# get_federation_data.yml
- name: Fetch JSON content from webservers and generate federation config
  hosts: localhost
  connection: local
  gather_facts: false
  tasks:
    - name: set facts that would be set by CI for my local testing
      ansible.builtin.set_fact:
        cifmw_federation_keystone_OIDC_ProviderMetadataURL: "https://vakwetu.fedorapeople.org/testdata.yml"
        cifmw_federation_keystone_OIDC_ProviderMetadataURL2: "https://vakwetu.fedorapeople.org/testdata.yml"
        cifmw_federation_keystone_OIDC_ClientID: "client1"
        cifmw_federation_keystone_OIDC_ClientSecret: "clientsecret1"
        cifmw_federation_keystone_OIDC_ClientID2: "client2"
        cifmw_federation_keystone_OIDC_ClientSecret2: "clientsecret2"

    - name: Download realm1 OpenID configuration
      ansible.builtin.uri:
        url: "{{ cifmw_federation_keystone_OIDC_ProviderMetadataURL }}"
        method: GET
        return_content: true
        validate_certs: false
      register: openid_wellknown_config1

    - name: Download realm2 OpenID configuration
      ansible.builtin.uri:
        url: "{{ cifmw_federation_keystone_OIDC_ProviderMetadataURL2 }}"
        method: GET
        return_content: true
        validate_certs: false
      register: openid_wellknown_config2

    - name: set federation_config_items
      ansible.builtin.set_fact:
        federation_config_items:
          - filename: "keystone_idp1_conf_content" #replace by actual urlencoded filenames
            contents: |
              {
                "scope" : "openid email profile"
              }
          - filename: "keystone_idp1_client_content"
            contents: |
              {
                "client_id":"{{ cifmw_federation_keystone_OIDC_ClientID }}",
                "client_secret":"{{ cifmw_federation_keystone_OIDC_ClientSecret }}"
              }
          - filename: "keystone_idp1_provider_content"
            contents: |
              {{ openid_wellknown_config1.content }}
          - filename: "keystone_idp2_conf_content"
            contents: |
              {
                "scope" : "openid email profile"
              }
          - filename: "keystone_idp2_client_content"
            contents: |
              {
                "client_id":"{{ cifmw_federation_keystone_OIDC_ClientID2 }}",
                "client_secret":"{{ cifmw_federation_keystone_OIDC_ClientSecret2 }}"
              }
          - filename: "keystone_idp2_provider_content"
            contents: |
              {{ openid_wellknown_config2.content }}

    - name: Generate the final federation_config.json string (as a dictionary)
      ansible.builtin.set_fact:
        _raw_federation_config_json_value: |
          {
          {% for item in federation_config_items %}
            "{{ item.filename }}": {{ item.contents }}{% if not loop.last %},{% endif %}
          {% endfor %}
          }

    # IMPORTANT FIX: Apply `to_json` one final time to the _raw_federation_config_json_value
    # to ensure it's a single, valid JSON string for stringData.
    - name: Final JSON string for Secret stringData
      ansible.builtin.set_fact:
        federation_config_json_string: "{{ _raw_federation_config_json_value | to_json }}"


    - name: Print the generated JSON string for verification
      ansible.builtin.debug:
        var: federation_config_json_string

    - name: Create a Kubernetes Secret with this data
      kubernetes.core.k8s:
        state: present
        definition:
          apiVersion: v1
          kind: Secret
          type: Opaque
          metadata:
            name: my-federation-realm-data
            namespace: openstack
          stringData:
            federation_config.json: "{{ federation_config_json_string }}"
