Add OPA and Openshift AI

roles/opa_server/defaults/main.yml

@@ -0,0 +1,58 @@
+---
+# --- Deployment ---
+opa_server_namespace: opa
+opa_server_name: opa
+opa_server_image: docker.io/openpolicyagent/opa:1.21.1-static
+opa_server_replicas: 1
+opa_server_port: 8443
+opa_server_log_level: info
+# Log every decision (including the job's extra_vars) to the pod log for auditing.
+opa_server_decision_logs: true
+opa_server_resources:
+  requests:
+    cpu: 50m
+    memory: 64Mi
+  limits:
+    cpu: 500m
+    memory: 256Mi
+opa_server_wait_timeout: 300
+
+# --- Policies ---
+# Every *.rego file in this directory is loaded into the server.
+opa_server_policy_dir: "{{ role_path }}/files/policies"
+# Exposed to policies as data.aap_policy_config (see files/policies/aap_policy.rego).
+opa_server_policy_config:
+  allowed_ee_registries:
+    - aap.toal.ca/
+    - registry.redhat.io/
+  forbidden_extra_vars:
+    - ansible_password
+    - ansible_become_password
+    - ansible_ssh_pass
+    - ansible_become_pass
+  change_freeze: false
+  change_freeze_exempt_teams: []
+
+# --- Bearer token (OPA --authentication=token) ---
+# Generated on first run and stored in Vault; reused afterwards.
+opa_server_vault_mount: kv
+opa_server_vault_path: toallab/opa-server
+
+# --- AAP integration ---
+opa_server_configure_aap: true
+opa_server_aap_url: "{{ aap_gateway_url }}"
+opa_server_aap_username: admin
+opa_server_aap_namespace: aap
+opa_server_aap_admin_secret: aap-admin-password
+opa_server_aap_validate_certs: true
+opa_server_aap_request_timeout: 1.5
+opa_server_aap_request_retries: 2
+# Attach a policy to AAP resources. Jobs fail closed: any OPA error or violation
+# blocks the launch, so start with aap/smoke/allow_all and a test resource.
+#   - type: organizations | inventories | job_templates
+#     name: Default
+#     query_path: aap/policy/decision
+opa_server_aap_query_paths: []
+
+# --- Debugging ---
+opa_server_no_log: true