---
- name: Wait for the sandbox SPIRE token reviewer credential
  ansible.builtin.command:
    argv:
      - k3s
      - kubectl
      - --namespace
      - "{{ sandbox_spire_bootstrap_source_namespace }}"
      - get
      - secret
      - "{{ sandbox_spire_bootstrap_source_secret }}"
      - --output=json
  register: sandbox_spire_bootstrap_reviewer_secret
  changed_when: false
  retries: 60
  delay: 10
  until:
    - sandbox_spire_bootstrap_reviewer_secret.rc == 0
    - (sandbox_spire_bootstrap_reviewer_secret.stdout | from_json).data.token is defined
    - (sandbox_spire_bootstrap_reviewer_secret.stdout | from_json).data['ca.crt'] is defined
  no_log: true

- name: Wait for the sandbox SPIRE controller credential
  ansible.builtin.command:
    argv:
      - k3s
      - kubectl
      - --namespace
      - "{{ sandbox_spire_bootstrap_source_namespace }}"
      - get
      - secret
      - "{{ sandbox_spire_bootstrap_controller_secret }}"
      - --output=json
  register: sandbox_spire_bootstrap_controller_secret_result
  changed_when: false
  retries: 60
  delay: 10
  until:
    - sandbox_spire_bootstrap_controller_secret_result.rc == 0
    - (sandbox_spire_bootstrap_controller_secret_result.stdout | from_json).data.token is defined
    - (sandbox_spire_bootstrap_controller_secret_result.stdout | from_json).data['ca.crt'] is defined
  no_log: true

- name: Extract the sandbox TokenReview credential data
  ansible.builtin.set_fact:
    sandbox_spire_bootstrap_secret_data: >-
      {{ (sandbox_spire_bootstrap_reviewer_secret.stdout | from_json).data }}
    sandbox_spire_bootstrap_controller_data: >-
      {{ (sandbox_spire_bootstrap_controller_secret_result.stdout | from_json).data }}
  no_log: true

- name: Build the restricted sandbox TokenReview kubeconfig
  ansible.builtin.set_fact:
    sandbox_spire_bootstrap_kubeconfig: |
      apiVersion: v1
      kind: Config
      clusters:
        - name: sandbox
          cluster:
            server: {{ sandbox_spire_bootstrap_api_server }}
            certificate-authority-data: {{ sandbox_spire_bootstrap_secret_data['ca.crt'] }}
      users:
        - name: spire-server-token-reviewer
          user:
            token: {{ sandbox_spire_bootstrap_secret_data.token | b64decode }}
      contexts:
        - name: sandbox
          context:
            cluster: sandbox
            user: spire-server-token-reviewer
      current-context: sandbox
    sandbox_spire_bootstrap_controller_kubeconfig: |
      apiVersion: v1
      kind: Config
      clusters:
        - name: sandbox
          cluster:
            server: {{ sandbox_spire_bootstrap_api_server }}
            certificate-authority-data: {{ sandbox_spire_bootstrap_controller_data['ca.crt'] }}
      users:
        - name: spire-controller-manager
          user:
            token: {{ sandbox_spire_bootstrap_controller_data.token | b64decode }}
      contexts:
        - name: sandbox
          context:
            cluster: sandbox
            user: spire-controller-manager
      current-context: sandbox
  no_log: true

- name: Reconcile the central SPIRE external kubeconfig Secret
  ansible.builtin.command:
    argv:
      - k3s
      - kubectl
      - apply
      - --filename=-
    stdin: |
      apiVersion: v1
      kind: Secret
      metadata:
        name: {{ sandbox_spire_bootstrap_target_secret }}
        namespace: {{ sandbox_spire_bootstrap_target_namespace }}
      type: Opaque
      data:
        sandbox: {{ sandbox_spire_bootstrap_kubeconfig | b64encode }}
        sandbox-controller: {{ sandbox_spire_bootstrap_controller_kubeconfig | b64encode }}
  delegate_to: localhost
  become: true
  register: sandbox_spire_bootstrap_target
  changed_when: >-
    ' created' in sandbox_spire_bootstrap_target.stdout or
    ' configured' in sandbox_spire_bootstrap_target.stdout
  no_log: true