---
- name: Helm | Add Jetstack chart repository
  ansible.builtin.command: helm repo add jetstack https://jetstack.io
  environment:
    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _helm_repo_add
  changed_when: false
  failed_when: _helm_repo_add.rc != 0 and 'already exists' not in _helm_repo_add.stderr

- name: Helm | Update chart repositories
  ansible.builtin.command: helm repo update
  environment:
    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  changed_when: false

- name: Helm | Install or upgrade cert-manager CRDs
  ansible.builtin.command: >
    kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/{{ cert_manager_crds_version }}/cert-manager.crds.yaml
  environment:
    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _cert_manager_crds
  changed_when: false
  failed_when: _cert_manager_crds.rc != 0

- name: Helm | Update repositories
  ansible.builtin.command: helm repo update
  environment:
    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  changed_when: false

- name: Helm | Install or upgrade cert-manager
  ansible.builtin.command: >
    helm upgrade --install cert-manager jetstack/cert-manager
    --namespace {{ cert_manager_namespace }}
    --create-namespace
    {% if cert_manager_chart_version is defined and cert_manager_chart_version | length > 0 %}
    --version {{ cert_manager_chart_version }}
    {% endif %}
    {% if cert_manager_args is defined and cert_manager_args | length > 0 %}
    --set args[0]={{ cert_manager_args[0] }}
    {% endif %}
    --timeout 10m0s
    --wait
  environment:
    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _helm_install
  changed_when: "'STATUS: deployed' in _helm_install.stdout or 'has been upgraded' in _helm_install.stdout"

- name: Deploy | Self-signed ClusterIssuer
  ansible.builtin.template:
    src: self-signed-issuer.yml.j2
    dest: /tmp/self-signed-issuer.yml
    mode: "0600"
  when: cert_manager_deploy_test_issuer | default(true)

- name: Apply | Self-signed ClusterIssuer
  ansible.builtin.command: >
    kubectl apply -f /tmp/self-signed-issuer.yml
  environment:
    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _issuer_apply
  changed_when: false
  failed_when: _issuer_apply.rc != 0
  when: cert_manager_deploy_test_issuer | default(true)

- name: Deploy | Test Certificate
  ansible.builtin.template:
    src: test-certificate.yml.j2
    dest: /tmp/test-certificate.yml
    mode: "0600"
  when: cert_manager_deploy_test_issuer | default(true)

- name: Apply | Test Certificate
  ansible.builtin.command: >
    kubectl apply -f /tmp/test-certificate.yml
  environment:
    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _certificate_apply
  changed_when: false
  failed_when: _certificate_apply.rc != 0
  when: cert_manager_deploy_test_issuer | default(true)

- name: Wait | Certificate ready
  ansible.builtin.command: >
    kubectl wait --for=condition=Ready certificate/test-certificate -n default --timeout=120s
  environment:
    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _cert_wait
  changed_when: false
  failed_when: _cert_wait.rc != 0
  when: cert_manager_deploy_test_issuer | default(true)