prole/infrastructure/roles/k3s/tasks/fetch_kubeconfig.yml

---

- name: Build kubeconfig fetch candidates
  ansible.builtin.set_fact:
    k3s_kubeconfig_source_candidates: "{{ groups['k3s_hosts'] | default([inventory_hostname]) }}"

- name: Initialize kubeconfig source host
  ansible.builtin.set_fact:
    k3s_kubeconfig_source_host: ""

- name: Select k3s init server as kubeconfig source (preferred)
  ansible.builtin.set_fact:
    k3s_kubeconfig_source_host: "{{ item }}"
  loop: "{{ k3s_kubeconfig_source_candidates }}"
  when:
    - (k3s_kubeconfig_source_host | length) == 0
    - hostvars[item].k3s_role | default('agent') == 'server'
    - hostvars[item].k3s_cluster_init | default(false) | bool

- name: Fallback to first k3s server as kubeconfig source
  ansible.builtin.set_fact:
    k3s_kubeconfig_source_host: "{{ item }}"
  loop: "{{ k3s_kubeconfig_source_candidates }}"
  when:
    - (k3s_kubeconfig_source_host | length) == 0
    - hostvars[item].k3s_role | default('agent') == 'server'

- name: Final fallback to current host as kubeconfig source
  ansible.builtin.set_fact:
    k3s_kubeconfig_source_host: "{{ inventory_hostname }}"
  when: (k3s_kubeconfig_source_host | length) == 0

- name: Require kubeconfig source host
  ansible.builtin.assert:
    that:
      - (k3s_kubeconfig_source_host | length) > 0
    fail_msg: "Unable to select a k3s kubeconfig source host."

- name: Determine kubeconfig API server URL
  ansible.builtin.set_fact:
    k3s_kubeconfig_api_server: >-
      {{ (k3s_server_url | trim) if (k3s_server_url | default('') | trim | length) > 0
         else 'https://' ~ k3s_kubeconfig_source_host ~ ':6443' }}      

- name: Read k3s kubeconfig from source node
  ansible.builtin.slurp:
    src: /etc/rancher/k3s/k3s.yaml
  register: _k3s_kubeconfig_raw
  delegate_to: "{{ k3s_kubeconfig_source_host }}"
  become: true

- name: Rewrite kubeconfig server and context to primary endpoint
  ansible.builtin.set_fact:
    k3s_kubeconfig_rendered: >-
      {{ _k3s_kubeconfig_raw.content
         | b64decode
         | regex_replace('server:\s*https?://\S+', 'server: ' ~ k3s_kubeconfig_api_server)
         | regex_replace('name:\s*default', 'name: ' ~ (k3s_kubeconfig_context | default('prole-service-cluster')))
         | regex_replace('context:\s*default', 'context: ' ~ (k3s_kubeconfig_context | default('prole-service-cluster')))
         | regex_replace('user:\s*default', 'user: ' ~ (k3s_kubeconfig_context | default('prole-service-cluster')))
         | regex_replace('cluster:\s*default', 'cluster: ' ~ (k3s_kubeconfig_context | default('prole-service-cluster')))
         | regex_replace('current-context:\s*default', 'current-context: ' ~ (k3s_kubeconfig_context | default('prole-service-cluster'))) }}      

- name: Validate rendered kubeconfig YAML (controller-side scripts depend on this)
  ansible.builtin.set_fact:
    _k3s_kubeconfig_parsed: "{{ k3s_kubeconfig_rendered | from_yaml }}"
  changed_when: false

- name: Require kubeconfig to contain required keys
  ansible.builtin.assert:
    that:
      - _k3s_kubeconfig_parsed is mapping
      - (_k3s_kubeconfig_parsed.clusters | default([])) | length > 0
      - (_k3s_kubeconfig_parsed.contexts | default([])) | length > 0
      - (_k3s_kubeconfig_parsed.users | default([])) | length > 0
      - (_k3s_kubeconfig_parsed['current-context'] | default('') | length) > 0
    fail_msg: >-
      Rendered kubeconfig is invalid or missing required keys. Refusing to save
      kubeconfig to the controller.      

- name: Define controller kubeconfig destinations
  ansible.builtin.set_fact:
    k3s_kubeconfig_controller_project_path: "{{ playbook_dir }}/../../prole-k3s.kubeconfig"
    k3s_kubeconfig_controller_service_path: "{{ playbook_dir }}/../../etc/secrets/k3s.kubeconfig"
  changed_when: false

- name: Ensure controller kubeconfig directory exists (service path)
  ansible.builtin.file:
    path: "{{ k3s_kubeconfig_controller_service_path | dirname }}"
    state: directory
    mode: "0700"
  delegate_to: localhost
  become: false

- name: Save kubeconfig locally for controller-side init scripts (project root)
  ansible.builtin.copy:
    content: "{{ k3s_kubeconfig_rendered }}"
    dest: "{{ k3s_kubeconfig_controller_project_path }}"
    mode: "0600"
  delegate_to: localhost
  become: false

- name: Save kubeconfig locally for controller-side init scripts (etc/secrets)
  ansible.builtin.copy:
    content: "{{ k3s_kubeconfig_rendered }}"
    dest: "{{ k3s_kubeconfig_controller_service_path }}"
    mode: "0600"
  delegate_to: localhost
  become: false