---
- name: Ensure Kubernetes directories exist
  when: item.state == 'directory'
  ansible.builtin.file:
    path: "{{ repository_path }}/kubernetes/{{ item.path }}"
    state: directory
    mode: "0755"
  with_community.general.filetree: ["../templates/kubernetes/"]

- name: Template Kubernetes unencrypted files
  when:
    - "item.state == 'file'"
    - "'.DS_Store' not in item.path"
    - "'sops' not in item.path"
    - "'cluster-settings-user.yaml.j2' not in item.path"
    - "'cluster-secrets-user.yaml.j2' not in item.path"
  ansible.builtin.template:
    src: "{{ item.src }}"
    dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}"
    mode: "0644"
  with_community.general.filetree: ["../templates/kubernetes/"]

- name: Check if the cluster user settings file already exists
  stat:
    path: "{{ repository_path }}/kubernetes/flux/vars/cluster-settings-user.yaml"
  register: cluster_settings_user

- name: Template Kubernetes user cluster settings
  when:
    - "item.state == 'file'"
    - "'cluster-settings-user.yaml' in item.path"
    - "not cluster_settings_user.stat.exists"
  ansible.builtin.template:
    src: "{{ item.src }}"
    dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}"
    mode: "0644"
  with_community.general.filetree: ["../templates/kubernetes/"]

- name: Check if the cluster user secrets file already exists
  stat:
    path: "{{ repository_path }}/kubernetes/flux/vars/cluster-secrets-user.yaml"
  register: cluster_secrets_user

- name: Template Kubernetes user cluster secrets
  when:
    - "item.state == 'file'"
    - "'cluster-secrets-user.yaml' in item.path"
    - "not cluster_secrets_user.stat.exists"
  ansible.builtin.template:
    src: "{{ item.src }}"
    dest: "{{ repository_path }}/kubernetes/{{ item.path | regex_replace('.j2$', '') }}"
    mode: "0644"
  with_community.general.filetree: ["../templates/kubernetes/"]

- name: Template Kubernetes encrypted files
  block:
    - name: Template Kubernetes encrypted files
      when:
        - "item.state == 'file'"
        - "'sops' in item.path"
      community.sops.sops_encrypt:
        path: "{{ repository_path }}/kubernetes/{{ item.path | replace('.j2', '') }}"
        encrypted_regex: ^(data|stringData)$
        age: ["{{ bootstrap_age_public_key }}"]
        content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
        mode: "0644"
        force: true
      with_community.general.filetree: ["../templates/kubernetes/"]