---
- name: Check if Cilium CLI has already been Installed.
  stat:
    path: /usr/local/bin/cilium
  register: cilium_init_stat
  when:
    - kubernetes_pod_network.cni == 'cilium'

- name: Install Cilium CLI
  when:
    - kubernetes_pod_network.cni == 'cilium'
    - not cilium_init_stat.stat.exists
  block:
    - name: Get Cilium CLI version
      shell: curl -s https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt
      register: cilium_cli_version
      changed_when: false

    - name: Set CLI architecture
      set_fact:
        cli_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}"

    - name: Download Cilium CLI
      get_url:
        url: "https://github.com/cilium/cilium-cli/releases/download/{{ cilium_cli_version.stdout }}/cilium-linux-{{ cli_arch }}.tar.gz"
        dest: "/tmp/cilium-linux-{{ cli_arch }}.tar.gz"
        mode: '0644'

    - name: Download Cilium CLI checksum
      get_url:
        url: "https://github.com/cilium/cilium-cli/releases/download/{{ cilium_cli_version.stdout }}/cilium-linux-{{ cli_arch }}.tar.gz.sha256sum"
        dest: "/tmp/cilium-linux-{{ cli_arch }}.tar.gz.sha256sum"
        mode: '0644'

    - name: Verify Cilium CLI checksum
      shell: sha256sum --check /tmp/cilium-linux-{{ cli_arch }}.tar.gz.sha256sum
      args:
        chdir: /tmp

    - name: Extract Cilium CLI
      unarchive:
        src: "/tmp/cilium-linux-{{ cli_arch }}.tar.gz"
        dest: /usr/local/bin
        remote_src: true

    - name: Remove downloaded files
      file:
        path: "/tmp/cilium-linux-{{ cli_arch }}.tar.gz{{ item }}"
        state: absent
      loop:
        - ''
        - '.sha256sum'