---
- name: fail if kubernetes_network_plugin_variant is set to with-kube-router
  run_once: yes
  assert:
    msg: Unfortunately using kube-router together with kubeguard does not work at the moment!
    that: "kubernetes_network_plugin_variant != 'with-kube-router'"

- name: make sure kubernetes_network_plugin_replaces_kube_proxy is not set
  when:
  - "kubernetes_network_plugin_variant != 'with-kube-router'"
  run_once: yes
  assert:
    msg: "kubeguard variant '{{ kubernetes_network_plugin_variant }}' can not replace kube-proxy, please set kubernetes_network_plugin_replaces_kube_proxy to false or configure a differnt kubernetes_network_plugin_variant."
    that: not kubernetes_network_plugin_replaces_kube_proxy


- name: install wireguard
  import_role:
    name: wireguard/base

- name: create network config directory
  file:
    name: /var/lib/kubeguard/
    state: directory

- name: install ifupdown script
  template:
    src: net_kubeguard/ifupdown.sh.j2
    dest: /var/lib/kubeguard/ifupdown.sh
    mode: 0755
  # TODO: notify reload... this is unfortunately already to late because
  #                        it must probably be brought down by the old version of the script

- name: generate wireguard private key
  shell: "umask 077; wg genkey > /var/lib/kubeguard/kubeguard-wg0.privatekey"
  args:
    creates: /var/lib/kubeguard/kubeguard-wg0.privatekey

- name: fetch wireguard public key
  shell: "wg pubkey < /var/lib/kubeguard/kubeguard-wg0.privatekey"
  register: kubeguard_wireguard_pubkey
  changed_when: false
  check_mode: no

- name: install systemd service unit for network interface
  template:
    src: net_kubeguard/interface.service.j2
    dest: /etc/systemd/system/kubeguard-interface.service
  # TODO: notify: reload???

- name: make sure kubeguard interface service is started and enabled
  systemd:
    daemon_reload: yes
    name: kubeguard-interface.service
    state: started
    enabled: yes

- name: install systemd units for every kubeguard peer
  loop: "{{ groups['_kubernetes_nodes_'] | difference(inventory_hostname) }}"
  loop_control:
    loop_var: peer
  template:
    src: net_kubeguard/peer.service.j2
    dest: "/etc/systemd/system/kubeguard-peer-{{ peer }}.service"
  # TODO: notify restart for peers that change...

- name: make sure kubeguard peer services are started and enabled
  loop: "{{ groups['_kubernetes_nodes_'] | difference(inventory_hostname) }}"
  systemd:
    daemon_reload: yes
    name: "kubeguard-peer-{{ item }}.service"
    state: started
    enabled: yes

- name: enable IPv4 forwarding
  sysctl:
    name: net.ipv4.ip_forward
    value: '1'
    sysctl_set: yes
    state: present
    reload: yes

- name: create cni config directory
  file:
    name: /etc/cni/net.d
    state: directory

- name: install cni config
  template:
    src: net_kubeguard/cni.json.j2
    dest: /etc/cni/net.d/kubeguard.json

- name: install packages needed for debugging kube-router
  when: kubernetes_network_plugin_variant == 'with-kube-router'
  apt:
    name:
    - iptables
    - ipvsadm
    - ipset
    state: present