---
- name: Create OPA namespace
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: v1
      kind: Namespace
      metadata:
        name: "{{ opa_server_namespace }}"

- name: Create OPA policy ConfigMap
  kubernetes.core.k8s:
    state: present
    apply: true
    definition:
      apiVersion: v1
      kind: ConfigMap
      metadata:
        name: "{{ opa_server_name }}-policies"
        namespace: "{{ opa_server_namespace }}"
      data: >-
        {{ __opa_server_policies
           | combine({'aap_policy_config.json': {'aap_policy_config': opa_server_policy_config} | to_json}) }}

- name: Create OPA authorization token Secret
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: v1
      kind: Secret
      metadata:
        name: "{{ opa_server_name }}-authz"
        namespace: "{{ opa_server_namespace }}"
      type: Opaque
      stringData:
        opa_authz.json: "{{ {'opa_authz': {'token': __opa_server_token}} | to_json }}"
  no_log: "{{ opa_server_no_log }}"

- name: Create OPA Service with a service-ca serving certificate
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: v1
      kind: Service
      metadata:
        name: "{{ opa_server_name }}"
        namespace: "{{ opa_server_namespace }}"
        annotations:
          service.beta.openshift.io/serving-cert-secret-name: "{{ __opa_server_tls_secret }}"
      spec:
        selector:
          app: "{{ opa_server_name }}"
        ports:
          - name: https
            port: "{{ opa_server_port | int }}"
            targetPort: https

- name: Wait for OPA serving certificate
  kubernetes.core.k8s_info:
    api_version: v1
    kind: Secret
    namespace: "{{ opa_server_namespace }}"
    name: "{{ __opa_server_tls_secret }}"
  register: __opa_server_cert
  until: __opa_server_cert.resources | length > 0
  retries: 30
  delay: 10
  no_log: true

- name: Create OPA Deployment
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: "{{ opa_server_name }}"
        namespace: "{{ opa_server_namespace }}"
        labels:
          app: "{{ opa_server_name }}"
      spec:
        replicas: "{{ opa_server_replicas | int }}"
        selector:
          matchLabels:
            app: "{{ opa_server_name }}"
        template:
          metadata:
            labels:
              app: "{{ opa_server_name }}"
            annotations:
              # Roll pods when policies, config, or the token change
              checksum/policies: "{{ (__opa_server_policies | to_json ~ opa_server_policy_config | to_json) | hash('sha256') }}"
              checksum/authz: "{{ __opa_server_token | hash('sha256') }}"
          spec:
            securityContext:
              runAsNonRoot: true
              seccompProfile:
                type: RuntimeDefault
            containers:
              - name: opa
                image: "{{ opa_server_image }}"
                args: >-
                  {{ [
                       'run', '--server',
                       '--addr=0.0.0.0:' ~ opa_server_port,
                       '--tls-cert-file=/certs/tls.crt',
                       '--tls-private-key-file=/certs/tls.key',
                       '--authentication=token',
                       '--authorization=basic',
                       '--ignore=.*',
                       '--log-format=json',
                       '--log-level=' ~ opa_server_log_level,
                     ]
                     + (['--set=decision_logs.console=true'] if opa_server_decision_logs | bool else [])
                     + ['/policies', '/authz'] }}
                ports:
                  - name: https
                    containerPort: "{{ opa_server_port | int }}"
                readinessProbe:
                  httpGet:
                    path: /health
                    port: https
                    scheme: HTTPS
                  initialDelaySeconds: 3
                  periodSeconds: 10
                livenessProbe:
                  httpGet:
                    path: /health
                    port: https
                    scheme: HTTPS
                  initialDelaySeconds: 10
                  periodSeconds: 20
                resources: "{{ opa_server_resources }}"
                securityContext:
                  allowPrivilegeEscalation: false
                  readOnlyRootFilesystem: true
                  capabilities:
                    drop: [ALL]
                volumeMounts:
                  - name: policies
                    mountPath: /policies
                    readOnly: true
                  - name: authz
                    mountPath: /authz
                    readOnly: true
                  - name: certs
                    mountPath: /certs
                    readOnly: true
            volumes:
              - name: policies
                configMap:
                  name: "{{ opa_server_name }}-policies"
              - name: authz
                secret:
                  secretName: "{{ opa_server_name }}-authz"
              - name: certs
                secret:
                  secretName: "{{ __opa_server_tls_secret }}"

- name: Wait for OPA to be available
  kubernetes.core.k8s_info:
    api_version: apps/v1
    kind: Deployment
    namespace: "{{ opa_server_namespace }}"
    name: "{{ opa_server_name }}"
  register: __opa_server_deploy
  until: >-
    __opa_server_deploy.resources | length > 0 and
    (__opa_server_deploy.resources[0].status.updatedReplicas | default(0)) == opa_server_replicas | int and
    (__opa_server_deploy.resources[0].status.availableReplicas | default(0)) == opa_server_replicas | int
  retries: "{{ __opa_server_wait_retries }}"
  delay: 10