Add Automation Orchestrator Install and setup

roles/automation_orchestrator_oidc/defaults/main.yml

@@ -0,0 +1,38 @@
+---
+# --- Automation Orchestrator instance ---
+# Defaults track the automation_orchestrator_operator role's variables when set.
+automation_orchestrator_oidc_namespace: "{{ automation_orchestrator_operator_app_namespace | default('automation-orchestrator') }}"
+automation_orchestrator_oidc_instance_name: "{{ automation_orchestrator_operator_instance_name | default('automation-orchestrator') }}"
+# Public base URL of the AO UI/API; "" derives it from the instance's Route.
+automation_orchestrator_oidc_url: ""
+automation_orchestrator_oidc_admin_user: admin
+automation_orchestrator_oidc_validate_certs: true
+
+# --- Keycloak ---
+automation_orchestrator_oidc_keycloak_url: ""
+automation_orchestrator_oidc_keycloak_realm: ""
+automation_orchestrator_oidc_keycloak_admin_user: ""
+automation_orchestrator_oidc_keycloak_admin_password: ""
+automation_orchestrator_oidc_keycloak_validate_certs: true
+automation_orchestrator_oidc_client_id: automation-orchestrator
+# Create the Keycloak groups named in group_mappings (membership is managed in Keycloak).
+automation_orchestrator_oidc_create_keycloak_groups: true
+
+# --- AO identity provider ---
+automation_orchestrator_oidc_provider_name: Keycloak
+# Keycloak group (from the "groups" claim) -> AO built-in group (admins, auditors, users).
+# Users in no mapped group are refused login.
+automation_orchestrator_oidc_group_mappings: []
+#   - idp_group: ao-admins
+#     group: admins
+automation_orchestrator_oidc_rp_initiated_logout: true
+# PATCH the provider even when its config is unchanged (e.g. to push a rotated client secret).
+automation_orchestrator_oidc_force_update: false
+
+# The backend rejects OIDC issuers that resolve to private IPs unless this is set, and
+# the AutomationOrchestrator CR has no field for it — so the role sets the env var on the
+# backend Deployment directly. Re-run the role if the operator ever reverts it.
+automation_orchestrator_oidc_allow_private_networks: true
+
+# --- Debugging ---
+automation_orchestrator_oidc_no_log: true