---
- name: Validate Falco alerting inputs
  ansible.builtin.assert:
    that:
      - not (falco_alerting_enabled | bool) or falco_slack_webhook_url | length > 0
    fail_msg: falco_slack_webhook_url is required when falco_alerting_enabled is true.

- name: Ensure the Falco namespace exists for alerting resources
  ansible.builtin.raw: >-
    {{ k3d_tool_dir }}/kubectl create namespace falco
    --dry-run=client -o yaml |
    {{ k3d_tool_dir }}/kubectl apply -f -
  become_user: "{{ k3d_user }}"
  when: falco_alerting_enabled | bool

- name: Create or update the Falco alerting Secret
  ansible.builtin.raw: >-
    {{ k3d_tool_dir }}/kubectl -n falco create secret generic falco-alerting
    --from-literal=webhook-url='{{ falco_slack_webhook_url }}'
    --dry-run=client -o yaml |
    {{ k3d_tool_dir }}/kubectl apply --server-side --force-conflicts -f -
  become_user: "{{ k3d_user }}"
  no_log: true
  when: falco_alerting_enabled | bool

- name: Apply the optional Falco alerting ArgoCD Application
  ansible.builtin.raw: >-
    {{ k3d_tool_dir }}/kubectl apply --server-side --force-conflicts
    -f {{ falco_alerting_application_manifest }}
  become_user: "{{ k3d_user }}"
  when: falco_alerting_enabled | bool

- name: Remove the optional Falco alerting ArgoCD Application when disabled
  ansible.builtin.raw: >-
    {{ k3d_tool_dir }}/kubectl -n argocd delete application falco-alerting
    --ignore-not-found=true --wait=true
  become_user: "{{ k3d_user }}"
  when: not (falco_alerting_enabled | bool)

- name: Remove the Falcosidekick Component when alerting is disabled
  ansible.builtin.raw: >-
    {{ k3d_tool_dir }}/kubectl -n falco delete component falcosidekick
    --ignore-not-found=true --wait=true
  become_user: "{{ k3d_user }}"
  when: not (falco_alerting_enabled | bool)

- name: Remove the Falcosidekick output Config when alerting is disabled
  ansible.builtin.raw: >-
    {{ k3d_tool_dir }}/kubectl -n falco delete config falco-falcosidekick-output
    --ignore-not-found=true --wait=true
  become_user: "{{ k3d_user }}"
  when: not (falco_alerting_enabled | bool)

- name: Remove the Falco alerting Secret when alerting is disabled
  ansible.builtin.raw: >-
    {{ k3d_tool_dir }}/kubectl -n falco delete secret falco-alerting
    --ignore-not-found=true --wait=true
  become_user: "{{ k3d_user }}"
  when: not (falco_alerting_enabled | bool)