Add Automation Orchestrator Install and setup

playbooks/deploy_automation_orchestrator.yml

@@ -0,0 +1,84 @@
+---
+# Deploy Automation Orchestrator on OpenShift via its OLM operator, backed by a
+# CloudNativePG-provisioned PostgreSQL cluster.
+#
+# WARNING: CloudNativePG here is a single-instance, operator-provisioned PostgreSQL
+# cluster intended for demo/dev use — not production. For production, disable the
+# cloudnativepg_operator role below and point automation_orchestrator_operator's
+# postgres_* variables at a customer-managed PostgreSQL instance instead.
+#
+# Authenticates via the same aap-deployer ServiceAccount token used by deploy_aap.yml
+# (same cluster). The token is stored in 1Password as vault_aap_deployer_token.
+#
+# Modeled on https://github.com/ansible/aapctl (aap-plus install path).
+#
+# Prerequisites:
+#   - OpenShift cluster deployed (deploy_openshift.yml)
+#   - aap-deployer ServiceAccount provisioned (re-run after RBAC changes):
+#       ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
+#   - CloudNativePG uses Manual install-plan approval; the role approves its
+#     InstallPlan. Automation Orchestrator installs from redhat-operators and
+#     adopts an existing operator install when its namespace is set in inventory.
+#   - Pre-release AO builds additionally need a custom CatalogSource and an
+#     ImageDigestMirrorSet (see automation_orchestrator_operator defaults).
+#
+# Keycloak OIDC (--tags ao_configure_oidc, run after the install):
+#   - Keycloak settings come from the openshift host (keycloak_url, keycloak_realm,
+#     keycloak_admin_user, vault_keycloak_admin_password).
+#   - automation_orchestrator_oidc_group_mappings in host_vars for the aap host.
+#   - The client secret is generated by Keycloak and read back each run (not vaulted).
+#
+# Usage:
+#   ansible-navigator run playbooks/deploy_automation_orchestrator.yml --mode stdout
+#   ansible-navigator run playbooks/deploy_automation_orchestrator.yml --mode stdout --tags ao_configure_oidc
+
+- name: Install Automation Orchestrator
+  hosts: aap
+  gather_facts: false
+  connection: local
+
+  environment:
+    K8S_AUTH_HOST: "{{ aap_k8s_api_url }}"
+    K8S_AUTH_API_KEY: "{{ vault_aap_deployer_token }}"
+
+  pre_tasks:
+    - name: Verify aap-deployer token is available
+      ansible.builtin.assert:
+        that:
+          - vault_aap_deployer_token is defined
+          - vault_aap_deployer_token | length > 0
+        fail_msg: >-
+          vault_aap_deployer_token is not set. Provision the ServiceAccount with:
+          ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
+          Then save the displayed token to 1Password as vault_aap_deployer_token.
+
+  roles:
+    - role: cloudnativepg_operator
+    - role: automation_orchestrator_operator
+
+# ---------------------------------------------------------------------------
+# Configure Keycloak OIDC login (optional, run after the install)
+# ---------------------------------------------------------------------------
+- name: Configure Keycloak OIDC for Automation Orchestrator
+  hosts: aap
+  gather_facts: false
+  connection: local
+
+  tags:
+    - never
+    - ao_configure_oidc
+
+  vars:
+    __ao_keycloak_host: "{{ hostvars[groups['openshift'][0]] }}"
+    automation_orchestrator_oidc_keycloak_url: "{{ __ao_keycloak_host.keycloak_url }}{{ __ao_keycloak_host.keycloak_context | default('') }}"
+    automation_orchestrator_oidc_keycloak_realm: "{{ __ao_keycloak_host.keycloak_realm }}"
+    automation_orchestrator_oidc_keycloak_admin_user: "{{ __ao_keycloak_host.keycloak_admin_user }}"
+    automation_orchestrator_oidc_keycloak_admin_password: "{{ __ao_keycloak_host.vault_keycloak_admin_password }}"
+    automation_orchestrator_oidc_keycloak_validate_certs: "{{ __ao_keycloak_host.keycloak_validate_certs | default(true) }}"
+
+  environment:
+    K8S_AUTH_HOST: "{{ aap_k8s_api_url }}"
+    K8S_AUTH_API_KEY: "{{ vault_aap_deployer_token }}"
+
+  roles:
+    - role: automation_orchestrator_oidc