---
- name: Set addon facts
  ansible.builtin.set_fact:
    addon_name: kube-prometheus-stack
    addon_namespace: monitoring

- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
  when: item.state == 'directory'
  ansible.builtin.file:
    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
    state: directory
    mode: "0755"
  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]

- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
  when: item.state == 'file' and 'sops' not in item.path
  ansible.builtin.template:
    src: "{{ item.src }}"
    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
    mode: "0644"
  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]

- name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
  block:
    - name: Template encrypted files
      when: item.state == 'file' and 'sops' in item.path
      community.sops.sops_encrypt:
        path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
        encrypted_regex: ^(data|stringData)$
        age: ["{{ bootstrap_age_public_key }}"]
        content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
        mode: "0644"
        force: true
      with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]