fix: CRD에서 직접 ClusterSecretStore served 버전 조회

api-versions는 API 그룹 전체 버전을 반환하므로
ClusterSecretStore와 무관한 v1alpha1(generators용)이 선택되는 문제.
CRD spec.versions[served==true]에서 정확한 버전을 가져오도록 수정.

Author: WAFriend3416

IaC/3-v3/ansible/roles/external-secrets/tasks/main.yml

@@ -47,16 +47,17 @@
     --timeout=60s
   changed_when: false
 
-- name: Detect ESO API version
+- name: Get ClusterSecretStore served API version from CRD
   shell: |
-    kubectl --kubeconfig=/home/ubuntu/.kube/config api-versions | grep '^external-secrets.io/v' | sort -rV | head -1
-  register: eso_api_version
+    kubectl --kubeconfig=/home/ubuntu/.kube/config get crd clustersecretstores.external-secrets.io \
+      -o jsonpath='{.spec.versions[?(@.served==true)].name}' | tr ' ' '\n' | sort -rV | head -1
+  register: css_api_version
   changed_when: false
 
 - name: Apply ClusterSecretStore
   shell: |
     cat <<'EOF' | kubectl --kubeconfig=/home/ubuntu/.kube/config apply -f -
-    apiVersion: {{ eso_api_version.stdout | default('external-secrets.io/v1beta1') }}
+    apiVersion: external-secrets.io/{{ css_api_version.stdout }}
     kind: ClusterSecretStore
     metadata:
       name: aws-secrets-manager
@@ -67,4 +68,4 @@
           region: ap-northeast-2
     EOF
   register: css_apply
-  changed_when: "'configured' in css_apply.stdout or 'created' in css_apply.stdout"
+  changed_when: false