Add OPA and Openshift AI

playbooks/deploy_opa.yml

@@ -0,0 +1,49 @@
+---
+# Deploy an Open Policy Agent server on OpenShift and wire it into AAP's
+# policy enforcement (policy as code).
+#
+# Authenticates via the aap-deployer ServiceAccount token used by deploy_aap.yml
+# (same cluster). The token is stored in 1Password as vault_aap_deployer_token.
+#
+# Prerequisites:
+#   - AAP deployed (deploy_aap.yml) and aap_gateway_url set for the aap host
+#   - aap-deployer ServiceAccount RBAC current (re-run after RBAC changes):
+#       ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
+#
+# Policies live in roles/opa_server/files/policies; test them with:
+#   podman run --rm -v ./roles/opa_server/files:/files:Z docker.io/openpolicyagent/opa:1.21.1-static \
+#     test /files/policies /files/tests -v
+#
+# Attaching a policy (AAP fails closed — start with aap/smoke/allow_all):
+#   -e '{"opa_server_aap_query_paths": [{"type": "job_templates", "name": "Demo Job Template",
+#        "query_path": "aap/policy/decision"}]}'
+#
+# Usage:
+#   ansible-navigator run playbooks/deploy_opa.yml --mode stdout
+
+- name: Deploy OPA server for AAP policy enforcement
+  hosts: aap
+  gather_facts: false
+  connection: local
+
+  environment:
+    K8S_AUTH_HOST: "{{ aap_k8s_api_url }}"
+    K8S_AUTH_API_KEY: "{{ vault_aap_deployer_token }}"
+
+  pre_tasks:
+    - name: Verify aap-deployer token and AAP URL are available
+      ansible.builtin.assert:
+        that:
+          - vault_aap_deployer_token is defined
+          - vault_aap_deployer_token | length > 0
+          - aap_gateway_url is defined
+        fail_msg: >-
+          vault_aap_deployer_token or aap_gateway_url is not set. Provision the ServiceAccount with:
+          ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
+
+  roles:
+    - role: opa_server
+      vars:
+        opa_server_aap_namespace: "{{ aap_operator_namespace | default('aap') }}"
+        opa_server_aap_admin_secret: "{{ aap_operator_platform_name | default('aap') }}-admin-password"
+        opa_server_aap_username: "{{ aap_operator_admin_user | default('admin') }}"