---
- name: Require explicit approval before certificate smoke test
  ansible.builtin.assert:
    that:
      - matrix_certificate_smoke_enabled | bool
    fail_msg: >-
      Refusing certificate smoke test changes. Re-run with
      matrix_certificate_smoke_enabled=true after creating the test DNS record.

- name: Render non-sensitive certificate smoke-test resources
  ansible.builtin.template:
    src: smoke.yaml.j2
    dest: "/etc/rancher/k3s/{{ matrix_certificate_smoke_name }}.yaml"
    owner: root
    group: root
    mode: "0600"

- name: Apply certificate smoke-test resources
  ansible.builtin.command:
    argv:
      - k3s
      - kubectl
      - apply
      - -f
      - "/etc/rancher/k3s/{{ matrix_certificate_smoke_name }}.yaml"
  changed_when: false

- name: Wait for smoke-test deployment
  ansible.builtin.command:
    argv:
      - k3s
      - kubectl
      - rollout
      - status
      - "deployment/{{ matrix_certificate_smoke_name }}"
      - "--namespace={{ matrix_certificate_smoke_namespace }}"
      - --timeout=180s
  changed_when: false

- name: Wait for smoke-test certificate
  ansible.builtin.command:
    argv:
      - k3s
      - kubectl
      - wait
      - --for=condition=Ready
      - "certificate/{{ matrix_certificate_smoke_name }}-tls"
      - "--namespace={{ matrix_certificate_smoke_namespace }}"
      - --timeout=10m
  changed_when: false
  when: not (matrix_certificate_smoke_cleanup | bool)

- name: Remove smoke-test resources after verification
  ansible.builtin.command:
    argv:
      - k3s
      - kubectl
      - delete
      - -f
      - "/etc/rancher/k3s/{{ matrix_certificate_smoke_name }}.yaml"
      - --ignore-not-found=true
  changed_when: false
  when: matrix_certificate_smoke_cleanup | bool