---
- name: Check etcd certs
  include_tasks: check_certs.yml
  when: cert_management == "script"
  tags:
    - etcd-secrets
    - facts

- name: Generate etcd certs
  include_tasks: "gen_certs_script.yml"
  when:
    - cert_management | d('script') == "script"
  tags:
    - etcd-secrets

- name: Trust etcd CA
  include_tasks: upd_ca_trust.yml
  when:
    - inventory_hostname in groups['etcd'] | union(groups['kube_control_plane']) | unique | sort
  tags:
    - etcd-secrets

- name: Trust etcd CA on nodes if needed
  include_tasks: upd_ca_trust.yml
  when:
    - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally | default(false) | bool
    - kube_network_plugin != "calico" or calico_datastore == "etcd"
    - inventory_hostname in groups['k8s_cluster']
  tags:
    - etcd-secrets

- name: "Gen_certs | Get etcd certificate serials"
  command: "openssl x509 -in {{ etcd_cert_dir }}/node-{{ inventory_hostname }}.pem -noout -serial"
  register: "etcd_client_cert_serial_result"
  changed_when: false
  check_mode: no
  when:
    - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally | default(false) | bool
    - kube_network_plugin != "calico" or calico_datastore == "etcd"
    - inventory_hostname in groups['k8s_cluster']
  tags:
    - master
    - network

- name: Set etcd_client_cert_serial
  set_fact:
    etcd_client_cert_serial: "{{ etcd_client_cert_serial_result.stdout.split('=')[1] }}"
  when:
    - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally | default(false) | bool
    - kube_network_plugin != "calico" or calico_datastore == "etcd"
    - inventory_hostname in groups['k8s_cluster']
  tags:
    - master
    - network

- name: Install etcd
  include_tasks: "install_{{ etcd_deployment_type }}.yml"
  when: is_etcd_master
  tags:
    - upgrade

- name: Configure etcd
  include_tasks: configure.yml
  when: is_etcd_master

- name: Refresh etcd config
  include_tasks: refresh_config.yml
  when: is_etcd_master

- name: Restart etcd if certs changed
  command: /bin/true
  notify: Restart etcd
  when: is_etcd_master and etcd_cluster_setup and etcd_secret_changed | default(false)

- name: Restart etcd-events if certs changed
  command: /bin/true
  notify: Restart etcd
  when: is_etcd_master and etcd_events_cluster_setup and etcd_secret_changed | default(false)

# After etcd cluster is assembled, make sure that
# initial state of the cluster is in `existing`
# state instead of `new`.
- name: Refresh etcd config again for idempotency
  include_tasks: refresh_config.yml
  when: is_etcd_master