Add Automation Orchestrator Install and setup
This commit is contained in:
38
roles/automation_orchestrator_oidc/defaults/main.yml
Normal file
38
roles/automation_orchestrator_oidc/defaults/main.yml
Normal file
@@ -0,0 +1,38 @@
|
||||
---
|
||||
# --- Automation Orchestrator instance ---
|
||||
# Defaults track the automation_orchestrator_operator role's variables when set.
|
||||
automation_orchestrator_oidc_namespace: "{{ automation_orchestrator_operator_app_namespace | default('automation-orchestrator') }}"
|
||||
automation_orchestrator_oidc_instance_name: "{{ automation_orchestrator_operator_instance_name | default('automation-orchestrator') }}"
|
||||
# Public base URL of the AO UI/API; "" derives it from the instance's Route.
|
||||
automation_orchestrator_oidc_url: ""
|
||||
automation_orchestrator_oidc_admin_user: admin
|
||||
automation_orchestrator_oidc_validate_certs: true
|
||||
|
||||
# --- Keycloak ---
|
||||
automation_orchestrator_oidc_keycloak_url: ""
|
||||
automation_orchestrator_oidc_keycloak_realm: ""
|
||||
automation_orchestrator_oidc_keycloak_admin_user: ""
|
||||
automation_orchestrator_oidc_keycloak_admin_password: ""
|
||||
automation_orchestrator_oidc_keycloak_validate_certs: true
|
||||
automation_orchestrator_oidc_client_id: automation-orchestrator
|
||||
# Create the Keycloak groups named in group_mappings (membership is managed in Keycloak).
|
||||
automation_orchestrator_oidc_create_keycloak_groups: true
|
||||
|
||||
# --- AO identity provider ---
|
||||
automation_orchestrator_oidc_provider_name: Keycloak
|
||||
# Keycloak group (from the "groups" claim) -> AO built-in group (admins, auditors, users).
|
||||
# Users in no mapped group are refused login.
|
||||
automation_orchestrator_oidc_group_mappings: []
|
||||
# - idp_group: ao-admins
|
||||
# group: admins
|
||||
automation_orchestrator_oidc_rp_initiated_logout: true
|
||||
# PATCH the provider even when its config is unchanged (e.g. to push a rotated client secret).
|
||||
automation_orchestrator_oidc_force_update: false
|
||||
|
||||
# The backend rejects OIDC issuers that resolve to private IPs unless this is set, and
|
||||
# the AutomationOrchestrator CR has no field for it — so the role sets the env var on the
|
||||
# backend Deployment directly. Re-run the role if the operator ever reverts it.
|
||||
automation_orchestrator_oidc_allow_private_networks: true
|
||||
|
||||
# --- Debugging ---
|
||||
automation_orchestrator_oidc_no_log: true
|
||||
99
roles/automation_orchestrator_oidc/meta/argument_specs.yml
Normal file
99
roles/automation_orchestrator_oidc/meta/argument_specs.yml
Normal file
@@ -0,0 +1,99 @@
|
||||
---
|
||||
argument_specs:
|
||||
main:
|
||||
short_description: Configure Keycloak OIDC login for Automation Orchestrator
|
||||
description:
|
||||
- Creates a confidential OIDC client (with a "groups" claim mapper) and the mapped groups
|
||||
in Keycloak, then registers Keycloak as an identity provider in Automation Orchestrator
|
||||
via its REST API, mapping Keycloak groups to AO built-in groups.
|
||||
- The client secret is read back from Keycloak on each run, so it is not stored elsewhere.
|
||||
- >-
|
||||
Sets APP_OIDC_ALLOW_PRIVATE_NETWORKS on the backend Deployment, since the
|
||||
AutomationOrchestrator CR has no field for it and the backend otherwise rejects
|
||||
issuers resolving to private IPs.
|
||||
options:
|
||||
automation_orchestrator_oidc_namespace:
|
||||
description: Namespace of the AutomationOrchestrator instance.
|
||||
type: str
|
||||
default: automation-orchestrator
|
||||
automation_orchestrator_oidc_instance_name:
|
||||
description: Name of the AutomationOrchestrator CR (prefix of its Route, Deployments and Secrets).
|
||||
type: str
|
||||
default: automation-orchestrator
|
||||
automation_orchestrator_oidc_url:
|
||||
description: Public base URL of Automation Orchestrator. Empty derives it from the instance Route.
|
||||
type: str
|
||||
default: ""
|
||||
automation_orchestrator_oidc_admin_user:
|
||||
description: Local AO admin used to call the API (password read from the initial-admin-password Secret).
|
||||
type: str
|
||||
default: admin
|
||||
automation_orchestrator_oidc_validate_certs:
|
||||
description: Verify TLS when calling the AO API.
|
||||
type: bool
|
||||
default: true
|
||||
automation_orchestrator_oidc_keycloak_url:
|
||||
description: Keycloak base URL (e.g. https://auth.example.com).
|
||||
type: str
|
||||
required: true
|
||||
automation_orchestrator_oidc_keycloak_realm:
|
||||
description: Keycloak realm holding the client and groups.
|
||||
type: str
|
||||
required: true
|
||||
automation_orchestrator_oidc_keycloak_admin_user:
|
||||
description: Keycloak master-realm admin username.
|
||||
type: str
|
||||
required: true
|
||||
automation_orchestrator_oidc_keycloak_admin_password:
|
||||
description: Keycloak master-realm admin password.
|
||||
type: str
|
||||
required: true
|
||||
no_log: true
|
||||
automation_orchestrator_oidc_keycloak_validate_certs:
|
||||
description: Verify TLS when calling the Keycloak admin API.
|
||||
type: bool
|
||||
default: true
|
||||
automation_orchestrator_oidc_client_id:
|
||||
description: Keycloak client ID for Automation Orchestrator.
|
||||
type: str
|
||||
default: automation-orchestrator
|
||||
automation_orchestrator_oidc_create_keycloak_groups:
|
||||
description: Create the Keycloak groups named in group_mappings. Group membership is managed in Keycloak.
|
||||
type: bool
|
||||
default: true
|
||||
automation_orchestrator_oidc_provider_name:
|
||||
description: Name of the identity provider in Automation Orchestrator (shown on the login page).
|
||||
type: str
|
||||
default: Keycloak
|
||||
automation_orchestrator_oidc_group_mappings:
|
||||
description: >-
|
||||
Keycloak group to AO built-in group mappings. Users in no mapped group are refused login.
|
||||
type: list
|
||||
elements: dict
|
||||
required: true
|
||||
options:
|
||||
idp_group:
|
||||
description: Keycloak group name, as emitted in the "groups" claim.
|
||||
type: str
|
||||
required: true
|
||||
group:
|
||||
description: AO built-in group.
|
||||
type: str
|
||||
required: true
|
||||
choices: [admins, auditors, users]
|
||||
automation_orchestrator_oidc_rp_initiated_logout:
|
||||
description: Log users out of Keycloak when they log out of Automation Orchestrator.
|
||||
type: bool
|
||||
default: true
|
||||
automation_orchestrator_oidc_force_update:
|
||||
description: PATCH the identity provider even when unchanged (e.g. to push a rotated client secret).
|
||||
type: bool
|
||||
default: false
|
||||
automation_orchestrator_oidc_allow_private_networks:
|
||||
description: Set APP_OIDC_ALLOW_PRIVATE_NETWORKS=true on the backend Deployment.
|
||||
type: bool
|
||||
default: true
|
||||
automation_orchestrator_oidc_no_log:
|
||||
description: Set to false to expose secret values in task output. Never set false in shared environments.
|
||||
type: bool
|
||||
default: true
|
||||
17
roles/automation_orchestrator_oidc/meta/main.yml
Normal file
17
roles/automation_orchestrator_oidc/meta/main.yml
Normal file
@@ -0,0 +1,17 @@
|
||||
---
|
||||
galaxy_info:
|
||||
author: ptoal
|
||||
description: Configure Keycloak OIDC login for Automation Orchestrator
|
||||
license: MIT
|
||||
min_ansible_version: "2.16"
|
||||
platforms:
|
||||
- name: GenericLinux
|
||||
versions:
|
||||
- all
|
||||
galaxy_tags:
|
||||
- openshift
|
||||
- aap
|
||||
- keycloak
|
||||
- oidc
|
||||
|
||||
dependencies: []
|
||||
286
roles/automation_orchestrator_oidc/tasks/main.yml
Normal file
286
roles/automation_orchestrator_oidc/tasks/main.yml
Normal file
@@ -0,0 +1,286 @@
|
||||
---
|
||||
# Configure Keycloak OIDC login for Automation Orchestrator.
|
||||
#
|
||||
# 1. Keycloak: mapped groups + confidential client with a "groups" claim mapper;
|
||||
# the client secret is read back rather than stored elsewhere.
|
||||
# 2. Backend Deployment: APP_OIDC_ALLOW_PRIVATE_NETWORKS (no CR field exists for it).
|
||||
# 3. AO REST API: create/update the identity provider with group mappings.
|
||||
#
|
||||
# AO identity providers are runtime configuration in the AO database — the
|
||||
# AutomationOrchestrator CR has no auth fields.
|
||||
|
||||
- name: Validate group mappings
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- automation_orchestrator_oidc_group_mappings | length > 0
|
||||
- >-
|
||||
automation_orchestrator_oidc_group_mappings | map(attribute='group')
|
||||
| difference(__automation_orchestrator_oidc_valid_groups) | length == 0
|
||||
fail_msg: >-
|
||||
automation_orchestrator_oidc_group_mappings must map at least one Keycloak group to an
|
||||
AO built-in group ({{ __automation_orchestrator_oidc_valid_groups | join(', ') }});
|
||||
otherwise no Keycloak user can log in.
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Step 1: Resolve the Automation Orchestrator public URL
|
||||
# ------------------------------------------------------------------
|
||||
- name: Read Automation Orchestrator Route
|
||||
kubernetes.core.k8s_info:
|
||||
api_version: route.openshift.io/v1
|
||||
kind: Route
|
||||
namespace: "{{ automation_orchestrator_oidc_namespace }}"
|
||||
name: "{{ automation_orchestrator_oidc_instance_name }}"
|
||||
register: __automation_orchestrator_oidc_route
|
||||
when: automation_orchestrator_oidc_url | length == 0
|
||||
failed_when: __automation_orchestrator_oidc_route.resources | length == 0
|
||||
|
||||
- name: Set Automation Orchestrator URL
|
||||
ansible.builtin.set_fact:
|
||||
__automation_orchestrator_oidc_url: >-
|
||||
{{ (automation_orchestrator_oidc_url
|
||||
if automation_orchestrator_oidc_url | length > 0
|
||||
else 'https://' + __automation_orchestrator_oidc_route.resources[0].spec.host)
|
||||
| regex_replace('/$', '') }}
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Step 2: Keycloak client and groups
|
||||
# ------------------------------------------------------------------
|
||||
- name: Configure Keycloak
|
||||
module_defaults:
|
||||
community.general.keycloak_group: &keycloak_auth
|
||||
auth_client_id: admin-cli
|
||||
auth_keycloak_url: "{{ automation_orchestrator_oidc_keycloak_url }}"
|
||||
auth_realm: master
|
||||
auth_username: "{{ automation_orchestrator_oidc_keycloak_admin_user }}"
|
||||
auth_password: "{{ automation_orchestrator_oidc_keycloak_admin_password }}"
|
||||
validate_certs: "{{ automation_orchestrator_oidc_keycloak_validate_certs }}"
|
||||
community.general.keycloak_clientsecret_info: *keycloak_auth
|
||||
middleware_automation.keycloak.keycloak_client: *keycloak_auth
|
||||
block:
|
||||
- name: Create mapped Keycloak groups
|
||||
community.general.keycloak_group:
|
||||
realm: "{{ automation_orchestrator_oidc_keycloak_realm }}"
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
loop: "{{ automation_orchestrator_oidc_group_mappings | map(attribute='idp_group') | unique }}"
|
||||
when: automation_orchestrator_oidc_create_keycloak_groups | bool
|
||||
|
||||
# No secret is passed: Keycloak generates one on create and keeps it on update.
|
||||
- name: Create Automation Orchestrator OIDC client in Keycloak
|
||||
middleware_automation.keycloak.keycloak_client:
|
||||
realm: "{{ automation_orchestrator_oidc_keycloak_realm }}"
|
||||
client_id: "{{ automation_orchestrator_oidc_client_id }}"
|
||||
name: Automation Orchestrator
|
||||
description: OIDC client for Automation Orchestrator at {{ __automation_orchestrator_oidc_url }}
|
||||
enabled: true
|
||||
protocol: openid-connect
|
||||
public_client: false
|
||||
standard_flow_enabled: true
|
||||
implicit_flow_enabled: false
|
||||
direct_access_grants_enabled: false
|
||||
service_accounts_enabled: false
|
||||
root_url: "{{ __automation_orchestrator_oidc_url }}"
|
||||
redirect_uris:
|
||||
- "{{ __automation_orchestrator_oidc_url }}/api/v1/auth/oidc/callback"
|
||||
web_origins:
|
||||
- "+"
|
||||
attributes:
|
||||
post.logout.redirect.uris: "{{ __automation_orchestrator_oidc_url }}##{{ __automation_orchestrator_oidc_url }}/*"
|
||||
protocol_mappers:
|
||||
- name: groups
|
||||
protocol: openid-connect
|
||||
protocolMapper: oidc-group-membership-mapper
|
||||
config:
|
||||
full.path: "false"
|
||||
id.token.claim: "true"
|
||||
access.token.claim: "true"
|
||||
userinfo.token.claim: "true"
|
||||
claim.name: groups
|
||||
state: present
|
||||
no_log: "{{ automation_orchestrator_oidc_no_log }}"
|
||||
|
||||
- name: Read Automation Orchestrator client secret from Keycloak
|
||||
community.general.keycloak_clientsecret_info:
|
||||
realm: "{{ automation_orchestrator_oidc_keycloak_realm }}"
|
||||
client_id: "{{ automation_orchestrator_oidc_client_id }}"
|
||||
register: __automation_orchestrator_oidc_clientsecret
|
||||
no_log: "{{ automation_orchestrator_oidc_no_log }}"
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Step 3: Allow private-network issuers on the backend
|
||||
# ------------------------------------------------------------------
|
||||
- name: Set APP_OIDC_ALLOW_PRIVATE_NETWORKS on backend Deployment
|
||||
kubernetes.core.k8s:
|
||||
state: patched
|
||||
merge_type: strategic-merge
|
||||
api_version: apps/v1
|
||||
kind: Deployment
|
||||
namespace: "{{ automation_orchestrator_oidc_namespace }}"
|
||||
name: "{{ automation_orchestrator_oidc_instance_name }}-backend"
|
||||
definition:
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: backend
|
||||
env:
|
||||
- name: APP_OIDC_ALLOW_PRIVATE_NETWORKS
|
||||
value: "{{ automation_orchestrator_oidc_allow_private_networks | string | lower }}"
|
||||
register: __automation_orchestrator_oidc_backend_patch
|
||||
|
||||
- name: Wait for backend rollout
|
||||
kubernetes.core.k8s_info:
|
||||
api_version: apps/v1
|
||||
kind: Deployment
|
||||
namespace: "{{ automation_orchestrator_oidc_namespace }}"
|
||||
name: "{{ automation_orchestrator_oidc_instance_name }}-backend"
|
||||
register: __automation_orchestrator_oidc_backend
|
||||
until: >-
|
||||
__automation_orchestrator_oidc_backend.resources | length > 0 and
|
||||
(__automation_orchestrator_oidc_backend.resources[0].status.observedGeneration | default(0)) >=
|
||||
__automation_orchestrator_oidc_backend.resources[0].metadata.generation and
|
||||
(__automation_orchestrator_oidc_backend.resources[0].status.updatedReplicas | default(0)) ==
|
||||
__automation_orchestrator_oidc_backend.resources[0].spec.replicas and
|
||||
(__automation_orchestrator_oidc_backend.resources[0].status.availableReplicas | default(0)) ==
|
||||
__automation_orchestrator_oidc_backend.resources[0].spec.replicas
|
||||
retries: 30
|
||||
delay: 10
|
||||
when: __automation_orchestrator_oidc_backend_patch is changed
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Step 4: Register Keycloak as an AO identity provider
|
||||
# ------------------------------------------------------------------
|
||||
- name: Read AO initial admin password
|
||||
kubernetes.core.k8s_info:
|
||||
api_version: v1
|
||||
kind: Secret
|
||||
namespace: "{{ automation_orchestrator_oidc_namespace }}"
|
||||
name: "{{ automation_orchestrator_oidc_instance_name }}-initial-admin-password"
|
||||
register: __automation_orchestrator_oidc_admin_secret
|
||||
no_log: "{{ automation_orchestrator_oidc_no_log }}"
|
||||
|
||||
- name: Log in to the AO API
|
||||
ansible.builtin.uri:
|
||||
url: "{{ __automation_orchestrator_oidc_url }}/api/v1/auth/login"
|
||||
method: POST
|
||||
body_format: json
|
||||
body:
|
||||
username: "{{ automation_orchestrator_oidc_admin_user }}"
|
||||
password: "{{ __automation_orchestrator_oidc_admin_secret.resources[0].data.password | b64decode }}"
|
||||
validate_certs: "{{ automation_orchestrator_oidc_validate_certs }}"
|
||||
register: __automation_orchestrator_oidc_login
|
||||
no_log: "{{ automation_orchestrator_oidc_no_log }}"
|
||||
|
||||
- name: Call the AO API
|
||||
module_defaults:
|
||||
ansible.builtin.uri:
|
||||
headers:
|
||||
Authorization: "Bearer {{ __automation_orchestrator_oidc_login.json.access_token }}"
|
||||
validate_certs: "{{ automation_orchestrator_oidc_validate_certs }}"
|
||||
block:
|
||||
- name: List AO groups
|
||||
ansible.builtin.uri:
|
||||
url: "{{ __automation_orchestrator_oidc_url }}/api/v1/groups?limit=100"
|
||||
register: __automation_orchestrator_oidc_groups
|
||||
|
||||
- name: List AO identity providers
|
||||
ansible.builtin.uri:
|
||||
url: "{{ __automation_orchestrator_oidc_url }}/api/v1/identity_providers?limit=100"
|
||||
register: __automation_orchestrator_oidc_idps
|
||||
|
||||
- name: Build desired identity provider configuration
|
||||
ansible.builtin.set_fact:
|
||||
__automation_orchestrator_oidc_existing: >-
|
||||
{{ __automation_orchestrator_oidc_idps.json.resources
|
||||
| selectattr('name', '==', automation_orchestrator_oidc_provider_name) | first | default({}) }}
|
||||
__automation_orchestrator_oidc_config:
|
||||
provider_type: oidc
|
||||
idp_type: custom
|
||||
auto_discovery: true
|
||||
issuer_url: "{{ __automation_orchestrator_oidc_issuer }}"
|
||||
client_id: "{{ automation_orchestrator_oidc_client_id }}"
|
||||
redirect_uri: "{{ __automation_orchestrator_oidc_url }}/api/v1/auth/oidc/callback"
|
||||
scopes: openid profile email
|
||||
group_jmespath_expression: groups
|
||||
allow_all_authenticated: false
|
||||
enable_rp_initiated_logout: "{{ automation_orchestrator_oidc_rp_initiated_logout | bool }}"
|
||||
__automation_orchestrator_oidc_group_ids: >-
|
||||
{{ __automation_orchestrator_oidc_groups.json.resources | items2dict(key_name='name', value_name='id') }}
|
||||
__automation_orchestrator_oidc_entries: []
|
||||
|
||||
- name: Build group mapping entries
|
||||
ansible.builtin.set_fact:
|
||||
__automation_orchestrator_oidc_entries: >-
|
||||
{{ __automation_orchestrator_oidc_entries + [{
|
||||
'idp_group_value': item.idp_group,
|
||||
'mapped_group_id': __automation_orchestrator_oidc_group_ids[item.group]}] }}
|
||||
loop: "{{ automation_orchestrator_oidc_group_mappings }}"
|
||||
loop_control:
|
||||
label: "{{ item.idp_group }} -> {{ item.group }}"
|
||||
|
||||
# Compare everything except client_secret (never returned by the API).
|
||||
- name: Determine whether the identity provider needs updating
|
||||
ansible.builtin.set_fact:
|
||||
__automation_orchestrator_oidc_needs_update: >-
|
||||
{{ automation_orchestrator_oidc_force_update | bool
|
||||
or not (__automation_orchestrator_oidc_existing.enabled | default(false))
|
||||
or (__automation_orchestrator_oidc_existing.configuration | default({}))
|
||||
!= ((__automation_orchestrator_oidc_existing.configuration | default({}))
|
||||
| combine(__automation_orchestrator_oidc_config))
|
||||
or ((__automation_orchestrator_oidc_existing.configuration.group_mapping_entries | default([])
|
||||
| map(attribute='idp_group_value') | zip(__automation_orchestrator_oidc_existing.configuration.group_mapping_entries
|
||||
| default([]) | map(attribute='mapped_group_id')) | map('join', '=') | sort)
|
||||
!= (__automation_orchestrator_oidc_entries | map(attribute='idp_group_value')
|
||||
| zip(__automation_orchestrator_oidc_entries | map(attribute='mapped_group_id'))
|
||||
| map('join', '=') | sort)) }}
|
||||
when: __automation_orchestrator_oidc_existing | length > 0
|
||||
|
||||
- name: Create Keycloak identity provider in AO
|
||||
ansible.builtin.uri:
|
||||
url: "{{ __automation_orchestrator_oidc_url }}/api/v1/identity_providers"
|
||||
method: POST
|
||||
body_format: json
|
||||
body:
|
||||
name: "{{ automation_orchestrator_oidc_provider_name }}"
|
||||
description: Keycloak realm {{ automation_orchestrator_oidc_keycloak_realm }}
|
||||
configuration: >-
|
||||
{{ __automation_orchestrator_oidc_config | combine({
|
||||
'client_secret': __automation_orchestrator_oidc_clientsecret.clientsecret_info.value,
|
||||
'group_mapping_entries': __automation_orchestrator_oidc_entries}) }}
|
||||
status_code: 201
|
||||
changed_when: true
|
||||
when: __automation_orchestrator_oidc_existing | length == 0
|
||||
no_log: "{{ automation_orchestrator_oidc_no_log }}"
|
||||
|
||||
- name: Update Keycloak identity provider in AO
|
||||
ansible.builtin.uri:
|
||||
url: "{{ __automation_orchestrator_oidc_url }}/api/v1/identity_providers/{{ __automation_orchestrator_oidc_existing.id }}"
|
||||
method: PATCH
|
||||
body_format: json
|
||||
body:
|
||||
enabled: true
|
||||
configuration: >-
|
||||
{{ __automation_orchestrator_oidc_config | combine({
|
||||
'client_secret': __automation_orchestrator_oidc_clientsecret.clientsecret_info.value,
|
||||
'group_mapping_entries': __automation_orchestrator_oidc_entries}) }}
|
||||
changed_when: true
|
||||
when:
|
||||
- __automation_orchestrator_oidc_existing | length > 0
|
||||
- __automation_orchestrator_oidc_needs_update | bool
|
||||
no_log: "{{ automation_orchestrator_oidc_no_log }}"
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Step 5: Summary
|
||||
# ------------------------------------------------------------------
|
||||
- name: Display Automation Orchestrator OIDC summary
|
||||
ansible.builtin.debug:
|
||||
msg:
|
||||
- "Keycloak OIDC configured for Automation Orchestrator:"
|
||||
- " Login URL : {{ __automation_orchestrator_oidc_url }}"
|
||||
- " Issuer : {{ __automation_orchestrator_oidc_issuer }}"
|
||||
- " Client : {{ automation_orchestrator_oidc_client_id }}"
|
||||
- " Mappings : {{ automation_orchestrator_oidc_group_mappings | map(attribute='idp_group')
|
||||
| zip(automation_orchestrator_oidc_group_mappings | map(attribute='group'))
|
||||
| map('join', ' -> ') | join(', ') }}"
|
||||
- ""
|
||||
- "Add users to the mapped Keycloak groups to grant access."
|
||||
8
roles/automation_orchestrator_oidc/vars/main.yml
Normal file
8
roles/automation_orchestrator_oidc/vars/main.yml
Normal file
@@ -0,0 +1,8 @@
|
||||
---
|
||||
# Computed internal variables - do not override
|
||||
__automation_orchestrator_oidc_valid_groups:
|
||||
- admins
|
||||
- auditors
|
||||
- users
|
||||
__automation_orchestrator_oidc_issuer: >-
|
||||
{{ automation_orchestrator_oidc_keycloak_url | regex_replace('/$', '') }}/realms/{{ automation_orchestrator_oidc_keycloak_realm }}
|
||||
Reference in New Issue
Block a user