# SPDX-License-Identifier: MIT-0
---
- name: Validate role configuration
  ansible.builtin.import_tasks: validate.yml

- name: Create application namespace
  kubernetes.core.k8s:
    kubeconfig: "{{ wikideck_kubeconfig | default(omit, true) }}"
    context: "{{ wikideck_kube_context | default(omit, true) }}"
    state: present
    apply: true
    definition:
      apiVersion: v1
      kind: Namespace
      metadata:
        name: "{{ wikideck_namespace }}"
  when: wikideck_create_namespace | bool

- name: Create persistent chain storage
  kubernetes.core.k8s:
    kubeconfig: "{{ wikideck_kubeconfig | default(omit, true) }}"
    context: "{{ wikideck_kube_context | default(omit, true) }}"
    state: present
    apply: true
    definition: "{{ lookup('ansible.builtin.template', 'pvc.yml.j2') | from_yaml }}"
    # WaitForFirstConsumer claims cannot bind until the pod is scheduled.
    wait: false
  when: wikideck_existing_claim | length == 0

- name: Create workload identity and internal service
  kubernetes.core.k8s:
    kubeconfig: "{{ wikideck_kubeconfig | default(omit, true) }}"
    context: "{{ wikideck_kube_context | default(omit, true) }}"
    state: present
    apply: true
    definition: "{{ lookup('ansible.builtin.template', item) | from_yaml }}"
  loop:
    - serviceaccount.yml.j2
    - service.yml.j2

- name: Configure network isolation before starting the application
  kubernetes.core.k8s:
    kubeconfig: "{{ wikideck_kubeconfig | default(omit, true) }}"
    context: "{{ wikideck_kube_context | default(omit, true) }}"
    state: "{{ 'present' if wikideck_network_policy_enabled else 'absent' }}"
    definition: "{{ lookup('ansible.builtin.template', 'networkpolicy.yml.j2') | from_yaml }}"

- name: Deploy the single-writer application
  kubernetes.core.k8s:
    kubeconfig: "{{ wikideck_kubeconfig | default(omit, true) }}"
    context: "{{ wikideck_kube_context | default(omit, true) }}"
    state: present
    apply: true
    definition: "{{ lookup('ansible.builtin.template', 'deployment.yml.j2') | from_yaml }}"
    wait: "{{ wikideck_wait | bool }}"
    wait_timeout: "{{ wikideck_wait_timeout | int }}"

- name: Configure optional TLS ingress
  kubernetes.core.k8s:
    kubeconfig: "{{ wikideck_kubeconfig | default(omit, true) }}"
    context: "{{ wikideck_kube_context | default(omit, true) }}"
    state: present
    apply: true
    definition: "{{ lookup('ansible.builtin.template', 'ingress.yml.j2') | from_yaml }}"
  when: wikideck_ingress_enabled | bool

- name: Remove role ingress when disabled
  kubernetes.core.k8s:
    kubeconfig: "{{ wikideck_kubeconfig | default(omit, true) }}"
    context: "{{ wikideck_kube_context | default(omit, true) }}"
    state: absent
    api_version: networking.k8s.io/v1
    kind: Ingress
    namespace: "{{ wikideck_namespace }}"
    name: "{{ wikideck_name }}"
  when: not wikideck_ingress_enabled | bool