---
- name: DevAccess | Render RBAC manifests
  ansible.builtin.template:
    src: "{{ item.src }}"
    dest: "/tmp/{{ item.dest }}"
    mode: "0600"
  loop:
    - { src: dev-serviceaccount.yml.j2, dest: dev-sa.yml }
    - { src: dev-role.yml.j2, dest: dev-role.yml }
    - { src: dev-rolebinding.yml.j2, dest: dev-rolebinding.yml }
    - { src: dev-clusterrole.yml.j2, dest: dev-clusterrole.yml }
    - { src: dev-clusterrolebinding.yml.j2, dest: dev-clusterrolebinding.yml }

- name: DevAccess | Apply ServiceAccount
  ansible.builtin.command:
    cmd: kubectl apply -f /tmp/dev-sa.yml
  environment:
    KUBECONFIG: "{{ dev_access_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _dev_sa
  changed_when: "'created' in _dev_sa.stdout or 'configured' in _dev_sa.stdout"

- name: DevAccess | Apply Role
  ansible.builtin.command:
    cmd: kubectl apply -f /tmp/dev-role.yml
  environment:
    KUBECONFIG: "{{ dev_access_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _dev_role
  changed_when: "'created' in _dev_role.stdout or 'configured' in _dev_role.stdout"

- name: DevAccess | Apply RoleBinding
  ansible.builtin.command:
    cmd: kubectl apply -f /tmp/dev-rolebinding.yml
  environment:
    KUBECONFIG: "{{ dev_access_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _dev_rb
  changed_when: "'created' in _dev_rb.stdout or 'configured' in _dev_rb.stdout"

- name: DevAccess | Apply ClusterRole (namespace reader)
  ansible.builtin.command:
    cmd: kubectl apply -f /tmp/dev-clusterrole.yml
  environment:
    KUBECONFIG: "{{ dev_access_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _dev_cr
  changed_when: "'created' in _dev_cr.stdout or 'configured' in _dev_cr.stdout"

- name: DevAccess | Apply ClusterRoleBinding (namespace reader)
  ansible.builtin.command:
    cmd: kubectl apply -f /tmp/dev-clusterrolebinding.yml
  environment:
    KUBECONFIG: "{{ dev_access_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _dev_crb
  changed_when: "'created' in _dev_crb.stdout or 'configured' in _dev_crb.stdout"