---
- name: Probe environment inside AWX EE
  hosts: localhost
  connection: local
  gather_facts: no
  tasks:
    - name: Who am I and where
      ansible.builtin.shell: |
        echo "=== whoami ===";        id
        echo "=== hostname ===";      hostname
        echo "=== os-release ===";    cat /etc/os-release 2>/dev/null
        echo "=== cgroup ===";        cat /proc/1/cgroup 2>/dev/null
        echo "=== pid1 cmdline ===";  tr '\0' ' ' < /proc/1/cmdline; echo
        echo "=== /etc/hosts ===";    cat /etc/hosts
        echo "=== resolv.conf ===";   cat /etc/resolv.conf
        echo "=== env kube ===";      env | grep -i -E 'kube|k8s|runner' || true
      args: { executable: /bin/sh }
      register: env_info
      failed_when: false

    - ansible.builtin.debug: { var: env_info.stdout_lines }

    - name: Check service account & kubeconfig
      ansible.builtin.shell: |
        echo "=== /var/run/secrets/kubernetes.io ==="
        ls -la /var/run/secrets/kubernetes.io/serviceaccount/ 2>&1 || true
        echo "=== ~/.kube ==="
        ls -la ~/.kube 2>&1 || true
        echo "=== /etc/rancher ==="
        ls -la /etc/rancher 2>&1 || true
        echo "=== /root/.kube ==="
        ls -la /root/.kube 2>&1 || true
        echo "=== find kubeconfig ==="
        find / -maxdepth 4 -name 'kubeconfig*' -o -name '*.kubeconfig' 2>/dev/null | head
      args: { executable: /bin/sh }
      register: kube_files
      failed_when: false

    - ansible.builtin.debug: { var: kube_files.stdout_lines }

    - name: Available tools
      ansible.builtin.shell: |
        for t in kubectl oc curl wget python3 python perl nc socat nsenter docker podman crictl; do
          p=$(command -v $t 2>/dev/null)
          echo "$t -> ${p:-NOT FOUND}"
        done
        echo "=== PATH ==="
        echo $PATH
      args: { executable: /bin/sh }
      register: tools
      failed_when: false

    - ansible.builtin.debug: { var: tools.stdout_lines }

    - name: Try k8s API via service account (if token exists)
      ansible.builtin.shell: |
        SA=/var/run/secrets/kubernetes.io/serviceaccount
        if [ -f $SA/token ]; then
          TOKEN=$(cat $SA/token)
          CACERT=$SA/ca.crt
          API="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}"
          echo "API=$API"
          echo "--- /version ---"
          curl -s --cacert $CACERT -H "Authorization: Bearer $TOKEN" $API/version || true
          echo
          echo "--- /api/v1/namespaces/default/pods ---"
          curl -s --cacert $CACERT -H "Authorization: Bearer $TOKEN" \
            "$API/api/v1/namespaces/default/pods?limit=5" | head -c 800 || true
          echo
          echo "--- can-i create pods? ---"
          curl -s --cacert $CACERT -H "Authorization: Bearer $TOKEN" \
            -H "Content-Type: application/json" \
            -X POST "$API/apis/authorization.k8s.io/v1/selfsubjectaccessreviews" \
            -d '{"apiVersion":"authorization.k8s.io/v1","kind":"SelfSubjectAccessReview","spec":{"resourceAttributes":{"verb":"create","resource":"pods"}}}' || true
          echo
        else
          echo "No service account token found"
        fi
      args: { executable: /bin/sh }
      register: api_probe
      failed_when: false

    - ansible.builtin.debug: { var: api_probe.stdout_lines }

    - name: Check for awx-ee specific paths and k8s hints
      ansible.builtin.shell: |
        echo "=== mounts ==="
        mount 2>/dev/null | head -20
        echo "=== /run/secrets ==="
        ls -la /run/secrets 2>/dev/null || true
        echo "=== /var/run ==="
        ls -la /var/run 2>/dev/null | head
      args: { executable: /bin/sh }
      register: mounts
      failed_when: false

    - ansible.builtin.debug: { var: mounts.stdout_lines }