Add OPA and Openshift AI

roles/opa_server/tasks/main.yml

@@ -0,0 +1,32 @@
+---
+# Deploy an Open Policy Agent server for AAP policy enforcement (policy as code)
+# and point AAP's controller at it.
+#
+# OPA serves TLS with a service-ca certificate and requires a bearer token
+# (--authentication=token, system.authz policy). AAP connects in-cluster with
+# OPA_SSL=true, OPA_AUTH_TYPE=Token and the service CA bundle.
+#
+# AAP fails closed: once a resource has an opa_query_path, any OPA error or
+# violation blocks its jobs. Nothing is attached unless opa_server_aap_query_paths
+# lists it.
+#
+# All tasks are idempotent (kubernetes.core.k8s state: present).
+
+- name: Resolve OPA bearer token from Vault
+  ansible.builtin.include_tasks: vault_token.yml
+
+- name: Deploy OPA server
+  ansible.builtin.include_tasks: deploy.yml
+
+- name: Configure AAP policy enforcement
+  ansible.builtin.include_tasks: aap.yml
+  when: opa_server_configure_aap | bool
+
+- name: Display OPA deployment summary
+  ansible.builtin.debug:
+    msg:
+      - "OPA server ready!"
+      - "  Endpoint    : https://{{ __opa_server_host }}:{{ opa_server_port }} (in-cluster)"
+      - "  Policies    : {{ __opa_server_policies.keys() | list | join(', ') }}"
+      - "  Query paths : aap/policy/decision, aap/smoke/allow_all, aap/smoke/deny_all"
+      - "  Token       : Vault {{ opa_server_vault_mount }}/{{ opa_server_vault_path }}"