only when changed)
  ansible.builtin.include_tasks: kong_restart.yml
  when:
    - k3s_state == "present"
    - k3s_role == 'server'