Add OPA and Openshift AI

roles/opa_server/tasks/deploy.yml

@@ -0,0 +1,172 @@
+---
+- name: Create OPA namespace
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: "{{ opa_server_namespace }}"
+
+- name: Create OPA policy ConfigMap
+  kubernetes.core.k8s:
+    state: present
+    apply: true
+    definition:
+      apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: "{{ opa_server_name }}-policies"
+        namespace: "{{ opa_server_namespace }}"
+      data: >-
+        {{ __opa_server_policies
+           | combine({'aap_policy_config.json': {'aap_policy_config': opa_server_policy_config} | to_json}) }}
+
+- name: Create OPA authorization token Secret
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Secret
+      metadata:
+        name: "{{ opa_server_name }}-authz"
+        namespace: "{{ opa_server_namespace }}"
+      type: Opaque
+      stringData:
+        opa_authz.json: "{{ {'opa_authz': {'token': __opa_server_token}} | to_json }}"
+  no_log: "{{ opa_server_no_log }}"
+
+- name: Create OPA Service with a service-ca serving certificate
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: "{{ opa_server_name }}"
+        namespace: "{{ opa_server_namespace }}"
+        annotations:
+          service.beta.openshift.io/serving-cert-secret-name: "{{ __opa_server_tls_secret }}"
+      spec:
+        selector:
+          app: "{{ opa_server_name }}"
+        ports:
+          - name: https
+            port: "{{ opa_server_port | int }}"
+            targetPort: https
+
+- name: Wait for OPA serving certificate
+  kubernetes.core.k8s_info:
+    api_version: v1
+    kind: Secret
+    namespace: "{{ opa_server_namespace }}"
+    name: "{{ __opa_server_tls_secret }}"
+  register: __opa_server_cert
+  until: __opa_server_cert.resources | length > 0
+  retries: 30
+  delay: 10
+  no_log: true
+
+- name: Create OPA Deployment
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: apps/v1
+      kind: Deployment
+      metadata:
+        name: "{{ opa_server_name }}"
+        namespace: "{{ opa_server_namespace }}"
+        labels:
+          app: "{{ opa_server_name }}"
+      spec:
+        replicas: "{{ opa_server_replicas | int }}"
+        selector:
+          matchLabels:
+            app: "{{ opa_server_name }}"
+        template:
+          metadata:
+            labels:
+              app: "{{ opa_server_name }}"
+            annotations:
+              # Roll pods when policies, config, or the token change
+              checksum/policies: "{{ (__opa_server_policies | to_json ~ opa_server_policy_config | to_json) | hash('sha256') }}"
+              checksum/authz: "{{ __opa_server_token | hash('sha256') }}"
+          spec:
+            securityContext:
+              runAsNonRoot: true
+              seccompProfile:
+                type: RuntimeDefault
+            containers:
+              - name: opa
+                image: "{{ opa_server_image }}"
+                args: >-
+                  {{ [
+                       'run', '--server',
+                       '--addr=0.0.0.0:' ~ opa_server_port,
+                       '--tls-cert-file=/certs/tls.crt',
+                       '--tls-private-key-file=/certs/tls.key',
+                       '--authentication=token',
+                       '--authorization=basic',
+                       '--ignore=.*',
+                       '--log-format=json',
+                       '--log-level=' ~ opa_server_log_level,
+                     ]
+                     + (['--set=decision_logs.console=true'] if opa_server_decision_logs | bool else [])
+                     + ['/policies', '/authz'] }}
+                ports:
+                  - name: https
+                    containerPort: "{{ opa_server_port | int }}"
+                readinessProbe:
+                  httpGet:
+                    path: /health
+                    port: https
+                    scheme: HTTPS
+                  initialDelaySeconds: 3
+                  periodSeconds: 10
+                livenessProbe:
+                  httpGet:
+                    path: /health
+                    port: https
+                    scheme: HTTPS
+                  initialDelaySeconds: 10
+                  periodSeconds: 20
+                resources: "{{ opa_server_resources }}"
+                securityContext:
+                  allowPrivilegeEscalation: false
+                  readOnlyRootFilesystem: true
+                  capabilities:
+                    drop: [ALL]
+                volumeMounts:
+                  - name: policies
+                    mountPath: /policies
+                    readOnly: true
+                  - name: authz
+                    mountPath: /authz
+                    readOnly: true
+                  - name: certs
+                    mountPath: /certs
+                    readOnly: true
+            volumes:
+              - name: policies
+                configMap:
+                  name: "{{ opa_server_name }}-policies"
+              - name: authz
+                secret:
+                  secretName: "{{ opa_server_name }}-authz"
+              - name: certs
+                secret:
+                  secretName: "{{ __opa_server_tls_secret }}"
+
+- name: Wait for OPA to be available
+  kubernetes.core.k8s_info:
+    api_version: apps/v1
+    kind: Deployment
+    namespace: "{{ opa_server_namespace }}"
+    name: "{{ opa_server_name }}"
+  register: __opa_server_deploy
+  until: >-
+    __opa_server_deploy.resources | length > 0 and
+    (__opa_server_deploy.resources[0].status.updatedReplicas | default(0)) == opa_server_replicas | int and
+    (__opa_server_deploy.resources[0].status.availableReplicas | default(0)) == opa_server_replicas | int
+  retries: "{{ __opa_server_wait_retries }}"
+  delay: 10