- name: Set up Cert-Manager
  hosts: init
  gather_facts: false
  become: true
  vars:
    cert_manager_ns: cert-manager
    cert_manager_crds:
      - certificates.cert-manager.io
      - issuers.cert-manager.io
    cert_manager_deployments:
      - cert-manager
      - cert-manager-cainjector
      - cert-manager-webhook
  tasks:
    - name: Apply Cert-Manager YAML
      kubernetes.core.k8s:
        state: present
        src: "/tmp/k8s/scylla/01-cert-manager.yml"
        kubeconfig: /etc/rancher/k3s/k3s.yaml

    - name: Wait for Cert-Manager CRDs
      ansible.builtin.shell: |
        kubectl wait --for condition=established --timeout=60s crd/{{ cert_manager_crds | join(' crd/') }}
      environment:
        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
      changed_when: false

    - name: Wait for Cert-Manager deployments
      ansible.builtin.shell: |
        kubectl -n {{ cert_manager_ns }} rollout status --timeout=10m deployment.apps/{{ item }}
      loop: "{{ cert_manager_deployments }}"
      loop_control:
        loop_var: item
      environment:
        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
      changed_when: false

    - name: Wait for Cert-Manager webhook CA secret
      ansible.builtin.shell: |
        for i in {1..30}; do
          kubectl -n {{ cert_manager_ns }} get secret/cert-manager-webhook-ca && break
          sleep 1
        done
      environment:
        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
      changed_when: false