- name: CertManager | Copy latest manifest
  ansible.builtin.get_url:
    url: "https://github.com/cert-manager/cert-manager/releases/download/v{{ certmgr_version }}/cert-manager.yaml"
    dest: "{{ k8s_etc }}/k8s-certmanager.yaml"
    mode: "0600"

- name: CertManager | Apply manifest
  environment:
    PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
  vars:
    ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
  kubernetes.core.k8s:
    state: present
    kubeconfig: "{{ k8s_kubeconfig }}"
    src: "{{ k8s_etc }}/k8s-certmanager.yaml"
    wait: true

- name: CertManager | Register LetsEncrypt (prod)
  environment:
    PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
  vars:
    ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
  kubernetes.core.k8s:
    state: present
    kubeconfig: "{{ k8s_kubeconfig }}"
    wait: true
    definition:
      apiVersion: cert-manager.io/v1
      kind: ClusterIssuer
      metadata:
        name: letsencrypt-prod
        namespace: cert-manager
      spec:
        acme:
          # The ACME server URL
          server: https://acme-v02.api.letsencrypt.org/directory
          # Email address used for ACME registration
          email: "{{ issuer_email }}"
          # Name of a secret used to store the ACME account private key
          privateKeySecretRef:
            name: letsencrypt-prod
          # Enable the HTTP-01 challenge provider
          solvers:
            - http01:
                ingress:
                  class: public

- name: CertManager | Register LetsEncrypt (staging)
  environment:
    PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
  vars:
    ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
  kubernetes.core.k8s:
    state: present
    kubeconfig: "{{ k8s_kubeconfig }}"
    wait: true
    definition:
      apiVersion: cert-manager.io/v1
      kind: ClusterIssuer
      metadata:
        name: letsencrypt-staging
        namespace: cert-manager
      spec:
        acme:
          # The ACME server URL
          server: https://acme-staging-v02.api.letsencrypt.org/directory
          # Email address used for ACME registration
          email: "{{ issuer_email }}"
          # Name of a secret used to store the ACME account private key
          privateKeySecretRef:
            name: letsencrypt-staging
          # Enable the HTTP-01 challenge provider
          solvers:
            - http01:
                ingress:
                  class: public