---
- name: Validate Luanti configuration before contacting Kubernetes
  ansible.builtin.import_tasks: validate.yml

- name: Render Luanti resources before contacting Kubernetes
  ansible.builtin.import_tasks: render.yml

- name: Create Luanti namespace
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: v1
      kind: Namespace
      metadata:
        name: "{{ luanti_wasm_namespace }}"

# Apply isolation before creating any pods. Enforcement requires a capable CNI.
- name: Apply mandatory Luanti network policy and configuration
  kubernetes.core.k8s:
    state: present
    definition: "{{ _luanti_wasm_manifests[item] }}"
  loop:
    - networkpolicy
    - configmap

- name: Deploy Luanti web and proxy sidecar
  kubernetes.core.k8s:
    state: present
    definition: "{{ _luanti_wasm_manifests.deployment }}"
    wait: "{{ luanti_wasm_wait }}"
    wait_timeout: "{{ luanti_wasm_wait_timeout }}"

- name: Create Luanti private web service
  kubernetes.core.k8s:
    state: present
    definition: "{{ _luanti_wasm_manifests.service }}"

- name: Reconcile optional Luanti TLS ingress
  kubernetes.core.k8s:
    state: "{{ 'present' if luanti_wasm_ingress_enabled else 'absent' }}"
    definition: "{{ _luanti_wasm_manifests.ingress }}"