Automation Orchestrator install and tweaks

roles/sno_alert_tuning/defaults/main.yml

@@ -0,0 +1,13 @@
+---
+# Platform alerts that are false positives on a single-control-plane cluster.
+# Dropped via an AlertRelabelConfig (monitoring.openshift.io/v1), so they never
+# reach Alertmanager. Alerts are matched by exact alertname.
+#
+# KubeCPUOvercommit / KubeMemoryOvercommit: the HA branch of these rules assumes
+# the cluster survives losing its largest node. With one control-plane node plus
+# smaller workers, that node is master-0 — losing it loses the cluster anyway.
+sno_alert_tuning_dropped_alerts:
+  - KubeCPUOvercommit
+  - KubeMemoryOvercommit
+
+sno_alert_tuning_config_name: sno-single-control-plane

roles/sno_alert_tuning/meta/argument_specs.yml

@@ -0,0 +1,17 @@
+---
+argument_specs:
+  main:
+    short_description: Drop platform alerts that are false positives on a single-control-plane cluster
+    description:
+      - Creates an AlertRelabelConfig in openshift-monitoring that drops the listed alerts
+        before they reach Alertmanager. An empty list removes the AlertRelabelConfig.
+    options:
+      sno_alert_tuning_dropped_alerts:
+        description: Exact alertnames to drop.
+        type: list
+        elements: str
+        default: [KubeCPUOvercommit, KubeMemoryOvercommit]
+      sno_alert_tuning_config_name:
+        description: Name of the AlertRelabelConfig.
+        type: str
+        default: sno-single-control-plane

roles/sno_alert_tuning/meta/main.yml

@@ -0,0 +1,16 @@
+---
+galaxy_info:
+  author: ptoal
+  description: Drop platform alerts that are false positives on single-node OpenShift
+  license: MIT
+  min_ansible_version: "2.16"
+  platforms:
+    - name: GenericLinux
+      versions:
+        - all
+  galaxy_tags:
+    - openshift
+    - monitoring
+    - sno
+
+dependencies: []

roles/sno_alert_tuning/tasks/main.yml

@@ -0,0 +1,19 @@
+---
+# Drop platform alerts that only fire because the cluster has a single
+# control-plane node. Uses the supported AlertRelabelConfig API rather than
+# silences (which expire) or editing cluster-monitoring-operator rules (reverted).
+
+- name: Drop single-control-plane false-positive alerts
+  kubernetes.core.k8s:
+    state: "{{ 'present' if sno_alert_tuning_dropped_alerts | length > 0 else 'absent' }}"
+    definition:
+      apiVersion: monitoring.openshift.io/v1
+      kind: AlertRelabelConfig
+      metadata:
+        name: "{{ sno_alert_tuning_config_name }}"
+        namespace: openshift-monitoring
+      spec:
+        configs:
+          - sourceLabels: [alertname]
+            regex: "{{ sno_alert_tuning_dropped_alerts | map('regex_escape') | join('|') }}"
+            action: Drop