Add Automation Orchestrator Install and setup

roles/automation_orchestrator_operator/defaults/main.yml

@@ -0,0 +1,81 @@
+---
+# --- OLM subscription ---
+# Automation Orchestrator is published in redhat-operators. To install a pre-release
+# build instead (as aapctl's scripts/create-catalogsources.sh does), set:
+#   automation_orchestrator_operator_catalog_source_name: cs-automation-orchestrator
+#   automation_orchestrator_operator_catalog_image: quay.io/aap/ansible-automation-platform/automation-orchestrator-operator-index@sha256:...
+# plus automation_orchestrator_operator_image_digest_mirrors below.
+#
+# To adopt an existing install (e.g. from OperatorHub), point operator_namespace at
+# it: an existing OperatorGroup in that namespace is reused, not duplicated, and an
+# already-installed CSV skips InstallPlan approval.
+automation_orchestrator_operator_operator_namespace: automation-orchestrator
+automation_orchestrator_operator_channel: stable
+automation_orchestrator_operator_name: automation-orchestrator-operator
+automation_orchestrator_operator_catalog_source_name: redhat-operators
+# Index image for a custom CatalogSource; "" uses the existing catalog_source_name as-is.
+automation_orchestrator_operator_catalog_image: ""
+# Manual: the role approves the initial InstallPlan only (upgrades stay pending).
+automation_orchestrator_operator_install_plan_approval: Manual
+automation_orchestrator_operator_wait_timeout: 600
+
+# --- Pre-release image mirrors (ImageDigestMirrorSet) ---
+# Only needed for pre-release builds whose images are not on registry.redhat.io.
+# Cluster-wide; applying it triggers a MachineConfigPool rollout. Pre-release example:
+#   - source: registry.redhat.io/ansible-automation-platform-27-next
+#     mirrors: [quay.io/aap/ansible-automation-platform-27-next]
+#   - source: registry.redhat.io/ansible-automation-platform-27
+#     mirrors: [quay.io/aap/ansible-automation-platform-27-next]
+automation_orchestrator_operator_idms_name: idms-aap-27-next
+automation_orchestrator_operator_image_digest_mirrors: []
+automation_orchestrator_operator_mcp_wait_timeout: 1800
+
+# --- AutomationOrchestrator CR ---
+# Same as the operator namespace by default (aapctl runs OLM + CR in one namespace);
+# override only if you need to split the cluster-scoped operator from the app instance.
+automation_orchestrator_operator_app_namespace: "{{ automation_orchestrator_operator_operator_namespace }}"
+automation_orchestrator_operator_instance_name: automation-orchestrator
+
+# --- PostgreSQL (bring-your-own) ---
+# Defaults match the Secrets/Service created by the cloudnativepg_operator role
+# (run it first, or point these at a customer-managed PostgreSQL instance instead).
+automation_orchestrator_operator_postgres_host: orchestrator-postgres-rw
+automation_orchestrator_operator_postgres_port: 5432
+automation_orchestrator_operator_postgres_ssl_mode: verify-ca
+# Name of a pre-existing Secret (key ca.crt). CloudNativePG auto-generates
+# "<cluster-name>-ca" for its Cluster CR. Only used with sslMode verify-ca/verify-full.
+automation_orchestrator_operator_postgres_ca_cert_secret: orchestrator-postgres-ca
+
+# Names of pre-existing Secrets (keys: database, username, password) — created by
+# cloudnativepg_operator, or your own Secrets when using a customer-managed PostgreSQL.
+automation_orchestrator_operator_backend_db_secret_name: orchestrator-postgres-secret
+automation_orchestrator_operator_temporal_db_secret_name: temporal-postgres-secret
+
+# --- Ingress ---
+# Route (OpenShift) or Ingress (AKS); the operator manages the resource itself.
+automation_orchestrator_operator_ingress_type: Route
+automation_orchestrator_operator_ingress_host: ""
+automation_orchestrator_operator_ingress_annotations: {}
+# Only used when ingress_type is Ingress — name of a pre-existing kubernetes.io/tls Secret.
+automation_orchestrator_operator_ingress_tls_secret_name: ""
+
+# --- Component workload images (only needed for private registries) ---
+automation_orchestrator_operator_image_pull_secrets: []
+
+# --- Per-component overrides (replicas, resources, affinity, tolerations, nodeSelector) ---
+# Passed through as-is into the matching spec.<component> block; leave {} for operator defaults.
+automation_orchestrator_operator_backend: {}
+automation_orchestrator_operator_ui: {}
+automation_orchestrator_operator_worker: {}
+automation_orchestrator_operator_background_worker: {}
+automation_orchestrator_operator_redis: {}
+automation_orchestrator_operator_temporal_server: {}
+
+# Escape hatch: recursively merged into the generated spec last, for fields
+# (fileStorage, otel, tls, secrets, workflowHttpRequestAllowedHosts, ...) not
+# otherwise exposed as dedicated variables above.
+automation_orchestrator_operator_extra_spec: {}
+
+# --- Debugging ---
+# Set to false to disable no_log and expose secret values in task output.
+automation_orchestrator_operator_no_log: true