---
- name: Create the AWX namespace
  kubernetes.core.k8s:
    name: "{{ awx_operator_namespace }}"
    api_version: v1
    kind: Namespace
    state: present
  tags: [awx_operator]

- name: Deploy the AWX Operator (pinned version)
  ansible.builtin.command: >
    /usr/local/bin/k3s kubectl apply -k
    github.com/ansible/awx-operator/config/default?ref={{ awx_operator_version }}
  environment:
    KUBECONFIG: /etc/rancher/k3s/k3s.yaml
  register: awx_operator_deploy_result
  changed_when: "'unchanged' not in awx_operator_deploy_result.stdout"
  tags: [awx_operator]

- name: Set the operator's default namespace annotation
  ansible.builtin.command: >
    /usr/local/bin/k3s kubectl config set-context --current --namespace={{ awx_operator_namespace }}
  environment:
    KUBECONFIG: /etc/rancher/k3s/k3s.yaml
  changed_when: true
  tags: [awx_operator]

- name: Wait for the AWX Operator deployment to become available
  ansible.builtin.command: >
    /usr/local/bin/k3s kubectl wait deployment/awx-operator-controller-manager
    -n {{ awx_operator_namespace }} --for=condition=Available --timeout=300s
  environment:
    KUBECONFIG: /etc/rancher/k3s/k3s.yaml
  changed_when: false
  tags: [awx_operator]

- name: Create the AWX admin password secret
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: v1
      kind: Secret
      metadata:
        name: "{{ awx_operator_name }}-admin-password"
        namespace: "{{ awx_operator_namespace }}"
      type: Opaque
      stringData:
        password: "{{ awx_admin_password }}"
  no_log: true
  tags: [awx_operator]

- name: Deploy the AWX custom resource
  kubernetes.core.k8s:
    state: present
    definition: "{{ lookup('ansible.builtin.template', 'awx-instance.yml.j2') }}"
  tags: [awx_operator]

- name: Wait for the AWX web deployment to become available
  ansible.builtin.command: >
    /usr/local/bin/k3s kubectl wait deployment/{{ awx_operator_name }}-web
    -n {{ awx_operator_namespace }} --for=condition=Available --timeout=900s
  environment:
    KUBECONFIG: /etc/rancher/k3s/k3s.yaml
  changed_when: false
  register: awx_operator_web_ready
  tags: [awx_operator]

- name: Report AWX access details
  ansible.builtin.debug:
    msg: >-
      AWX is reachable at http://{{ ansible_host | default(inventory_hostname) }}:{{ awx_operator_nodeport }}
      with user '{{ awx_operator_admin_user }}'. Password is stored in vault/secrets.yml (awx_admin_password).
  tags: [awx_operator]