Add OPA and Openshift AI

roles/opa_server/tasks/vault_token.yml

@@ -0,0 +1,28 @@
+---
+# Read the OPA bearer token from Vault; generate and store it if missing.
+# Sets __opa_server_token and __opa_server_token_generated.
+
+- name: Read OPA token from Vault
+  community.hashi_vault.vault_kv2_get:
+    path: "{{ opa_server_vault_path }}"
+    engine_mount_point: "{{ opa_server_vault_mount }}"
+  register: __opa_server_vault_read
+  failed_when: false
+  no_log: "{{ opa_server_no_log }}"
+
+- name: Resolve OPA token (generate if missing)
+  ansible.builtin.set_fact:
+    __opa_server_token_generated: "{{ ((__opa_server_vault_read.secret | default({})).token | default('')) | length == 0 }}"
+    __opa_server_token: >-
+      {{ (__opa_server_vault_read.secret | default({})).token
+         | default(lookup('community.general.random_string', length=48, special=false)) }}
+  no_log: "{{ opa_server_no_log }}"
+
+- name: Write OPA token to Vault
+  community.hashi_vault.vault_kv2_write:
+    path: "{{ opa_server_vault_path }}"
+    engine_mount_point: "{{ opa_server_vault_mount }}"
+    data:
+      token: "{{ __opa_server_token }}"
+  when: __opa_server_token_generated | bool
+  no_log: "{{ opa_server_no_log }}"