---
- name: Verify the owned K3s CNI paths before installing the mesh
  hosts: devbox
  become: true
  gather_facts: false
  tasks:
    - name: Read the Flannel CNI directories
      ansible.builtin.stat:
        path: '{{ item }}'
      loop:
        - '{{ istio_cni_bin_dir | default("/var/lib/pharos-metallo/k3s/data/cni") }}'
        - '{{ istio_cni_conf_dir | default("/var/lib/pharos-metallo/k3s/agent/etc/cni/net.d") }}/10-flannel.conflist'
      register: istio_cni_paths

    - name: Require the existing K3s Flannel configuration
      ansible.builtin.assert:
        that: istio_cni_paths.results | map(attribute='stat.exists') | list == [true, true]

    - name: Read the actual containerd CNI binary directories
      ansible.builtin.command:
        argv:
          - /usr/bin/python3
          - -c
          - >-
            import json,tomllib,sys;
            data=tomllib.load(open(sys.argv[1],'rb'));
            cnis=[value['cni'] for value in data['plugins'].values() if 'cni' in value];
            print(json.dumps([path for cni in cnis for path in cni.get('bin_dirs',[cni.get('bin_dir')])]))
          - '{{ istio_k3s_data_path | default("/var/lib/pharos-metallo/k3s") }}/agent/etc/containerd/config.toml'
      register: istio_runtime_cni
      changed_when: false

    - name: Refuse an installation outside the runtime's CNI search path
      ansible.builtin.assert:
        that: istio_runtime_cni.stdout | from_json == [istio_cni_bin_dir | default('/var/lib/pharos-metallo/k3s/data/cni')]

    - name: Read host inotify capacity shared by the cluster's root processes
      ansible.builtin.command:
        argv: [sysctl, -n, '{{ item }}']
      loop: [fs.inotify.max_user_instances, fs.inotify.max_user_watches]
      register: istio_inotify
      changed_when: false

    - name: Persist mesh watcher capacity without lowering an existing larger limit
      ansible.builtin.copy:
        dest: /etc/sysctl.d/90-pharos-mesh.conf
        owner: root
        group: root
        mode: '0644'
        content: |
          # Istio CNI shares root's inotify budget with K3s and Ceph CSI.
          fs.inotify.max_user_instances={{ [istio_inotify.results[0].stdout | int, 1024] | max }}
          fs.inotify.max_user_watches={{ [istio_inotify.results[1].stdout | int, 524288] | max }}
      register: istio_inotify_configuration
      changed_when: >-
        istio_inotify_configuration.changed
        or istio_inotify.results[0].stdout | int < 1024
        or istio_inotify.results[1].stdout | int < 524288
      notify: Apply the owned mesh watcher configuration
  handlers:
    - name: Apply the owned mesh watcher configuration
      ansible.builtin.command: sysctl --load /etc/sysctl.d/90-pharos-mesh.conf
      changed_when: true

- name: Install the pinned mesh through the controller's private API tunnel
  hosts: mesh_controller
  gather_facts: false
  roles:
    # An explicit path resolves under either of the repository's Ansible configurations.
    - role: '{{ playbook_dir }}/../roles/istio'  # noqa role-name[path]