---
# Start / Stop Logic for OCP 4 Clusters

- import_playbook: ../../setup_runtime.yml

- name: Build inventory
  hosts: localhost
  connection: local
  gather_facts: false
  become: false
  tasks:
    - when: cloud_provider == 'ec2'
      block:
      - name: Run infra-ec2-create-inventory Role
        include_role:
          name: infra-ec2-create-inventory

      - name: Run Common SSH Config Generator Role
        include_role:
          name: infra-common-ssh-config-generate
        when: "'bastions' in groups"

- name: Set ansible_ssh_extra_args
  hosts:
    - all:!windows:!network
  gather_facts: false
  any_errors_fatal: true
  ignore_errors: false
  tasks:
    - name: Set facts for remote access
      set_fact:
        ansible_ssh_extra_args: >-
          {{ ansible_ssh_extra_args|d() }}
          -F {{hostvars.localhost.output_dir}}/{{ env_type }}_{{ guid }}_ssh_conf

- name: Run stop/start/status/... actions
  hosts: localhost
  connection: local
  gather_facts: False
  become: no
  tasks:
  - name: Check for project_tag
    when: project_tag is not defined or project_tag == ''
    fail:
      msg: "project_tag is not defined"

  - name: Check for ACTION
    when: ACTION is not defined
    fail:
      msg: "ACTION is not defined"

  - name: Start / Stop VMs on AWS
    when:
      - cloud_provider == 'ec2'
      - guid is defined
      - guid != ''
      - guid != '*'
    environment:
      AWS_ACCESS_KEY_ID: "{{aws_access_key_id}}"
      AWS_SECRET_ACCESS_KEY: "{{aws_secret_access_key}}"
      AWS_DEFAULT_REGION: "{{aws_region_final|d(aws_region)}}"
    block:
    - name: Stop instances by (guid,env_type) tags
      when: ACTION == 'stop'
      ec2_instance:
        state: stopped
        wait: "{{ aws_instance_wait_for_stop | default(false) }}"
        filters:
          "tag:guid": "{{ guid }}"
          "tag:env_type": "{{ env_type }}"
          instance-state-name: running

    - name: Start instances by (guid, env_type) tags
      when: ACTION == 'start'
      ec2_instance:
        state: started
        wait: true
        filters:
          "tag:guid": "{{ guid }}"
          "tag:env_type": "{{ env_type }}"
          instance-state-name: stopped
    - when: ACTION == 'status'
      block:
        - name: Get EC2 facts using (guid, env_type) tag
          ec2_instance_facts:
            filters:
              "tag:guid": "{{ guid }}"
              "tag:env_type": "{{ env_type }}"
          register: r_instances

        - name: Print status information to a file
          template:
            dest: "{{ output_dir }}/status.txt"
            src: files/status.j2

- name: Run recover cluster actions
  hosts: bastions
  run_once: true
  become: false
  gather_facts: false
  tasks:
  - name: Set Ansible Python interpreter to k8s virtualenv
    set_fact:
      ansible_python_interpreter: /opt/virtualenvs/k8s/bin/python

  - name: Recover cluster if it missed cert rotation
    when: ACTION == 'start'
    block:
    - name: Wait (default 3m) for Nodes to settle and pods to start
      pause:
        seconds: "{{ lifecycle_start_pause | default(180) }}"

    - name: Get CSRs that need to be approved
      k8s_facts:
        api_version: certificates.k8s.io/v1beta1
        kind: CertificateSigningRequest
        # Field selectors don't seem to work
        # field_selectors:
        # - status.conditions[0].type="Pending"
      register: r_csrs

    - name: Approve all Pending CSRs
      when: r_csrs.resources | length > 0
      command: "oc adm certificate approve {{ item.metadata.name }}"
      loop: "{{ r_csrs.resources }}"

    # TODO: Implement proper loop to watch for incoming CSRS while we are
    # approving them. For now, this is a workaround, just wait and re-approve.
    - name: Wait 10s for additional CSRs to appear
      pause:
        seconds: 10

    - name: Get additional CSRs that need to be approved
      k8s_facts:
        api_version: certificates.k8s.io/v1beta1
        kind: CertificateSigningRequest
        # Field selectors don't seem to work
        # field_selectors:
        # - status.conditions[0].type = "Pending"
      register: r_new_csrs

    - name: Approve all additional Pending CSRs
      when: r_new_csrs.resources | length > 0
      command: "oc adm certificate approve {{ item.metadata.name }}"
      loop: "{{ r_new_csrs.resources }}"