---
- name: Backup | Wait for sealed-secrets key Secret to be created
  ansible.builtin.command: >
    kubectl get secret
    -n {{ sealed_secrets_namespace }}
    -l sealedsecrets.bitnami.com/sealed-secrets-key
    --no-headers
  environment:
    KUBECONFIG: "{{ sealed_secrets_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _key_check
  until: _key_check.stdout != ""
  retries: 12
  delay: 10
  changed_when: false

- name: Backup | Export sealed-secrets master key
  ansible.builtin.command: >
    kubectl get secret
    -n {{ sealed_secrets_namespace }}
    -l sealedsecrets.bitnami.com/sealed-secrets-key
    -o yaml
  environment:
    KUBECONFIG: "{{ sealed_secrets_kubeconfig }}"
    PATH: "/usr/local/bin:/usr/bin:/bin"
  register: _key_yaml
  changed_when: false

- name: Backup | Save key to {{ sealed_secrets_backup_path }}
  ansible.builtin.copy:
    content: "{{ _key_yaml.stdout }}"
    dest: "{{ sealed_secrets_backup_path }}"
    mode: "0600"