---
# FINAL play of the bring-up: hand off to Flux + SOPS (Phase 1 T-1.4, docs/02
# "hands off to Flux"; ADR-0004, ADR-0007). This role does NOT author bootstrap/
# — it calls the entrypoints the Security + GitOps Engineers author there.
#
# Order matters: install the age decryption key FIRST (so Flux can decrypt on its
# very first reconcile), THEN bootstrap Flux at the environment's overlay.
#
# The two commands are variables (see defaults/main.yml). If the bootstrap workers
# expose different entrypoints, override flux_bootstrap_sops_cmd / _flux_cmd — the
# task graph does not change.
#
# ENVIRONMENT-AGNOSTIC (R-ENV-02): this role names NO environment. Which overlay gets
# bootstrapped comes from `flux_bootstrap_env_path` (defaults/main.yml, default
# clusters/dev), exported below as FLUX_ENV_PATH — the variable bootstrap/flux/
# bootstrap.sh already reads. Prod overrides it in group_vars/k3s_prod/vars.yml, the
# same seam as kube_vip_address / k3s_data_dir / cluster_kubeconfig_name.

- name: Assert the bootstrap/ subtree exists (authored by the other worker)
  ansible.builtin.stat:
    path: "{{ flux_bootstrap_repo_root }}/bootstrap"
  register: bootstrap_dir
  delegate_to: localhost
  become: false
  run_once: true
  failed_when: not bootstrap_dir.stat.exists

- name: Install the SOPS age key as a cluster Secret (bootstrap/sops)
  ansible.builtin.command:
    cmd: "{{ flux_bootstrap_sops_cmd }}"
  environment:
    KUBECONFIG: "{{ flux_bootstrap_kubeconfig }}"
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: true

- name: Bootstrap Flux against this environment's overlay (bootstrap/flux)
  ansible.builtin.command:
    cmd: "{{ flux_bootstrap_flux_cmd }}"
  environment:
    KUBECONFIG: "{{ flux_bootstrap_kubeconfig }}"
    # The ONLY per-environment input. clusters/dev by default (dev unchanged);
    # clusters/prod for [k3s_prod] hosts via group_vars.
    FLUX_ENV_PATH: "{{ flux_bootstrap_env_path }}"
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: true

- name: Wait for Flux to report the platform Kustomization Ready
  ansible.builtin.command:
    cmd: >-
      kubectl -n flux-system wait kustomization/platform
      --for=condition=Ready --timeout=600s
  environment:
    KUBECONFIG: "{{ flux_bootstrap_kubeconfig }}"
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: false