---
- name: Подготовка всех узлов (Master и Workers)
  hosts: masters,workers
  become: true
  gather_facts: true
  tasks:
    - name: 0. Ожидание разблокировки APT
      shell: "while fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do sleep 5; done;"
      changed_when: false

    - name: 1. Ядерная очистка репозиториев (Fix APT)
      shell: "rm -f /etc/apt/sources.list.d/kubernetes.list /etc/apt/sources.list.d/*k8s*"
      changed_when: true

    - name: 2. Настройка APT (Force IPv4 и MTU)
      shell: |
        echo 'Acquire::ForceIPv4 "true";' > /etc/apt/apt.conf.d/99force-ipv4
        ip link set dev eth0 mtu 1442 || true
      changed_when: false

    - name: 3. Установка системных зависимостей
      apt:
        update_cache: yes
        name: [apt-transport-https, ca-certificates, curl, gnupg, qemu-guest-agent, socat, conntrack]
        state: present

    - name: 4. Модули ядра и Sysctl
      shell: |
        modprobe overlay
        modprobe br_netfilter
        echo -e "overlay\nbr_netfilter" > /etc/modules-load.d/k8s.conf
        cat <<EOF > /etc/sysctl.d/k8s.conf
        net.bridge.bridge-nf-call-iptables  = 1
        net.bridge.bridge-nf-call-ip6tables = 1
        net.ipv4.ip_forward                 = 1
        EOF
        sysctl --system
      changed_when: false

    - name: 5. Установка Containerd
      apt:
        name: containerd
        state: present

    - name: 6. Конфигурация Containerd (SystemdCgroup)
      shell: |
        mkdir -p /etc/containerd
        containerd config default > /etc/containerd/config.toml
        sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
        systemctl restart containerd
      changed_when: true

    - name: 7. Добавление ключа Kubernetes
      shell: |
        mkdir -p /etc/apt/keyrings
        curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.32/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg --yes
      register: key_res
      until: key_res is success
      retries: 5

    - name: 8. Настройка официального репозитория (Явная архитектура amd64)
      copy:
        dest: /etc/apt/sources.list.d/kubernetes.list
        # ВАЖНО: Добавили arch=amd64
        content: "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg arch=amd64] https://pkgs.k8s.io/core:/stable:/v1.32/deb/ /"

    - name: 9. Диагностика (Проверяем, видит ли APT пакеты)
      shell: "apt-get update && apt-cache policy kubeadm"
      register: apt_policy
      changed_when: false

    - name: 10. Вывод диагностики в лог Semaphore
      debug:
        var: apt_policy.stdout_lines

    - name: 11. Принудительная установка компонентов K8s
      shell: |
        apt-mark unhold kubelet kubeadm kubectl || true
        apt-get install -y --allow-change-held-packages kubelet kubeadm kubectl
        apt-mark hold kubelet kubeadm kubectl
      register: install_shell

    - name: 12. Проверка наличия бинарника (Final Check)
      shell: "ls -la /usr/bin/kubeadm"
      register: final_check
      failed_when: final_check.rc != 0

- name: Инициализация Master-ноды
  hosts: masters
  become: true
  tasks:
    - name: Kubeadm Init
      shell: "/usr/bin/kubeadm init --pod-network-cidr=10.244.0.0/16 --skip-phases=addon/kube-proxy"
      args:
        creates: /etc/kubernetes/admin.conf

    - name: Настройка конфига для ubuntu
      shell: |
        mkdir -p /home/ubuntu/.kube
        cp -f /etc/kubernetes/admin.conf /home/ubuntu/.kube/config
        chown ubuntu:ubuntu /home/ubuntu/.kube/config
      args:
        creates: /home/ubuntu/.kube/config

    - name: Генерация команды Join
      shell: "/usr/bin/kubeadm token create --print-join-command"
      register: join_command_raw

    - name: Сохранение факта Join
      set_fact:
        join_command: "{{ join_command_raw.stdout }}"

- name: Подключение Worker-нод
  hosts: workers
  become: true
  tasks:
    - name: Join к кластеру
      shell: "{{ hostvars[groups['masters'][0]]['join_command'] }}"
      args:
        creates: /etc/kubernetes/kubelet.conf

- name: Установка Cilium
  hosts: masters
  become: false
  tasks:
    - name: Cilium CLI и Install
      shell: |
        if [ ! -f /usr/local/bin/cilium ]; then
          curl -L --remote-name-all https://github.com/cilium/cilium-cli/releases/latest/download/cilium-linux-amd64.tar.gz
          sudo tar xzvf cilium-linux-amd64.tar.gz -C /usr/local/bin
          rm cilium-linux-amd64.tar.gz
        fi
        /usr/local/bin/cilium install --set kubeProxyReplacement=true
      ignore_errors: true