Add OPA and Openshift AI

roles/opa_server/meta/argument_specs.yml

@@ -0,0 +1,103 @@
+---
+argument_specs:
+  main:
+    short_description: Deploy an OPA server for AAP policy enforcement
+    description:
+      - Deploys Open Policy Agent with TLS (service-ca) and bearer-token authentication, loading
+        the Rego policies in opa_server_policy_dir and opa_server_policy_config as
+        data.aap_policy_config.
+      - Configures AAP's PolicyAsCode settings to use it and optionally attaches opa_query_path
+        to organizations, inventories, or job templates. AAP fails closed once a path is attached.
+      - The bearer token is generated on first run and stored in Vault at opa_server_vault_path.
+    options:
+      opa_server_namespace:
+        description: Namespace for the OPA server.
+        type: str
+        default: opa
+      opa_server_name:
+        description: Name for the Deployment, Service, and derived resources.
+        type: str
+        default: opa
+      opa_server_image:
+        description: OPA container image (pin an exact version).
+        type: str
+        default: docker.io/openpolicyagent/opa:1.21.1-static
+      opa_server_replicas:
+        description: Number of OPA replicas.
+        type: int
+        default: 1
+      opa_server_port:
+        description: HTTPS port OPA listens on and the Service exposes.
+        type: int
+        default: 8443
+      opa_server_log_level:
+        description: OPA log level.
+        type: str
+        choices: [debug, info, warn, error]
+        default: info
+      opa_server_decision_logs:
+        description: Log every decision (including job extra_vars) to the pod log.
+        type: bool
+        default: true
+      opa_server_resources:
+        description: Container resource requests and limits.
+        type: dict
+      opa_server_wait_timeout:
+        description: Seconds to wait for the OPA Deployment to become available.
+        type: int
+        default: 300
+      opa_server_policy_dir:
+        description: Directory whose *.rego files are loaded into OPA.
+        type: path
+      opa_server_policy_config:
+        description: Policy tunables exposed as data.aap_policy_config.
+        type: dict
+      opa_server_vault_mount:
+        description: Vault KV2 mount for the bearer token.
+        type: str
+        default: kv
+      opa_server_vault_path:
+        description: Vault KV2 path for the bearer token.
+        type: str
+        default: toallab/opa-server
+      opa_server_configure_aap:
+        description: Configure AAP's PolicyAsCode settings to use this server.
+        type: bool
+        default: true
+      opa_server_aap_url:
+        description: AAP gateway URL.
+        type: str
+      opa_server_aap_username:
+        description: AAP admin username.
+        type: str
+        default: admin
+      opa_server_aap_namespace:
+        description: Namespace of the AAP instance (holds the admin password secret).
+        type: str
+        default: aap
+      opa_server_aap_admin_secret:
+        description: Secret holding the AAP admin password (key password).
+        type: str
+        default: aap-admin-password
+      opa_server_aap_validate_certs:
+        description: Validate the AAP gateway certificate.
+        type: bool
+        default: true
+      opa_server_aap_request_timeout:
+        description: OPA_REQUEST_TIMEOUT in seconds.
+        type: float
+        default: 1.5
+      opa_server_aap_request_retries:
+        description: OPA_REQUEST_RETRIES.
+        type: int
+        default: 2
+      opa_server_aap_query_paths:
+        description: Resources to attach a policy to (type organizations|inventories|job_templates,
+          name, query_path).
+        type: list
+        elements: dict
+        default: []
+      opa_server_no_log:
+        description: Set to false to expose secret values in task output.
+        type: bool
+        default: true

roles/opa_server/meta/main.yml

@@ -0,0 +1,17 @@
+---
+galaxy_info:
+  author: ptoal
+  description: Deploy an Open Policy Agent server on OpenShift for AAP policy enforcement
+  license: MIT
+  min_ansible_version: "2.16"
+  platforms:
+    - name: GenericLinux
+      versions:
+        - all
+  galaxy_tags:
+    - openshift
+    - opa
+    - policy
+    - aap
+
+dependencies: []