ptoal/toallab-automation
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add OPA and Openshift AI

Browse Source
This commit is contained in:
Patrick Toal
2026-10-20 14:08:57 -04:00
parent 7df35b9dd4
commit 5b46ba7c74
27 changed files with 2634 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

91
playbooks/deploy_openshift.yml
View File

@@ -400,10 +400,15 @@
- apiGroups: [""]
resources: ["serviceaccounts"]
verbs: ["get", "list", "watch"]
# OPA server (deploy_opa.yml): policy ConfigMap, Service, service CA bundle
- apiGroups: [""]
resources: ["configmaps", "services"]
verbs: ["get", "list", "watch", "create", "patch"]
# patch: Automation Orchestrator backend env (APP_OIDC_ALLOW_PRIVATE_NETWORKS)
# create: OPA server Deployment
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["get", "list", "watch", "patch"]
verbs: ["get", "list", "watch", "create", "patch"]
- apiGroups: ["route.openshift.io"]
resources: ["routes"]
verbs: ["get", "list"]
@@ -443,6 +448,90 @@
token: "{{ __ocp_service_account_token }}"
no_log: true
# ---- rhoai-deployer (deploy_rhoai_maas.yml) ----
- name: Provision rhoai-deployer ServiceAccount
ansible.builtin.include_role:
name: ocp_service_account
vars:
ocp_service_account_name: rhoai-deployer
ocp_service_account_namespace: redhat-ods-operator
ocp_service_account_cluster_role_rules:
- apiGroups: [""]
resources: ["namespaces"]
verbs: ["get", "list", "create", "patch"]
# configmaps: cluster-monitoring-config (UWM), gateway options
# services: Authorino serving-cert annotation
- apiGroups: [""]
resources: ["secrets", "configmaps", "services"]
verbs: ["get", "list", "watch", "create", "patch"]
- apiGroups: [""]
resources: ["serviceaccounts", "endpoints"]
verbs: ["get", "list", "watch"]
# delete: restart the Kuadrant operator after Istio is installed
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list", "watch", "delete"]
# patch: Authorino service-CA trust env
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["route.openshift.io"]
resources: ["routes", "routes/custom-host"]
verbs: ["get", "list", "create", "patch"]
- apiGroups: ["config.openshift.io"]
resources: ["ingresses"]
verbs: ["get", "list"]
- apiGroups: ["operators.coreos.com"]
resources: ["operatorgroups", "subscriptions", "clusterserviceversions",
"catalogsources"]
verbs: ["get", "list", "create", "patch", "watch"]
- apiGroups: ["operators.coreos.com"]
resources: ["installplans"]
verbs: ["get", "list", "patch", "watch"]
- apiGroups: ["apiextensions.k8s.io"]
resources: ["customresourcedefinitions"]
verbs: ["get", "list", "watch"]
# CloudNativePG Cluster/Database CRs backing the MaaS database
- apiGroups: ["postgresql.cnpg.io"]
resources: ["clusters", "databases"]
verbs: ["get", "list", "create", "patch", "watch"]
- apiGroups: ["gateway.networking.k8s.io"]
resources: ["gatewayclasses", "gateways"]
verbs: ["get", "list", "create", "patch", "watch"]
# Dedicated MaaS gateway certificate (avoids HTTP/2 coalescing on the wildcard)
- apiGroups: ["cert-manager.io"]
resources: ["certificates"]
verbs: ["get", "list", "create", "patch", "watch"]
- apiGroups: ["kuadrant.io"]
resources: ["kuadrants"]
verbs: ["get", "list", "create", "patch", "watch"]
- apiGroups: ["operator.authorino.kuadrant.io"]
resources: ["authorinos"]
verbs: ["get", "list", "patch", "watch"]
- apiGroups: ["dscinitialization.opendatahub.io"]
resources: ["dscinitializations"]
verbs: ["get", "list", "create", "patch", "watch"]
- apiGroups: ["datasciencecluster.opendatahub.io"]
resources: ["datascienceclusters"]
verbs: ["get", "list", "create", "patch", "watch"]
- apiGroups: ["opendatahub.io"]
resources: ["odhdashboardconfigs"]
verbs: ["get", "list", "patch"]
- apiGroups: ["inference.opendatahub.io"]
resources: ["externalproviders", "externalmodels"]
verbs: ["get", "list", "create", "patch", "watch"]
- apiGroups: ["maas.opendatahub.io"]
resources: ["maasmodelrefs", "maasauthpolicies", "maassubscriptions"]
verbs: ["get", "list", "create", "patch", "watch"]
- name: Store rhoai-deployer token in Vault
community.hashi_vault.vault_kv2_write:
path: toallab/rhoai-deployer
engine_mount_point: kv
data:
token: "{{ __ocp_service_account_token }}"
no_log: true
# ---------------------------------------------------------------------------
# Play 10: Drop platform alerts that are false positives on a single
# control-plane cluster (AlertRelabelConfig in openshift-monitoring)