---

#
# Validate user-provided Presto TLS configuration when top-level spec.tls.enabled is set to false
#
- name: Validate the user-provided Presto TLS configuration
  block:
  - include_tasks: validate_presto_tls.yml
  rescue:
  - include_tasks: update_meteringconfig_status.yml
    vars:
      end_play_after_updating_status: true
      current_conditions:
        type: "Invalid"
        status: "True"
        message: |
          "{{ ansible_failed_result.msg }}"
        lastTransitionTime: "{{ now(utc=False).isoformat() + 'Z' }}"
    when:
    - ansible_failed_result is defined
    - ansible_failed_result.msg | length > 0
  when: not meteringconfig_tls_enabled

#
# Check for Presto TLS and auth secret existence (to avoid re-generating/overwriting the secret data if that secret name already exists)
#
- name: Check for the existence of Presto TLS-related secrets
  block:
  - name: Check for the existence of the Presto TLS secret
    k8s_info:
      api_version: v1
      kind: Secret
      name: "{{ meteringconfig_spec.presto.spec.config.tls.secretName }}"
      namespace: "{{ meta.namespace }}"
    no_log: true
    register: presto_secret_tls_buf

  - name: Check for the existence of the Presto Auth secret
    k8s_info:
      api_version: v1
      kind: Secret
      name: "{{ meteringconfig_spec.presto.spec.config.auth.secretName }}"
      namespace: "{{ meta.namespace }}"
    no_log: true
    register: presto_secret_auth_buf

  - name: Check for the existence of the Presto-Hive client TLS secret
    k8s_info:
      api_version: v1
      kind: Secret
      name: "{{ meteringconfig_spec.presto.spec.config.connectors.hive.tls.secretName }}"
      namespace: "{{ meta.namespace }}"
    no_log: true
    register: presto_hive_secret_tls_buf

  - name: Configure Presto to use the existing server TLS secret data
    set_fact:
      _meteringconfig_presto_server_ca_certificate: "{{ _meteringconfig_tls_root_ca_certificate }}"
      _meteringconfig_presto_server_certificate: "{{ presto_secret_tls_buf.resources[0].data['tls.crt'] | b64decode }}"
      _meteringconfig_presto_server_key: "{{ presto_secret_tls_buf.resources[0].data['tls.key'] | b64decode }}"
    no_log: true
    when: presto_tls_secret_exists

  - name: Configure Presto to use the existing client TLS secret data
    set_fact:
      _meteringconfig_presto_client_ca_certificate: "{{ _meteringconfig_tls_root_ca_certificate }}"
      _meteringconfig_presto_client_certificate: "{{ presto_secret_auth_buf.resources[0].data['tls.crt'] | b64decode }}"
      _meteringconfig_presto_client_key: "{{ presto_secret_auth_buf.resources[0].data['tls.key'] | b64decode }}"
    no_log: true
    when: presto_auth_secret_exists

  - name: Configure Presto/Hive to use the existing Presto client TLS secret data
    set_fact:
      _meteringconfig_presto_hive_client_ca_certificate: "{{ _meteringconfig_tls_root_ca_certificate }}"
      _meteringconfig_presto_hive_client_certificate: "{{ presto_hive_secret_tls_buf.resources[0].data['tls.crt'] | b64decode }}"
      _meteringconfig_presto_hive_client_key: "{{ presto_hive_secret_tls_buf.resources[0].data['tls.key'] | b64decode }}"
    no_log: true
    when: presto_hive_tls_secret_exists
  vars:
    presto_tls_secret_exists: "{{ presto_secret_tls_buf.resources and presto_secret_tls_buf.resources | length > 0 }}"
    presto_auth_secret_exists: "{{ presto_secret_auth_buf.resources and presto_secret_auth_buf.resources | length > 0 }}"
    presto_hive_tls_secret_exists: "{{ presto_hive_secret_tls_buf.resources is defined and presto_hive_secret_tls_buf.resources | length > 0 }}"
  when: meteringconfig_tls_enabled

#
# Generate server and client certificates for Presto (as needed) using the Ansible OpenSSL modules when top-level spec.tls.enabled is set to true
#
- name: Configure TLS and client-side authentication for Presto and Presto connectors
  block:
  - name: Generate Presto server and client TLS certificates and keys
    include_tasks: configure_presto_openssl.yml

  - name: Configure Presto to use generated server certificate and key
    set_fact:
      # presto.spec.config.tls
      _meteringconfig_presto_server_ca_certificate: "{{ _meteringconfig_tls_root_ca_certificate }}"
      _meteringconfig_presto_server_certificate: "{{ lookup('file', '{{ certificates_dir.path }}/presto_server.crt') + '\n' }}"
      _meteringconfig_presto_server_key: "{{ lookup('file', '{{ certificates_dir.path }}/presto_server.key') + '\n' }}"
    no_log: true
    when: not presto_tls_secret_exists

  - name: Configure Presto to use the generated client certificate and key
    set_fact:
      # presto.spec.config.auth
      _meteringconfig_presto_client_ca_certificate: "{{ _meteringconfig_tls_root_ca_certificate }}"
      _meteringconfig_presto_client_certificate: "{{ lookup('file', '{{ certificates_dir.path }}/presto_client.crt') + '\n' }}"
      _meteringconfig_presto_client_key: "{{ lookup('file', '{{ certificates_dir.path }}/presto_client.key') + '\n' }}"
    no_log: true
    when: not presto_auth_secret_exists

  - name: Configure Presto/Hive to use the generated Presto client certificate and key
    set_fact:
      # presto.spec.connectors.hive.tls
      _meteringconfig_presto_hive_client_ca_certificate: "{{ _meteringconfig_tls_root_ca_certificate }}"
      _meteringconfig_presto_hive_client_certificate: "{{ lookup('file', '{{ certificates_dir.path }}/presto_client.crt') + '\n' }}"
      _meteringconfig_presto_hive_client_key: "{{ lookup('file', '{{ certificates_dir.path }}/presto_client.key') + '\n' }}"
    no_log: true
    when: not presto_hive_tls_secret_exists
  vars:
    presto_tls_secret_exists: "{{ presto_secret_tls_buf.resources is defined and presto_secret_tls_buf.resources | length > 0 }}"
    presto_auth_secret_exists: "{{ presto_secret_auth_buf.resources is defined and presto_secret_auth_buf.resources | length > 0 }}"
    presto_hive_tls_secret_exists: "{{ presto_hive_secret_tls_buf.resources is defined and presto_hive_secret_tls_buf.resources | length > 0 }}"
  when: meteringconfig_tls_enabled and (not presto_tls_secret_exists or not presto_auth_secret_exists or not presto_hive_tls_secret_exists)
