Add OPA and Openshift AI

roles/opa_server/tasks/aap.yml

@@ -0,0 +1,95 @@
+---
+# Point the AAP controller at OPA (PolicyAsCode settings) and optionally attach
+# query paths to organizations, inventories, or job templates.
+
+- name: Read AAP admin password
+  kubernetes.core.k8s_info:
+    api_version: v1
+    kind: Secret
+    namespace: "{{ opa_server_aap_namespace }}"
+    name: "{{ opa_server_aap_admin_secret }}"
+  register: __opa_server_aap_admin
+  no_log: true
+
+- name: Read the service CA bundle
+  kubernetes.core.k8s_info:
+    api_version: v1
+    kind: ConfigMap
+    namespace: "{{ opa_server_namespace }}"
+    name: openshift-service-ca.crt
+  register: __opa_server_service_ca
+
+- name: Resolve AAP API connection
+  ansible.builtin.set_fact:
+    __opa_server_aap_api: "{{ opa_server_aap_url | regex_replace('/$', '') }}/api/controller/v2"
+    __opa_server_aap_password: "{{ __opa_server_aap_admin.resources[0].data.password | b64decode }}"
+    __opa_server_aap_settings:
+      OPA_HOST: "{{ __opa_server_host }}"
+      OPA_PORT: "{{ opa_server_port | int }}"
+      OPA_SSL: true
+      OPA_AUTH_TYPE: Token
+      OPA_AUTH_CA_CERT: "{{ __opa_server_service_ca.resources[0].data['service-ca.crt'] }}"
+      OPA_REQUEST_TIMEOUT: "{{ opa_server_aap_request_timeout | float }}"
+      OPA_REQUEST_RETRIES: "{{ opa_server_aap_request_retries | int }}"
+  no_log: true
+
+- name: Read AAP policy-as-code settings
+  ansible.builtin.uri:
+    url: "{{ __opa_server_aap_api }}/settings/policyascode/"
+    user: "{{ opa_server_aap_username }}"
+    password: "{{ __opa_server_aap_password }}"
+    force_basic_auth: true
+    validate_certs: "{{ opa_server_aap_validate_certs }}"
+  register: __opa_server_aap_current
+  no_log: "{{ opa_server_no_log }}"
+
+# The token reads back as $encrypted$, so it is only resent when unset or rotated
+- name: Configure AAP policy-as-code settings
+  ansible.builtin.uri:
+    url: "{{ __opa_server_aap_api }}/settings/policyascode/"
+    method: PATCH
+    user: "{{ opa_server_aap_username }}"
+    password: "{{ __opa_server_aap_password }}"
+    force_basic_auth: true
+    validate_certs: "{{ opa_server_aap_validate_certs }}"
+    body_format: json
+    body: "{{ __opa_server_aap_settings | combine({'OPA_AUTH_TOKEN': __opa_server_token}) }}"
+  changed_when: true
+  when: >-
+    (__opa_server_aap_current.json | dict2items
+     | selectattr('key', 'in', __opa_server_aap_settings.keys() | list)
+     | items2dict) != __opa_server_aap_settings
+    or (__opa_server_aap_current.json.OPA_AUTH_TOKEN | default('')) | length == 0
+    or __opa_server_token_generated | bool
+  no_log: "{{ opa_server_no_log }}"
+
+- name: Look up resources to attach policies to
+  ansible.builtin.uri:
+    url: "{{ __opa_server_aap_api }}/{{ item.type }}/?name={{ item.name | urlencode }}"
+    user: "{{ opa_server_aap_username }}"
+    password: "{{ __opa_server_aap_password }}"
+    force_basic_auth: true
+    validate_certs: "{{ opa_server_aap_validate_certs }}"
+  register: __opa_server_aap_targets
+  failed_when: >-
+    __opa_server_aap_targets.status != 200 or __opa_server_aap_targets.json.count != 1
+  loop: "{{ opa_server_aap_query_paths }}"
+  loop_control:
+    label: "{{ item.type }}/{{ item.name }}"
+
+- name: Attach OPA query paths
+  ansible.builtin.uri:
+    url: "{{ __opa_server_aap_api }}/{{ item.item.type }}/{{ item.json.results[0].id }}/"
+    method: PATCH
+    user: "{{ opa_server_aap_username }}"
+    password: "{{ __opa_server_aap_password }}"
+    force_basic_auth: true
+    validate_certs: "{{ opa_server_aap_validate_certs }}"
+    body_format: json
+    body:
+      opa_query_path: "{{ item.item.query_path }}"
+  changed_when: true
+  when: item.json.results[0].opa_query_path | default('') != item.item.query_path
+  loop: "{{ __opa_server_aap_targets.results }}"
+  loop_control:
+    label: "{{ item.item.type }}/{{ item.item.name }} -> {{ item.item.query_path }}"