---
- name: Require the runtime cluster token
  ansible.builtin.assert:
    that: lookup('ansible.builtin.env', 'K3S_TOKEN') | length >= 32
    fail_msg: "K3S_TOKEN must contain at least 32 characters."
  no_log: true

- name: Remove the globally open k3s API port
  ansible.posix.firewalld:
    port: 6443/tcp
    permanent: true
    immediate: true
    state: disabled

- name: Allow the k3s API from node and operator networks
  ansible.posix.firewalld:
    rich_rule: 'rule family="ipv4" source address="{{ item }}" port port="6443" protocol="tcp" accept'
    permanent: true
    immediate: true
    state: enabled
  loop: "{{ [k3s_node_cidr] + k3s_operator_cidrs }}"

- name: Install or reconcile the k3s server
  ansible.builtin.command: /var/tmp/k3s-install.sh
  environment:
    INSTALL_K3S_VERSION: "{{ k3s_version }}"
    INSTALL_K3S_EXEC: "server --node-ip {{ k3s_node_ip }} --write-kubeconfig-mode 0640"
    K3S_TOKEN: "{{ lookup('ansible.builtin.env', 'K3S_TOKEN') }}"
  changed_when: false
  no_log: true

- name: Enable the k3s server
  ansible.builtin.systemd_service:
    name: k3s
    enabled: true
    state: started