---
# Verify the cluster reached the Phase-1 exit gate #1: 3 nodes Ready, Cilium
# healthy (Hubble up), no flannel/kube-proxy. Runs from the controller once.

- name: Wait for all nodes to be Ready (Cilium must be up first)
  ansible.builtin.command:
    cmd: >-
      kubectl wait --for=condition=Ready nodes --all
      --timeout={{ cluster_verify_node_ready_timeout }}
  environment:
    KUBECONFIG: "{{ cluster_verify_kubeconfig }}"
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: false

- name: Wait for the Cilium DaemonSet to roll out
  ansible.builtin.command:
    cmd: >-
      kubectl -n kube-system rollout status ds/cilium --timeout=300s
  environment:
    KUBECONFIG: "{{ cluster_verify_kubeconfig }}"
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: false

- name: Wait for hubble-relay to be available
  ansible.builtin.command:
    cmd: >-
      kubectl -n kube-system rollout status deploy/hubble-relay --timeout=300s
  environment:
    KUBECONFIG: "{{ cluster_verify_kubeconfig }}"
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: false

- name: Confirm kube-proxy is absent (Cilium replaces it)
  ansible.builtin.command:
    cmd: "kubectl -n kube-system get ds kube-proxy"
  environment:
    KUBECONFIG: "{{ cluster_verify_kubeconfig }}"
  delegate_to: localhost
  become: false
  run_once: true
  register: kube_proxy_check
  changed_when: false
  failed_when: kube_proxy_check.rc == 0

- name: Summarise cluster state
  ansible.builtin.command:
    cmd: "kubectl get nodes -o wide"
  environment:
    KUBECONFIG: "{{ cluster_verify_kubeconfig }}"
  delegate_to: localhost
  become: false
  run_once: true
  register: cluster_nodes
  changed_when: false

- name: Show nodes
  ansible.builtin.debug:
    var: cluster_nodes.stdout_lines
  run_once: true