---
- name: Dashboard | Check kubeconfig exists
  ansible.builtin.stat:
    path: "{{ kubeconfig_dir }}/config"
  register: _kubeconfig_dash

- name: Dashboard | Skip notice
  ansible.builtin.debug:
    msg: "Dashboard install skipped — kubeconfig not found at {{ kubeconfig_dir }}/config."
  when: not _kubeconfig_dash.stat.exists

- name: Dashboard | Deploy and configure
  when:
    - _kubeconfig_dash.stat.exists
    - dashboard_enabled | bool
  environment:
    KUBECONFIG: "{{ kubeconfig_dir }}/config"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  block:
    - name: Dashboard | Apply manifest
      ansible.builtin.command:
        cmd: kubectl apply -f {{ dashboard_manifest_url }}
      register: _dash_apply
      changed_when: "'configured' in _dash_apply.stdout or 'created' in _dash_apply.stdout"

    - name: Dashboard | Patch deployment for insecure HTTP access
      ansible.builtin.command: >
        kubectl patch deployment kubernetes-dashboard
        -n {{ dashboard_namespace }}
        --type strategic
        -p '{"spec":{"template":{"spec":{"containers":[{"name":"kubernetes-dashboard","args":["--namespace={{ dashboard_namespace }}","--enable-insecure-login","--insecure-port=9090","--port=0"],"ports":[{"containerPort":9090,"protocol":"TCP"}],"livenessProbe":{"httpGet":{"path":"/","port":9090,"scheme":"HTTP"}}}]}}}}'
      register: _dash_deploy_patch
      changed_when: "'patched' in _dash_deploy_patch.stdout"
      failed_when: _dash_deploy_patch.rc != 0 and 'unchanged' not in _dash_deploy_patch.stdout
      when: dashboard_insecure | bool
      check_mode: false

    - name: Dashboard | Patch service to ClusterIP
      ansible.builtin.command: >
        kubectl patch svc kubernetes-dashboard
        -n {{ dashboard_namespace }}
        -p '{"spec":{"type":"ClusterIP","ports":[{"port":443,"targetPort":{{ 9090 if dashboard_insecure | bool else 8443 }},"protocol":"TCP"}]}}'
      register: _dash_patch
      changed_when: "'patched' in _dash_patch.stdout"
      failed_when: _dash_patch.rc != 0 and 'not patched' not in _dash_patch.stdout
      check_mode: false

    - name: Dashboard | Apply admin ServiceAccount
      ansible.builtin.template:
        src: dashboard_admin.yml.j2
        dest: /tmp/dashboard_admin.yml
        mode: "0600"

    - name: Dashboard | Create admin user
      ansible.builtin.command:
        cmd: kubectl apply -f /tmp/dashboard_admin.yml
      register: _dash_admin
      changed_when: "'created' in _dash_admin.stdout"

    - name: Dashboard | Check if token file exists
      ansible.builtin.stat:
        path: "/home/{{ ansible_user }}/.kube/dashboard-token"
      register: _token_file

    - name: Dashboard | Generate long-lived token
      ansible.builtin.command:
        cmd: kubectl -n {{ dashboard_namespace }} create token admin-user --duration=8760h
      register: _dashboard_token
      changed_when: true
      when: not _token_file.stat.exists

    - name: Dashboard | Save token to file
      ansible.builtin.copy:
        content: "{{ _dashboard_token.stdout }}\n"
        dest: "/home/{{ ansible_user }}/.kube/dashboard-token"
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: "0600"
      when: not _token_file.stat.exists

    - name: Dashboard | Show access info
      ansible.builtin.debug:
        msg: |
          ============================================================
          Kubernetes Dashboard: accessible via Traefik proxy.
          {% if dashboard_insecure | bool %}
          Mode: HTTP (insecure) — TLS terminated by Traefik
          {% endif %}
          Token saved to: ~/.kube/dashboard-token
          View token: cat ~/.kube/dashboard-token
          ============================================================