Add OPA and Openshift AI

playbooks/deploy_rhoai_maas.yml

@@ -0,0 +1,55 @@
+---
+# Deploy Red Hat OpenShift AI 3.5 Models-as-a-Service and publish the existing
+# llama-coder (llama.cpp) server through it as an ExternalModel.
+#
+# WARNING: the MaaS database is a single-instance CloudNativePG cluster intended
+# for demo/dev use — not production.
+#
+# Technology Preview: MaaS is GA in 3.5, but ExternalModel (used here to front
+# llama.cpp instead of a KServe LLMInferenceService) is Technology Preview.
+#
+# Prerequisites:
+#   - OpenShift cluster deployed (deploy_openshift.yml) with cert-manager
+#   - rhoai-deployer ServiceAccount provisioned (re-run after RBAC changes):
+#       ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
+#   - vault_rhoai_deployer_token set in host_vars (see hashivault_secrets.yml)
+#   - llama-coder running in llm-coding-assistant with secret llama-coder-api-key
+#
+# Usage:
+#   ansible-navigator run playbooks/deploy_rhoai_maas.yml --mode stdout
+
+- name: Deploy OpenShift AI Models-as-a-Service
+  hosts: sno.openshift.toal.ca
+  gather_facts: false
+  connection: local
+
+  environment:
+    K8S_AUTH_HOST: "{{ rhoai_maas_k8s_api_url | default('https://api.' ~ ocp_cluster_name ~ '.' ~ ocp_base_domain ~ ':6443') }}"
+    K8S_AUTH_API_KEY: "{{ vault_rhoai_deployer_token }}"
+
+  pre_tasks:
+    - name: Verify rhoai-deployer token is available
+      ansible.builtin.assert:
+        that:
+          - vault_rhoai_deployer_token is defined
+          - vault_rhoai_deployer_token | length > 0
+        fail_msg: >-
+          vault_rhoai_deployer_token is not set. Provision the ServiceAccount with:
+          ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
+          Then reference kv/data/toallab/rhoai-deployer:token as vault_rhoai_deployer_token.
+
+  roles:
+    - role: cloudnativepg_operator
+      vars:
+        cloudnativepg_operator_cluster_namespace: rhoai-maas-db
+        cloudnativepg_operator_cluster_name: maas-postgres
+        cloudnativepg_operator_owner_user: maas
+        cloudnativepg_operator_max_connections: 100
+        cloudnativepg_operator_databases:
+          - name: maas
+            dbname: maas
+        cloudnativepg_operator_secrets:
+          - name: maas-postgres-secret
+            database: maas
+        cloudnativepg_operator_vault_path: cloudnativepg/maas-postgres
+    - role: rhoai_maas