---
# ------------------------------------------------------------------
# User Workload Monitoring (MaaS reports Degraded without it)
# ------------------------------------------------------------------
- name: Read cluster monitoring config
  kubernetes.core.k8s_info:
    api_version: v1
    kind: ConfigMap
    namespace: openshift-monitoring
    name: cluster-monitoring-config
  register: __rhoai_maas_cmo

- name: Resolve cluster monitoring config
  ansible.builtin.set_fact:
    __rhoai_maas_cmo_config: >-
      {{ ((__rhoai_maas_cmo.resources[0].data['config.yaml'] | default('{}')) if __rhoai_maas_cmo.resources else '{}')
         | from_yaml | default({}, true) }}

- name: Enable User Workload Monitoring
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: v1
      kind: ConfigMap
      metadata:
        name: cluster-monitoring-config
        namespace: openshift-monitoring
      data:
        config.yaml: "{{ __rhoai_maas_cmo_config | combine({'enableUserWorkload': true}) | to_nice_yaml }}"
  when: not (__rhoai_maas_cmo_config.enableUserWorkload | default(false) | bool)

# ------------------------------------------------------------------
# Gateway API: GatewayClass, Gateway, passthrough Route
# ------------------------------------------------------------------
- name: Read cluster ingress domain
  kubernetes.core.k8s_info:
    api_version: config.openshift.io/v1
    kind: Ingress
    name: cluster
  register: __rhoai_maas_ingress
  when: rhoai_maas_hostname | length == 0

- name: Resolve MaaS hostname
  ansible.builtin.set_fact:
    __rhoai_maas_hostname: >-
      {{ rhoai_maas_hostname if rhoai_maas_hostname | length > 0
         else 'maas.' ~ __rhoai_maas_ingress.resources[0].spec.domain }}

- name: Create MaaS gateway certificate
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: cert-manager.io/v1
      kind: Certificate
      metadata:
        name: "{{ __rhoai_maas_gateway_name }}-cert"
        namespace: "{{ __rhoai_maas_gateway_namespace }}"
      spec:
        secretName: "{{ rhoai_maas_gateway_cert_secret }}"
        issuerRef:
          name: "{{ rhoai_maas_gateway_cert_issuer }}"
          kind: ClusterIssuer
        dnsNames:
          - "{{ __rhoai_maas_hostname }}"
        duration: 2160h
        renewBefore: 720h
  when: rhoai_maas_gateway_cert_issuer | length > 0

- name: Wait for MaaS gateway certificate to be issued
  kubernetes.core.k8s_info:
    api_version: cert-manager.io/v1
    kind: Certificate
    namespace: "{{ __rhoai_maas_gateway_namespace }}"
    name: "{{ __rhoai_maas_gateway_name }}-cert"
  register: __rhoai_maas_gw_cert
  until: >-
    (__rhoai_maas_gw_cert.resources[0].status.conditions | default([])
     | selectattr('type', 'equalto', 'Ready') | selectattr('status', 'equalto', 'True') | list | length) > 0
  retries: 30
  delay: 10
  when: rhoai_maas_gateway_cert_issuer | length > 0

# Creating the GatewayClass makes the ingress operator install Service Mesh 3 (Istio)
- name: Create openshift-default GatewayClass
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: gateway.networking.k8s.io/v1
      kind: GatewayClass
      metadata:
        name: openshift-default
      spec:
        controllerName: openshift.io/gateway-controller/v1

- name: Wait for GatewayClass to be accepted
  kubernetes.core.k8s_info:
    api_version: gateway.networking.k8s.io/v1
    kind: GatewayClass
    name: openshift-default
  register: __rhoai_maas_gwc
  until: >-
    __rhoai_maas_gwc.resources | length > 0 and
    (__rhoai_maas_gwc.resources[0].status.conditions | default([])
     | selectattr('type', 'equalto', 'Accepted') | selectattr('status', 'equalto', 'True') | list | length) > 0
  retries: "{{ __rhoai_maas_wait_retries }}"
  delay: 10

- name: Create Gateway deployment options
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: v1
      kind: ConfigMap
      metadata:
        name: maas-gateway-options
        namespace: "{{ __rhoai_maas_gateway_namespace }}"
      data:
        deployment: |
          spec:
            template:
              spec:
                containers:
                - name: istio-proxy
                  resources:
                    requests:
                      cpu: 100m
                      memory: 256Mi
                    limits:
                      cpu: "2"
                      memory: 2Gi

- name: Create MaaS Gateway
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: gateway.networking.k8s.io/v1
      kind: Gateway
      metadata:
        name: "{{ __rhoai_maas_gateway_name }}"
        namespace: "{{ __rhoai_maas_gateway_namespace }}"
        annotations:
          opendatahub.io/managed: "false"
          security.opendatahub.io/authorino-tls-bootstrap: "true"
          networking.istio.io/service-type: "{{ rhoai_maas_gateway_service_type }}"
      spec:
        gatewayClassName: openshift-default
        infrastructure:
          parametersRef:
            group: ""
            kind: ConfigMap
            name: maas-gateway-options
        listeners:
          - name: http
            hostname: "{{ __rhoai_maas_hostname }}"
            port: 80
            protocol: HTTP
            allowedRoutes:
              namespaces:
                from: Selector
                selector:
                  matchLabels:
                    maas.opendatahub.io/gateway-access: "true"
          - name: https
            hostname: "{{ __rhoai_maas_hostname }}"
            port: 443
            protocol: HTTPS
            allowedRoutes:
              namespaces:
                from: Selector
                selector:
                  matchLabels:
                    maas.opendatahub.io/gateway-access: "true"
            tls:
              mode: Terminate
              certificateRefs:
                - group: ""
                  kind: Secret
                  name: "{{ rhoai_maas_gateway_cert_secret }}"

- name: Wait for MaaS Gateway to be programmed
  kubernetes.core.k8s_info:
    api_version: gateway.networking.k8s.io/v1
    kind: Gateway
    namespace: "{{ __rhoai_maas_gateway_namespace }}"
    name: "{{ __rhoai_maas_gateway_name }}"
  register: __rhoai_maas_gw
  until: >-
    (__rhoai_maas_gw.resources[0].status.conditions | default([])
     | selectattr('type', 'equalto', 'Programmed') | selectattr('status', 'equalto', 'True') | list | length) > 0
  retries: "{{ __rhoai_maas_wait_retries }}"
  delay: 10

- name: Expose MaaS Gateway through the default router
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: route.openshift.io/v1
      kind: Route
      metadata:
        name: "{{ __rhoai_maas_gateway_name }}-https"
        namespace: "{{ __rhoai_maas_gateway_namespace }}"
      spec:
        host: "{{ __rhoai_maas_hostname }}"
        port:
          targetPort: https
        tls:
          termination: passthrough
          insecureEdgeTerminationPolicy: Redirect
        to:
          kind: Service
          name: "{{ __rhoai_maas_gateway_service }}"
          weight: 100
  when: rhoai_maas_gateway_create_route | bool

# ------------------------------------------------------------------
# Kuadrant (Authorino + Limitador) and Authorino TLS
# ------------------------------------------------------------------
- name: Create kuadrant-system namespace
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: v1
      kind: Namespace
      metadata:
        name: kuadrant-system

- name: Create Kuadrant instance
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: kuadrant.io/v1beta1
      kind: Kuadrant
      metadata:
        name: kuadrant
        namespace: kuadrant-system
      spec:
        observability:
          enable: true

# The Kuadrant operator only detects the Gateway API provider (Istio) at startup.
# RHCL is installed before the GatewayClass provisions Istio, so on a fresh
# install Kuadrant reports MissingDependency until the operator pod restarts.
- name: Read Kuadrant status
  kubernetes.core.k8s_info:
    api_version: kuadrant.io/v1beta1
    kind: Kuadrant
    namespace: kuadrant-system
    name: kuadrant
  register: __rhoai_maas_kuadrant
  until: >-
    (__rhoai_maas_kuadrant.resources[0].status.conditions | default([])
     | selectattr('type', 'equalto', 'Ready') | list | length) > 0
  retries: 12
  delay: 5
  failed_when: false

- name: Restart the Kuadrant operator to detect Istio
  kubernetes.core.k8s:
    state: absent
    api_version: v1
    kind: Pod
    namespace: openshift-operators
    label_selectors:
      - app=kuadrant
      - control-plane=controller-manager
  when: >-
    (__rhoai_maas_kuadrant.resources[0].status.conditions | default([])
     | selectattr('type', 'equalto', 'Ready') | map(attribute='reason') | first | default(''))
    == 'MissingDependency'

- name: Wait for Kuadrant to be ready
  kubernetes.core.k8s_info:
    api_version: kuadrant.io/v1beta1
    kind: Kuadrant
    namespace: kuadrant-system
    name: kuadrant
  register: __rhoai_maas_kuadrant
  until: >-
    (__rhoai_maas_kuadrant.resources[0].status.conditions | default([])
     | selectattr('type', 'equalto', 'Ready') | selectattr('status', 'equalto', 'True') | list | length) > 0
  retries: "{{ __rhoai_maas_wait_retries }}"
  delay: 10

- name: Wait for Authorino service
  kubernetes.core.k8s_info:
    api_version: v1
    kind: Service
    namespace: kuadrant-system
    name: authorino-authorino-authorization
  register: __rhoai_maas_authorino_svc
  until: __rhoai_maas_authorino_svc.resources | length > 0
  retries: "{{ __rhoai_maas_wait_retries }}"
  delay: 10

- name: Request a service-ca serving certificate for Authorino
  kubernetes.core.k8s:
    state: patched
    api_version: v1
    kind: Service
    namespace: kuadrant-system
    name: authorino-authorino-authorization
    definition:
      metadata:
        annotations:
          service.beta.openshift.io/serving-cert-secret-name: authorino-server-cert

- name: Wait for Authorino serving certificate
  kubernetes.core.k8s_info:
    api_version: v1
    kind: Secret
    namespace: kuadrant-system
    name: authorino-server-cert
  register: __rhoai_maas_authorino_cert
  until: __rhoai_maas_authorino_cert.resources | length > 0
  retries: 30
  delay: 10
  no_log: true

- name: Enable Authorino TLS listener
  kubernetes.core.k8s:
    state: patched
    api_version: operator.authorino.kuadrant.io/v1beta1
    kind: Authorino
    namespace: kuadrant-system
    name: authorino
    merge_type: merge
    definition:
      spec:
        listener:
          tls:
            enabled: true
            certSecretRef:
              name: authorino-server-cert

- name: Read Authorino deployment
  kubernetes.core.k8s_info:
    api_version: apps/v1
    kind: Deployment
    namespace: kuadrant-system
    name: authorino
  register: __rhoai_maas_authorino_deploy

- name: Trust the service CA in Authorino
  kubernetes.core.k8s:
    state: patched
    api_version: apps/v1
    kind: Deployment
    namespace: kuadrant-system
    name: authorino
    merge_type: strategic-merge
    definition:
      spec:
        template:
          spec:
            containers:
              - name: "{{ __rhoai_maas_authorino_deploy.resources[0].spec.template.spec.containers[0].name }}"
                env:
                  - name: SSL_CERT_FILE
                    value: /etc/ssl/certs/openshift-service-ca/service-ca-bundle.crt
                  - name: REQUESTS_CA_BUNDLE
                    value: /etc/ssl/certs/openshift-service-ca/service-ca-bundle.crt