# SPDX-License-Identifier: MIT
---
- name: Deploy the quadlet demo app
  hosts: all
  gather_facts: true
  vars_files:
    - vars/test_vars.yml
  vars:
  # NOTE: Currently need to use copr for EL testing for
  # healthcheck, Secret= directive.
  # NOTE: EL8 copr currently not working
    podman_use_copr: false # disable copr for CI testing
    podman_fail_if_too_old: false
    podman_create_host_directories: true
    __podman_quadlet_specs:
      - file_src: quadlet-demo.network
      - file_src: quadlet-demo-mysql.volume
      - template_src: quadlet-demo-mysql.container.j2
      - file_src: envoy-proxy-configmap.yml
      - template_src: quadlet-demo.yml.j2
      - file_src: quadlet-demo.kube
    podman_firewall:
      - port: 8000/tcp
        state: enabled
      - port: 9000/tcp
        state: enabled
    __test_cert_name: quadlet_demo
    podman_host_directories:
      "/tmp/quadlet_demo":
        mode: "0777"
  tasks:
    - name: Test is only supported on x86_64
      debug:
        msg: >
          This test is only supported on x86_64 because the test images used are only
          available on that platform.
      when: ansible_facts["architecture"] != "x86_64"

    - name: End test
      meta: end_play
      when: ansible_facts["architecture"] != "x86_64"

    - name: Run tests
      block:
        - name: Generate certificates
          include_role:
            name: fedora.linux_system_roles.certificate
          vars:
            certificate_requests:
              - name: "{{ __test_cert_name }}"
                dns: ["localhost"]
                ca: self-sign
            certificate_test_mode: true
            certificate_test_remove_files: true

        - name: Run the role
          include_role:
            name: fedora.linux_system_roles.podman
          vars:
            podman_quadlet_specs: "{{ __podman_quadlet_specs }}"
            podman_pull_retry: true
            podman_secrets:
              - name: mysql-root-password-container
                state: present
                data: "{{ mysql_container_root_password }}"
              - name: mysql-root-password-kube
                state: present
                data: |
                  apiVersion: v1
                  data:
                    password: "{{ mysql_container_root_password | b64encode }}"
                  kind: Secret
                  metadata:
                    name: mysql-root-password-kube
              - name: envoy-certificates
                state: present
                data: |
                  apiVersion: v1
                  data:
                    certificate.key: {{
                      certificate_test_certs[__test_cert_name]['key_content'] |
                      b64encode }}
                    certificate.pem: {{
                      certificate_test_certs[__test_cert_name]['cert_content'] |
                      b64encode }}
                  kind: Secret
                  metadata:
                    name: envoy-certificates

        - name: Check quadlet files
          command: ls -alrtF /etc/containers/systemd
          changed_when: false

        - name: Check containers
          command: podman ps -a
          changed_when: false
          failed_when: false

        - name: Check volumes
          command: podman volume ls
          changed_when: false
          failed_when: false

        - name: Check pods
          command: podman pod ps --ctr-ids --ctr-names --ctr-status
          changed_when: false
          failed_when: false

        - name: Check systemd
        # noqa command-instead-of-module
          shell: set -euo pipefail; systemctl list-units | grep quadlet
          changed_when: false
          failed_when: false

        - name: Check web
          get_url:
            url: https://localhost:8000
            dest: /run/out
            mode: "0600"
            validate_certs: false
          register: __web_status
          until: __web_status is success
          retries: 6
          delay: 5

        - name: Show web
          command: cat /run/out
          changed_when: false
          when: __web_status is success

        - name: Error
          fail:
          when: __web_status is failed

      rescue:
        - name: Dump journal
          command: journalctl -ex
          changed_when: false
          failed_when: true

      always:
        - name: Check
          command: podman ps -a
          changed_when: false

        - name: Check pods
          command: podman pod ps --ctr-ids --ctr-names --ctr-status
          changed_when: false
          failed_when: false

        - name: Check systemd
        # noqa command-instead-of-module
          shell: >-
            set -euo pipefail;
            systemctl list-units --all | grep quadlet
          changed_when: false
          failed_when: false

        - name: LS
          command: ls -alrtF /etc/systemd/system
          changed_when: false
          failed_when: false

        - name: Cleanup
          block:
            - name: Cleanup
              include_role:
                name: fedora.linux_system_roles.podman
              vars:
                podman_prune_images: true
                __podman_test_debug: true
                __absent: {"state": "absent"}
                podman_quadlet_specs: "{{ __podman_quadlet_specs | reverse | map('combine', __absent) | list }}"
                podman_secrets:
                  - name: mysql-root-password-container
                    state: absent
                  - name: mysql-root-password-kube
                    state: absent
                  - name: envoy-certificates
                    state: absent

            - name: Ensure no resources
              assert:
                that:
                  - __podman_test_debug_images.stdout == ""
                  - __podman_test_debug_networks.stdout_lines | reject("match", "^podman$") | reject("match", "^podman-default-kube-network$") | list | length == 0
                  - __podman_test_debug_volumes.stdout == ""
                  - __podman_test_debug_containers.stdout == ""
                  - __podman_test_debug_secrets.stdout == ""
                  - ansible_facts["services"] | dict2items | rejectattr("value.status", "match", "not-found") | selectattr("key", "match", "quadlet-demo") | list | length == 0

          rescue:
            - name: Debug
              shell: |
                exec 1>&2
                set -x
                set -o pipefail
                systemctl list-units --plain -l --all | grep quadlet || :
                systemctl list-unit-files --all | grep quadlet || :
                systemctl list-units --plain --failed -l --all | grep quadlet || :
              changed_when: false

            - name: Get journald
              command: journalctl -ex
              changed_when: false
              failed_when: true
