---
# ------------------------------------------------------------------
# ExternalProvider + ExternalModel + MaaSModelRef per model
# ------------------------------------------------------------------
- name: Allow model namespaces to attach to the Gateway
  kubernetes.core.k8s:
    state: patched
    api_version: v1
    kind: Namespace
    name: "{{ item }}"
    definition:
      metadata:
        labels:
          maas.opendatahub.io/gateway-access: "true"
          opendatahub.io/dashboard: "true"
  loop: "{{ rhoai_maas_external_models | map(attribute='namespace') | unique }}"

- name: Mark provider API key secrets as MaaS-managed
  kubernetes.core.k8s:
    state: patched
    api_version: v1
    kind: Secret
    namespace: "{{ item.namespace }}"
    name: "{{ item.api_key_secret }}"
    definition:
      metadata:
        labels:
          inference.llm-d.ai/ipp-managed: "true"
  loop: "{{ rhoai_maas_external_models }}"
  loop_control:
    label: "{{ item.namespace }}/{{ item.api_key_secret }}"

- name: Create ExternalProviders
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: inference.opendatahub.io/v1alpha1
      kind: ExternalProvider
      metadata:
        name: "{{ item.provider_name }}"
        namespace: "{{ item.namespace }}"
      spec:
        provider: "{{ item.provider_type }}"
        endpoint: "{{ item.endpoint }}"
        auth:
          type: apikey
          secretRef:
            name: "{{ item.api_key_secret }}"
  loop: "{{ rhoai_maas_external_models }}"
  loop_control:
    label: "{{ item.namespace }}/{{ item.provider_name }}"

- name: Wait for ExternalProviders to be ready
  kubernetes.core.k8s_info:
    api_version: inference.opendatahub.io/v1alpha1
    kind: ExternalProvider
    namespace: "{{ item.namespace }}"
    name: "{{ item.provider_name }}"
  register: __rhoai_maas_provider
  until: (__rhoai_maas_provider.resources[0].status.phase | default('')) == 'Ready'
  retries: 30
  delay: 10
  loop: "{{ rhoai_maas_external_models }}"
  loop_control:
    label: "{{ item.namespace }}/{{ item.provider_name }}"

- name: Create ExternalModels
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: inference.opendatahub.io/v1alpha1
      kind: ExternalModel
      metadata:
        name: "{{ item.name }}"
        namespace: "{{ item.namespace }}"
        annotations:
          maas.opendatahub.io/tls: "{{ item.tls | default(true) | string | lower }}"
          maas.opendatahub.io/port: "{{ item.port | default(443) | string }}"
      spec:
        externalProviderRefs:
          - ref:
              name: "{{ item.provider_name }}"
            targetModel: "{{ item.target_model }}"
            apiFormat: "{{ item.api_format | default('openai-chat') }}"
            path: "{{ item.path | default('/v1/chat/completions') }}"
            weight: 100
  loop: "{{ rhoai_maas_external_models }}"
  loop_control:
    label: "{{ item.namespace }}/{{ item.name }}"

- name: Publish models to MaaS
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: maas.opendatahub.io/v1alpha1
      kind: MaaSModelRef
      metadata:
        name: "{{ item.name }}"
        namespace: "{{ item.namespace }}"
        annotations:
          openshift.io/display-name: "{{ item.display_name | default(item.name) }}"
          openshift.io/description: "{{ item.description | default('') }}"
      spec:
        modelRef:
          kind: ExternalModel
          name: "{{ item.name }}"
  loop: "{{ rhoai_maas_external_models }}"
  loop_control:
    label: "{{ item.namespace }}/{{ item.name }}"

# ------------------------------------------------------------------
# Access policies and quota (models-as-a-service namespace)
# ------------------------------------------------------------------
- name: Wait for the models-as-a-service namespace
  kubernetes.core.k8s_info:
    api_version: v1
    kind: Namespace
    name: "{{ __rhoai_maas_namespace }}"
  register: __rhoai_maas_ns
  until: __rhoai_maas_ns.resources | length > 0
  retries: "{{ __rhoai_maas_wait_retries }}"
  delay: 10

- name: Create MaaSAuthPolicies
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: maas.opendatahub.io/v1alpha1
      kind: MaaSAuthPolicy
      metadata:
        name: "{{ item.name }}"
        namespace: "{{ __rhoai_maas_namespace }}"
        annotations:
          openshift.io/display-name: "{{ item.display_name | default(item.name) }}"
          openshift.io/description: "{{ item.description | default('') }}"
      spec:
        modelRefs: "{{ item.model_refs }}"
        subjects:
          groups: "{{ item.groups | default([]) | map('community.general.dict_kv', 'name') | list }}"
          users: "{{ item.users | default([]) }}"
  loop: "{{ rhoai_maas_auth_policies }}"
  loop_control:
    label: "{{ item.name }}"

- name: Create MaaSSubscriptions
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: maas.opendatahub.io/v1alpha1
      kind: MaaSSubscription
      metadata:
        name: "{{ item.name }}"
        namespace: "{{ __rhoai_maas_namespace }}"
        annotations:
          openshift.io/display-name: "{{ item.display_name | default(item.name) }}"
          openshift.io/description: "{{ item.description | default('') }}"
      spec:
        owner:
          groups: "{{ item.groups | default([]) | map('community.general.dict_kv', 'name') | list }}"
          users: "{{ item.users | default([]) }}"
        modelRefs: "{{ item.model_refs }}"
        priority: "{{ item.priority | default(10) | int }}"
  loop: "{{ rhoai_maas_subscriptions }}"
  loop_control:
    label: "{{ item.name }}"