---
# Install Cilium as the CNI (ADR-0002). Runs from the controller (dev container,
# which has kubectl + helm) against a kubeconfig fetched from the primary node.
# The cluster is NotReady until this completes — expected (PHASE1-SCOPE risks).
# run_once: this whole role acts on the cluster once, not per host.

- name: Fetch the k3s kubeconfig from the primary
  ansible.builtin.slurp:
    src: /etc/rancher/k3s/k3s.yaml
  register: k3s_kubeconfig_raw
  delegate_to: "{{ groups['k3s_primary'][0] }}"
  run_once: true

- name: Ensure the local cache dir exists
  ansible.builtin.file:
    path: "{{ cilium_kubeconfig | dirname }}"
    state: directory
    mode: "0700"
  delegate_to: localhost
  become: false
  run_once: true

- name: Write kubeconfig locally (server rewritten to the primary IP)
  ansible.builtin.copy:
    content: >-
      {{ k3s_kubeconfig_raw.content | b64decode
         | regex_replace('https://127.0.0.1:6443',
                         'https://' ~ k3s_api_host ~ ':' ~ k3s_api_port) }}
    dest: "{{ cilium_kubeconfig }}"
    mode: "0600"
  delegate_to: localhost
  become: false
  run_once: true

- name: Install Gateway API CRDs (must precede Cilium gatewayAPI.enabled)
  ansible.builtin.command:
    cmd: "kubectl apply -f {{ item }}"
  environment:
    KUBECONFIG: "{{ cilium_kubeconfig }}"
  loop: "{{ gateway_api_crd_urls }}"
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: true

- name: Add the Cilium Helm repo
  ansible.builtin.command:
    cmd: "helm repo add {{ cilium_chart_repo_name }} {{ cilium_chart_repo_url }}"
  delegate_to: localhost
  become: false
  run_once: true
  register: cilium_repo_add
  changed_when: "'has been added' in cilium_repo_add.stdout"
  failed_when:
    - cilium_repo_add.rc != 0
    - "'already exists' not in cilium_repo_add.stderr"

- name: Update Helm repos
  ansible.builtin.command:
    cmd: "helm repo update {{ cilium_chart_repo_name }}"
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: false

- name: Render the Cilium values file (parity-critical settings from k3s_api_host)
  ansible.builtin.template:
    src: cilium-values.yaml.j2
    dest: "{{ cilium_values_path }}"
    mode: "0644"
  delegate_to: localhost
  become: false
  run_once: true

- name: Install/upgrade Cilium via Helm
  ansible.builtin.command:
    cmd: >-
      helm upgrade --install cilium {{ cilium_chart_repo_name }}/cilium
      --version {{ cilium_version }}
      --namespace {{ cilium_namespace }}
      --values {{ cilium_values_path }}
      --wait --timeout 10m
  environment:
    KUBECONFIG: "{{ cilium_kubeconfig }}"
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: true