---
- name: Check whether K3s is installed
  ansible.builtin.stat:
    path: "{{ k3s_binary_path }}"
  register: k3s_server_binary

- name: Require explicit approval before first K3s installation
  ansible.builtin.assert:
    that:
      - k3s_install_enabled | bool
    fail_msg: >-
      Refusing first-time K3s installation. Re-run only after preflight succeeds
      with k3s_install_enabled=true.
  when: not (k3s_server_binary.stat.exists | bool)

- name: Install current stable K3s only on a new node
  ansible.builtin.shell:
    cmd: >-
      curl -fsSL {{ k3s_install_url }} |
      INSTALL_K3S_EXEC='server {{ k3s_server_args | join(' ') }}' sh -
    creates: "{{ k3s_binary_path }}"
  when: not (k3s_server_binary.stat.exists | bool)
  no_log: true

- name: Wait for K3s API readiness
  ansible.builtin.command:
    argv:
      - "{{ k3s_binary_path }}"
      - kubectl
      - get
      - node
      - --output=jsonpath={.items[0].status.conditions[?(@.type=="Ready")].status}
  changed_when: false
  register: k3s_server_ready
  retries: 30
  delay: 5
  until: k3s_server_ready.stdout == 'True'

- name: Assert Traefik is installed and K3s optional components remain disabled
  ansible.builtin.command:
    argv:
      - "{{ k3s_binary_path }}"
      - kubectl
      - get
      - deployment
      - traefik
      - --namespace=kube-system
  changed_when: false