Add OPA and Openshift AI

roles/rhoai_maas/tasks/database.yml

@@ -0,0 +1,49 @@
+---
+# Build maas-db-config (DB_CONNECTION_URL) from the CloudNativePG basic-auth secret.
+# RHOAI 3.5+ reads it from the infrastructure namespace; it must exist before the
+# DSC enables modelsAsAService.
+
+- name: Read MaaS database credentials
+  kubernetes.core.k8s_info:
+    api_version: v1
+    kind: Secret
+    namespace: "{{ rhoai_maas_db_secret_namespace }}"
+    name: "{{ rhoai_maas_db_secret_name }}"
+  register: __rhoai_maas_db_secret
+  no_log: true
+
+- name: Verify MaaS database credentials exist
+  ansible.builtin.assert:
+    that: __rhoai_maas_db_secret.resources | length > 0
+    fail_msg: >-
+      Secret {{ rhoai_maas_db_secret_namespace }}/{{ rhoai_maas_db_secret_name }} not found.
+      Run the cloudnativepg_operator role first (playbooks/deploy_rhoai_maas.yml does this).
+
+- name: Create MaaS infrastructure namespace
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: "{{ rhoai_maas_infra_namespace }}"
+
+- name: Create maas-db-config secret
+  vars:
+    __db: "{{ __rhoai_maas_db_secret.resources[0].data }}"
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Secret
+      metadata:
+        name: maas-db-config
+        namespace: "{{ rhoai_maas_infra_namespace }}"
+      type: Opaque
+      stringData:
+        DB_CONNECTION_URL: >-
+          postgresql://{{ __db.username | b64decode | urlencode | replace('/', '%2F') }}:{{
+          __db.password | b64decode | urlencode | replace('/', '%2F') }}@{{
+          __db.host | b64decode }}:{{ __db.port | b64decode }}/{{ __db.database | b64decode
+          }}?sslmode={{ rhoai_maas_db_sslmode }}
+  no_log: true