---
# Build maas-db-config (DB_CONNECTION_URL) from the CloudNativePG basic-auth secret.
# RHOAI 3.5+ reads it from the infrastructure namespace; it must exist before the
# DSC enables modelsAsAService.

- name: Read MaaS database credentials
  kubernetes.core.k8s_info:
    api_version: v1
    kind: Secret
    namespace: "{{ rhoai_maas_db_secret_namespace }}"
    name: "{{ rhoai_maas_db_secret_name }}"
  register: __rhoai_maas_db_secret
  no_log: true

- name: Verify MaaS database credentials exist
  ansible.builtin.assert:
    that: __rhoai_maas_db_secret.resources | length > 0
    fail_msg: >-
      Secret {{ rhoai_maas_db_secret_namespace }}/{{ rhoai_maas_db_secret_name }} not found.
      Run the cloudnativepg_operator role first (playbooks/deploy_rhoai_maas.yml does this).

- name: Create MaaS infrastructure namespace
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: v1
      kind: Namespace
      metadata:
        name: "{{ rhoai_maas_infra_namespace }}"

- name: Create maas-db-config secret
  vars:
    __db: "{{ __rhoai_maas_db_secret.resources[0].data }}"
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: v1
      kind: Secret
      metadata:
        name: maas-db-config
        namespace: "{{ rhoai_maas_infra_namespace }}"
      type: Opaque
      stringData:
        DB_CONNECTION_URL: >-
          postgresql://{{ __db.username | b64decode | urlencode | replace('/', '%2F') }}:{{
          __db.password | b64decode | urlencode | replace('/', '%2F') }}@{{
          __db.host | b64decode }}:{{ __db.port | b64decode }}/{{ __db.database | b64decode
          }}?sslmode={{ rhoai_maas_db_sslmode }}
  no_log: true