---
# FINAL play of the bring-up: hand off to Flux + SOPS (Phase 1 T-1.4, docs/02
# "hands off to Flux"; ADR-0004, ADR-0007). This role does NOT author bootstrap/
# — it calls the entrypoints the Security + GitOps Engineers author there.
#
# Order matters: install the age decryption key FIRST (so Flux can decrypt on its
# very first reconcile), THEN run `flux bootstrap` at clusters/dev.
#
# The two commands are variables (see defaults/main.yml). If the bootstrap workers
# expose different entrypoints, override flux_bootstrap_sops_cmd / _flux_cmd — the
# task graph does not change.

- name: Assert the bootstrap/ subtree exists (authored by the other worker)
  ansible.builtin.stat:
    path: "{{ flux_bootstrap_repo_root }}/bootstrap"
  register: bootstrap_dir
  delegate_to: localhost
  become: false
  run_once: true
  failed_when: not bootstrap_dir.stat.exists

- name: Install the SOPS age key as a cluster Secret (bootstrap/sops)
  ansible.builtin.command:
    cmd: "{{ flux_bootstrap_sops_cmd }}"
  environment:
    KUBECONFIG: "{{ flux_bootstrap_kubeconfig }}"
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: true

- name: Bootstrap Flux against clusters/dev (bootstrap/flux)
  ansible.builtin.command:
    cmd: "{{ flux_bootstrap_flux_cmd }}"
  environment:
    KUBECONFIG: "{{ flux_bootstrap_kubeconfig }}"
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: true

- name: Wait for Flux to report the platform Kustomization Ready
  ansible.builtin.command:
    cmd: >-
      kubectl -n flux-system wait kustomization/platform
      --for=condition=Ready --timeout=600s
  environment:
    KUBECONFIG: "{{ flux_bootstrap_kubeconfig }}"
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: false