---
- name: Discover the k3d API server port from the active kubeconfig
  ansible.builtin.raw: >-
    awk -F: '/server:/{print $4; exit}' /home/{{ k3d_user }}/.kube/config
  become_user: "{{ k3d_user }}"
  register: cilium_discovered_api_port
  changed_when: false
  when: cilium_k8s_service_port | int == 0

- name: Use the discovered k3d API server port
  ansible.builtin.set_fact:
    cilium_k8s_service_port: "{{ cilium_discovered_api_port.stdout | trim }}"
  when: cilium_k8s_service_port | int == 0

- name: Require a reachable Kubernetes API endpoint
  ansible.builtin.assert:
    that:
      - cilium_k8s_service_host | length > 0
      - cilium_k8s_service_port | int > 0
    fail_msg: Set cilium_k8s_service_host and cilium_k8s_service_port for kube-proxy replacement.

- name: Verify kube-proxy is disabled
  ansible.builtin.raw: "{{ k3d_tool_dir }}/kubectl -n kube-system get daemonset kube-proxy"
  become_user: "{{ k3d_user }}"
  register: kube_proxy_check
  changed_when: false
  failed_when: false

- name: Refuse Cilium replacement when kube-proxy is present
  ansible.builtin.assert:
    that:
      - kube_proxy_check.rc != 0
    fail_msg: kube-proxy is present. Create the cluster with a kube-proxy-free profile first.

- name: Add the Cilium Helm repository
  ansible.builtin.raw: "{{ k3d_tool_dir }}/helm repo add cilium https://helm.cilium.io/"
  become_user: "{{ k3d_user }}"
  changed_when: false

- name: Update Helm repositories
  ansible.builtin.raw: "{{ k3d_tool_dir }}/helm repo update"
  become_user: "{{ k3d_user }}"
  changed_when: false

- name: Install Cilium with kube-proxy replacement
  ansible.builtin.raw: >-
    {{ k3d_tool_dir }}/helm upgrade --install cilium cilium/cilium
    --namespace {{ cilium_namespace }}
    --version {{ cilium_chart_version }}
    --values {{ cilium_values_file }}
    --set kubeProxyReplacement=true
    --set k8sServiceHost={{ cilium_k8s_service_host }}
    --set k8sServicePort={{ cilium_k8s_service_port }}
    --wait --timeout 10m
  become_user: "{{ k3d_user }}"

- name: Wait for Cilium agents
  ansible.builtin.raw: >-
    {{ k3d_tool_dir }}/kubectl -n {{ cilium_namespace }} rollout status
    daemonset/cilium --timeout=300s
  become_user: "{{ k3d_user }}"

- name: Verify all Kubernetes nodes become Ready after Cilium starts
  ansible.builtin.raw: "{{ k3d_tool_dir }}/kubectl get nodes --no-headers"
  become_user: "{{ k3d_user }}"
  register: cilium_ready_nodes
  changed_when: false
  retries: 18
  delay: 10
  until:
    - cilium_ready_nodes.rc == 0
    - cilium_ready_nodes.stdout is search(' Ready ')