- name: Set up Cert-Manager
  hosts: dev
  become: true
  vars:
    cert_manager_ns: cert-manager
    cert_manager_yaml_src: "{{ playbook_dir }}/../../k8s/scylla/01-cert-manager.yml"
    cert_manager_yaml_dest: /tmp/01-cert-manager.yml
    cert_manager_crds:
      - certificates.cert-manager.io
      - issuers.cert-manager.io
    cert_manager_deployments:
      - cert-manager
      - cert-manager-cainjector
      - cert-manager-webhook
  tasks:
    - name: Copy Cert-Manager YAML to node
      ansible.builtin.copy:
        src: "{{ cert_manager_yaml_src }}"
        dest: "{{ cert_manager_yaml_dest }}"
        mode: '0644'

    - name: Apply Cert-Manager YAML
      kubernetes.core.k8s:
        state: present
        src: "{{ cert_manager_yaml_dest }}"
        kubeconfig: /etc/rancher/k3s/k3s.yaml

    - name: Wait for Cert-Manager CRDs
      ansible.builtin.shell: |
        kubectl wait --for condition=established --timeout=60s crd/{{ cert_manager_crds | join(' crd/') }}
      environment:
        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
      changed_when: false

    - name: Wait for Cert-Manager deployments
      ansible.builtin.shell: |
        kubectl -n {{ cert_manager_ns }} rollout status --timeout=10m deployment.apps/{{ item }}
      loop: "{{ cert_manager_deployments }}"
      loop_control:
        loop_var: item
      environment:
        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
      changed_when: false

    - name: Wait for Cert-Manager webhook CA secret
      ansible.builtin.shell: |
        for i in {1..30}; do
          kubectl -n {{ cert_manager_ns }} get secret/cert-manager-webhook-ca && break
          sleep 1
        done
      environment:
        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
      changed_when: false