---
- name: Require a node address
  ansible.builtin.assert:
    that:
      - k3s_node_ip is defined
      - k3s_node_ip | string | length > 0
      - k3s_node_cidr is defined
      - k3s_node_cidr | string | length > 0
      - k3s_operator_cidrs is defined
      - k3s_operator_cidrs | length > 0

- name: Install host dependencies
  ansible.builtin.dnf:
    name:
      - curl
      - firewalld
      - policycoreutils-python-utils
    state: present

- name: Enable firewalld
  ansible.builtin.systemd_service:
    name: firewalld
    enabled: true
    state: started

- name: Trust the k3s pod network
  ansible.posix.firewalld:
    source: "{{ k3s_cluster_cidr }}"
    zone: trusted
    permanent: true
    immediate: true
    state: enabled

- name: Trust the k3s service network
  ansible.posix.firewalld:
    source: "{{ k3s_service_cidr }}"
    zone: trusted
    permanent: true
    immediate: true
    state: enabled

- name: Remove globally open node-to-node k3s ports
  ansible.posix.firewalld:
    port: "{{ item }}"
    permanent: true
    immediate: true
    state: disabled
  loop:
    - 8472/udp
    - 10250/tcp

- name: Allow node-to-node k3s ports from the node network
  ansible.posix.firewalld:
    rich_rule: 'rule family="ipv4" source address="{{ k3s_node_cidr }}" port port="{{ item.port }}" protocol="{{ item.protocol }}" accept'
    permanent: true
    immediate: true
    state: enabled
  loop:
    - {port: "8472", protocol: udp}
    - {port: "10250", protocol: tcp}

- name: Download the official k3s installer
  ansible.builtin.get_url:
    url: https://get.k3s.io
    dest: /var/tmp/k3s-install.sh
    mode: "0755"
    owner: root
    group: root