---

- include_tasks: update_meteringconfig_status.yml
  vars:
    current_conditions:
      type: "Running"
      status: "True"
      message: "Configuring Hive storage"
      lastTransitionTime: "{{ now(utc=False).isoformat() + 'Z' }}"

- name: Log event for configuring storage
  k8s_event:
    state: present
    name: metering-operator-configuring-storage
    namespace: "{{ meta.namespace }}"
    message: Configuring storage for the metering-ansible-operator
    reason: Started
    type: Normal
    source:
      component: metering-ansible-operator
    involvedObject:
      apiVersion: metering.openshift.io
      kind: MeteringConfig
      name: "{{ meta.name }}"
      namespace: "{{ meta.namespace }}"

#
# Configure S3 section
#
- name: Configure S3 Storage
  block:
    - name: Validate that the bucket and secret names are non-empty
      assert:
        that:
          - meteringconfig_storage_s3_bucket_name != ""
          - meteringconfig_storage_s3_bucket_region != ""
        msg: "storage.hive.s3.bucket and storage.hive.s3.secretName cannot be empty"

    - name: Validate that the bucket region is non-empty when createBucket is set to true
      assert:
        that:
          - meteringconfig_storage_s3_bucket_region != ""
        msg: "storage.hive.s3.region cannot be empty when storage.hive.s3.createBucket is true"
      when: meteringconfig_storage_s3_create_bucket

    - name: Attempt to obtain the AWS credentials secret in the "{{ meta.namespace}}" namespace
      k8s_info:
        api_version: v1
        kind: Secret
        name: "{{ meteringconfig_storage_s3_aws_credentials_secret_name }}"
        namespace: "{{ meta.namespace }}"
      no_log: true
      register: operator_s3_credentials_secret

    - name: Validate the AWS credentials secret exists in the "{{ meta.namespace }}" namespace
      assert:
        that:
          - s3_credentials_secret_exists
        msg: "storage.hive.s3.secret does not exist"

    - name: Create the Metering S3 bucket
      aws_s3:
        mode: create
        bucket: "{{ meteringconfig_storage_s3_bucket_name }}"
        region: "{{ meteringconfig_storage_s3_bucket_region }}"
        dualstack: "{{ s3_use_dualstack_endpoint }}"
        aws_access_key: "{{ operator_s3_credentials_secret.resources[0].data['aws-access-key-id'] | b64decode | default(omit) }}"
        aws_secret_key: "{{ operator_s3_credentials_secret.resources[0].data['aws-secret-access-key'] | b64decode | default(omit) }}"
      when: meteringconfig_storage_s3_create_bucket and s3_credentials_secret_exists
  rescue:
    - include_tasks: update_meteringconfig_status.yml
      vars:
        current_conditions:
          type: "Invalid"
          status: "True"
          message: |
            "{{ ansible_failed_result.msg }}"
          lastTransitionTime: "{{ now(utc=False).isoformat() + 'Z' }}"
        end_play_after_updating_status: true
      when:
      - ansible_failed_result is defined
      - ansible_failed_result.msg | length > 0
  vars:
    s3_credentials_secret_exists: "{{ operator_s3_credentials_secret.resources and operator_s3_credentials_secret.resources | length > 0 }}"
    s3_use_dualstack_endpoint: "{{ _ocp_enabled_use_ipv6_networking }}"
  when: meteringconfig_storage_hive_storage_type == 's3'

#
# Configure S3-compatible section
#
- name: Configure S3 Compatible Storage
  block:
    - name: Validate Metering s3Compatible bucket name
      assert:
        that:
          - meteringconfig_storage_s3Compatible_bucket_name != ""
        msg: "storage.hive.s3Compatible.bucket cannot be empty"

    - name: Validating nonempty endpoint
      assert:
        that:
          - meteringconfig_storage_s3Compatible_endpoint != ""
        msg: "storage.hive.s3Compatible.endpoint cannot be empty"

    - name: Validate if createSecret is true secretName is empty
      assert:
        that:
          - meteringconfig_storage_s3Compatible_credentials_secret_name == ""
        msg: "storage.hive.s3Compatible.secretName is only used to reference existing secrets, must be empty if creating new secrets"
      when: meteringconfig_storage_s3Compatible_create_secret

    - name: Validate if createSecret is false secretName is nonempty
      assert:
        that:
          - meteringconfig_storage_s3Compatible_credentials_secret_name != ""
        msg: "storage.hive.s3Compatible.secretName is used to reference existing secrets, must not be empty if creatSecret is set to false"
      when: not meteringconfig_storage_s3Compatible_create_secret
  rescue:
    - include_tasks: update_meteringconfig_status.yml
      vars:
        current_conditions:
          type: "Invalid"
          status: "True"
          message: |
            "{{ ansible_failed_result.msg }}"
          lastTransitionTime: "{{ now(utc=False).isoformat() + 'Z' }}"
        end_play_after_updating_status: true
      when:
      - ansible_failed_result is defined
      - ansible_failed_result.msg | length > 0
  when: meteringconfig_storage_hive_storage_type == 's3Compatible'

#
# Configure Azure section
#
- name: Get azure storage account name
  block:
    - name: Get Azure storage credentials secret
      k8s_info:
        api_version: v1
        kind: Secret
        name: "{{ meteringconfig_spec.storage.hive.azure.secretName }}"
        namespace: "{{ meta.namespace }}"
      register: azure_secret_buf

    - name: Verify azure storage credentials secret exists
      assert:
        that:
          - azure_secret_buf is defined and azure_secret_buf.resources | length > 0
          - azure_secret_buf.resources[0].data['azure-storage-account-name'] != ""
    - name: Extract Azure storage account name
      set_fact:
        _azure_secret_account_name: "{{ azure_secret_buf.resources[0].data['azure-storage-account-name'] | b64decode | default(omit)  }}"
  rescue:
    - include_tasks: update_meteringconfig_status.yml
      vars:
        current_conditions:
          type: "Invalid"
          status: "True"
          message: |
            "{{ ansible_failed_result.msg }}"
          lastTransitionTime: "{{ now(utc=False).isoformat() + 'Z' }}"
        end_play_after_updating_status: true
      when:
      - ansible_failed_result is defined
      - ansible_failed_result.msg | length > 0
  when: meteringconfig_storage_hive_storage_type == 'azure' and not meteringconfig_storage_azure_create_secret

- name: Configure Azure Storage
  block:
    - name: Validate Metering Azure container name
      assert:
        that:
          - meteringconfig_storage_azure_container_name != ""
          - meteringconfig_storage_azure_storage_account_name != ""
        msg: "storage.hive.azure.container and storage.hive.azure.storageAccountName cannot be empty"

    - name: Validate Metering Azure credentials
      assert:
        that:
          - meteringconfig_storage_azure_credentials_secret_name == ""
        msg: "storage.hive.azure.secretName is only used to reference existing secrets, must be empty if creating new secrets"
  rescue:
    - include_tasks: update_meteringconfig_status.yml
      vars:
        current_conditions:
          type: "Invalid"
          status: "True"
          message: |
            "{{ ansible_failed_result.msg }}"
          lastTransitionTime: "{{ now(utc=False).isoformat() + 'Z' }}"
        end_play_after_updating_status: true
      when:
      - ansible_failed_result is defined
      - ansible_failed_result.msg | length > 0
  when: meteringconfig_storage_hive_storage_type == 'azure' and meteringconfig_storage_azure_create_secret

#
# Configure GCS section
#
- name: Configure GCS Storage
  block:
    - name: Validate Metering gcs bucket name
      assert:
        that:
          - meteringconfig_storage_gcs_bucket_name != ""
        msg: "storage.hive.gcs.bucket cannot be empty"

    - name: Validate Metering gcs credentials
      assert:
        that:
          - meteringconfig_storage_gcs_credentials_secret_name == ""
        msg: "storage.hive.gcs.secretName is only used to reference existing secrets, must be empty if creating new secrets"
      when: meteringconfig_storage_gcs_create_secret

    - name: Validate Metering gcs credentials
      assert:
        that:
          - meteringconfig_storage_gcs_credentials_secret_name != ""
        msg: "storage.hive.gcs.secretName is used to reference existing secrets, must not be empty if creatSecret is set to false"
      when: not meteringconfig_storage_gcs_create_secret
  rescue:
    - include_tasks: update_meteringconfig_status.yml
      vars:
        current_conditions:
          type: "Invalid"
          status: "True"
          message: |
            "{{ ansible_failed_result.msg }}"
          lastTransitionTime: "{{ now(utc=False).isoformat() + 'Z' }}"
        end_play_after_updating_status: true
      when:
      - ansible_failed_result is defined
      - ansible_failed_result.msg | length > 0
  when: meteringconfig_storage_hive_storage_type == 'gcs'

- include_tasks: update_meteringconfig_status.yml
  vars:
    current_conditions:
      type: "Running"
      status: "True"
      message: "Finished configuring Hive storage"
      lastTransitionTime: "{{ now(utc=False).isoformat() + 'Z' }}"
