Add Automation Orchestrator Install and setup

roles/automation_orchestrator_oidc/meta/argument_specs.yml

@@ -0,0 +1,99 @@
+---
+argument_specs:
+  main:
+    short_description: Configure Keycloak OIDC login for Automation Orchestrator
+    description:
+      - Creates a confidential OIDC client (with a "groups" claim mapper) and the mapped groups
+        in Keycloak, then registers Keycloak as an identity provider in Automation Orchestrator
+        via its REST API, mapping Keycloak groups to AO built-in groups.
+      - The client secret is read back from Keycloak on each run, so it is not stored elsewhere.
+      - >-
+        Sets APP_OIDC_ALLOW_PRIVATE_NETWORKS on the backend Deployment, since the
+        AutomationOrchestrator CR has no field for it and the backend otherwise rejects
+        issuers resolving to private IPs.
+    options:
+      automation_orchestrator_oidc_namespace:
+        description: Namespace of the AutomationOrchestrator instance.
+        type: str
+        default: automation-orchestrator
+      automation_orchestrator_oidc_instance_name:
+        description: Name of the AutomationOrchestrator CR (prefix of its Route, Deployments and Secrets).
+        type: str
+        default: automation-orchestrator
+      automation_orchestrator_oidc_url:
+        description: Public base URL of Automation Orchestrator. Empty derives it from the instance Route.
+        type: str
+        default: ""
+      automation_orchestrator_oidc_admin_user:
+        description: Local AO admin used to call the API (password read from the initial-admin-password Secret).
+        type: str
+        default: admin
+      automation_orchestrator_oidc_validate_certs:
+        description: Verify TLS when calling the AO API.
+        type: bool
+        default: true
+      automation_orchestrator_oidc_keycloak_url:
+        description: Keycloak base URL (e.g. https://auth.example.com).
+        type: str
+        required: true
+      automation_orchestrator_oidc_keycloak_realm:
+        description: Keycloak realm holding the client and groups.
+        type: str
+        required: true
+      automation_orchestrator_oidc_keycloak_admin_user:
+        description: Keycloak master-realm admin username.
+        type: str
+        required: true
+      automation_orchestrator_oidc_keycloak_admin_password:
+        description: Keycloak master-realm admin password.
+        type: str
+        required: true
+        no_log: true
+      automation_orchestrator_oidc_keycloak_validate_certs:
+        description: Verify TLS when calling the Keycloak admin API.
+        type: bool
+        default: true
+      automation_orchestrator_oidc_client_id:
+        description: Keycloak client ID for Automation Orchestrator.
+        type: str
+        default: automation-orchestrator
+      automation_orchestrator_oidc_create_keycloak_groups:
+        description: Create the Keycloak groups named in group_mappings. Group membership is managed in Keycloak.
+        type: bool
+        default: true
+      automation_orchestrator_oidc_provider_name:
+        description: Name of the identity provider in Automation Orchestrator (shown on the login page).
+        type: str
+        default: Keycloak
+      automation_orchestrator_oidc_group_mappings:
+        description: >-
+          Keycloak group to AO built-in group mappings. Users in no mapped group are refused login.
+        type: list
+        elements: dict
+        required: true
+        options:
+          idp_group:
+            description: Keycloak group name, as emitted in the "groups" claim.
+            type: str
+            required: true
+          group:
+            description: AO built-in group.
+            type: str
+            required: true
+            choices: [admins, auditors, users]
+      automation_orchestrator_oidc_rp_initiated_logout:
+        description: Log users out of Keycloak when they log out of Automation Orchestrator.
+        type: bool
+        default: true
+      automation_orchestrator_oidc_force_update:
+        description: PATCH the identity provider even when unchanged (e.g. to push a rotated client secret).
+        type: bool
+        default: false
+      automation_orchestrator_oidc_allow_private_networks:
+        description: Set APP_OIDC_ALLOW_PRIVATE_NETWORKS=true on the backend Deployment.
+        type: bool
+        default: true
+      automation_orchestrator_oidc_no_log:
+        description: Set to false to expose secret values in task output. Never set false in shared environments.
+        type: bool
+        default: true

roles/automation_orchestrator_oidc/meta/main.yml

@@ -0,0 +1,17 @@
+---
+galaxy_info:
+  author: ptoal
+  description: Configure Keycloak OIDC login for Automation Orchestrator
+  license: MIT
+  min_ansible_version: "2.16"
+  platforms:
+    - name: GenericLinux
+      versions:
+        - all
+  galaxy_tags:
+    - openshift
+    - aap
+    - keycloak
+    - oidc
+
+dependencies: []