Packer.Images/ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/metacluster/tasks/init.yml

- name: Configure fallback name resolution
  ansible.builtin.lineinfile:
    path: /etc/hosts
    line: "{{ vapp['guestinfo.ipaddress'] }}  {{ item ~ '.' ~ vapp['metacluster.fqdn'] }}"
    state: present
  loop:
    # TODO: Make this list dynamic
    - ca
    - git
    - gitops
    - ingress
    - registry
    - storage

- name: Initialize tempfile
  ansible.builtin.tempfile:
    state: file
  register: stepca_password

- name: Store password in tempfile
  ansible.builtin.copy:
    dest: "{{ stepca_password.path }}"
    content: "{{ vapp['metacluster.password'] }}"
  no_log: true

- name: Generate root CA
  ansible.builtin.shell:
    cmd: >-
      step ca init \
        --helm \
        --deployment-type=standalone \
        --name=ca.{{ vapp['metacluster.fqdn'] }} \
        --dns=ca.{{ vapp['metacluster.fqdn'] }} \
        --dns=step-certificates.step-ca.svc.cluster.local \
        --dns=127.0.0.1 \
        --address=:9000 \
        --provisioner=admin \
        --acme \
        --password-file={{ stepca_password.path }}
  register: stepca_values

- name: Cleanup tempfile
  ansible.builtin.file:
    path: "{{ stepca_password.path }}"
    state: absent
  when: stepca_password.path is defined

- name: Store root CA certificate
  ansible.builtin.copy:
    dest: /usr/local/share/ca-certificates/root_ca.crt
    content: "{{ (stepca_values.stdout | from_yaml).inject.certificates.root_ca }}"

- name: Update certificate truststore
  ansible.builtin.command:
    cmd: update-ca-certificates