Add Automation Orchestrator Install and setup

playbooks/deploy_openshift.yml

@@ -396,18 +396,40 @@
           - apiGroups: [""]
             resources: ["serviceaccounts"]
             verbs: ["get", "list", "watch"]
+          # patch: Automation Orchestrator backend env (APP_OIDC_ALLOW_PRIVATE_NETWORKS)
           - apiGroups: ["apps"]
             resources: ["deployments"]
+            verbs: ["get", "list", "watch", "patch"]
+          - apiGroups: ["route.openshift.io"]
+            resources: ["routes"]
+            verbs: ["get", "list"]
+          - apiGroups: [""]
+            resources: ["endpoints"]
             verbs: ["get", "list", "watch"]
           - apiGroups: ["operators.coreos.com"]
-            resources: ["operatorgroups", "subscriptions", "clusterserviceversions"]
+            resources: ["operatorgroups", "subscriptions", "clusterserviceversions",
+                        "catalogsources"]
             verbs: ["get", "list", "create", "patch", "watch"]
+          - apiGroups: ["operators.coreos.com"]
+            resources: ["installplans"]
+            verbs: ["get", "list", "patch", "watch"]
           - apiGroups: ["apiextensions.k8s.io"]
             resources: ["customresourcedefinitions"]
             verbs: ["get", "list", "watch"]
           - apiGroups: ["aap.ansible.com"]
-            resources: ["ansibleautomationplatforms"]
+            resources: ["ansibleautomationplatforms", "automationorchestrators"]
             verbs: ["get", "list", "create", "patch", "watch"]
+          # CloudNativePG Cluster/Database CRs backing Automation Orchestrator
+          - apiGroups: ["postgresql.cnpg.io"]
+            resources: ["clusters", "databases"]
+            verbs: ["get", "list", "create", "patch", "watch"]
+          # Automation Orchestrator pre-release image mirror (IDMS) + MCP rollout wait
+          - apiGroups: ["config.openshift.io"]
+            resources: ["imagedigestmirrorsets"]
+            verbs: ["get", "list", "create", "patch"]
+          - apiGroups: ["machineconfiguration.openshift.io"]
+            resources: ["machineconfigpools"]
+            verbs: ["get", "list", "watch"]
 
     - name: Store aap-deployer token in Vault
       community.hashi_vault.vault_kv2_write: