- name: Microk8s | Installing microk8s from channel '{{ microk8s_channel }}'
  become: true
  community.general.snap:
    name: microk8s
    channel: "{{ microk8s_channel }}"
    classic: true

- name: Create encryption configuration
  become: true
  ansible.builtin.copy:
    content: |
      ---
      apiVersion: apiserver.config.k8s.io/v1
      kind: EncryptionConfiguration
      resources:
        - resources:
          - secrets
          - configmaps
          providers:
          - aescbc:
              keys:
              - name: k8s-crypto
                secret: {{ microk8s_encryption_secret }}
          - identity: {}
    dest: "{{ microk8s_encryption_cfg }}"
    mode: "0600"

- name: Microk8s | Patch microk8s configuration
  notify: ["Restart microk8s"]
  block:
    - name: Microk8s | Enable privileged mode
      become: true
      ansible.builtin.lineinfile:
        path: /var/snap/microk8s/current/args/kube-apiserver
        line: "--allow-privileged=true"
        insertafter: "^--insecure-port=0$"

    - name: Microk8s | Enable encryption provider
      become: true
      ansible.builtin.lineinfile:
        path: /var/snap/microk8s/current/args/kube-apiserver
        line: "--encryption-provider-config={{ microk8s_encryption_cfg }}"
        insertafter: "^--insecure-port=0$"

    - name: Microk8s | Fixing Disk Pressure
      become: true
      ansible.builtin.lineinfile:
        path: /var/snap/microk8s/current/args/kubelet
        line: "{{ item }}"
        insertafter: "^--read-only-port=0$"
      with_items:
        - "--image-gc-high-threshold=70"
        - "--image-gc-low-threshold=60"

    - name: Microk8s | Setup alternative DNS names
      become: true
      ansible.builtin.lineinfile:
        path: /var/snap/microk8s/current/certs/csr.conf.template
        line: "DNS.6 = {{ microk8s_alt_names }}"
        insertafter: "^DNS.5 = kubernetes.default.svc.cluster.local$"

- name: Microk8s | Waiting for microk8s to be ready # noqa no-changed-when
  become: true
  ansible.builtin.command:
    cmd: "microk8s.status --wait-ready --format short -t {{ microk8s_status_timeout }}"
  register: microk8s_wait_result
  failed_when: "'microk8s is running' not in microk8s_wait_result.stdout"
  changed_when: false

- name: Microk8s | Adding required users to group microk8s
  become: true
  ansible.builtin.user:
    name: "{{ ansible_user }}"
    groups:
      - microk8s
    append: true
  register: user_group_task

- name: Reset ssh connection to allow user changes to affect ansible user # noqa no-handler
  when: user_group_task.changed
  ansible.builtin.meta: reset_connection

- name: Microk8s | Required plugins (microk8s)
  ansible.builtin.include_tasks: microk8s/plugins.yml
  loop:
    - { plugin: "ha-cluster", wait: 30, args: "--force", enabled: false }
    - { plugin: "rbac", wait: 30, args: "", enabled: true }
    - { plugin: "dns", wait: 30, args: "", enabled: true }
    - { plugin: "storage", wait: 10, args: "", enabled: true }
    - { plugin: "ingress", wait: 60, args: "", enabled: true }
    - { plugin: "hostpath-storage", wait: 10, args: "", enabled: true }

- name: Microk8s | Configure required ufw rules
  ansible.builtin.include_tasks: microk8s/ufw.yml

- name: Microk8s | Store kubeconfig
  ansible.builtin.shell:
    cmd: "microk8s config > {{ k8s_kubeconfig }}"
    creates: "{{ k8s_kubeconfig }}"

- name: Microk8s | Hardening kubeconfig permissions
  ansible.builtin.file:
    path: "{{ k8s_kubeconfig }}"
    state: file
    mode: "0600"
