---
# Deploy an Open Policy Agent server on OpenShift and wire it into AAP's
# policy enforcement (policy as code).
#
# Authenticates via the aap-deployer ServiceAccount token used by deploy_aap.yml
# (same cluster). The token is stored in 1Password as vault_aap_deployer_token.
#
# Prerequisites:
#   - AAP deployed (deploy_aap.yml) and aap_gateway_url set for the aap host
#   - aap-deployer ServiceAccount RBAC current (re-run after RBAC changes):
#       ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
#
# Policies live in roles/opa_server/files/policies; test them with:
#   podman run --rm -v ./roles/opa_server/files:/files:Z docker.io/openpolicyagent/opa:1.21.1-static \
#     test /files/policies /files/tests -v
#
# Attaching a policy (AAP fails closed — start with aap/smoke/allow_all):
#   -e '{"opa_server_aap_query_paths": [{"type": "job_templates", "name": "Demo Job Template",
#        "query_path": "aap/policy/decision"}]}'
#
# Usage:
#   ansible-navigator run playbooks/deploy_opa.yml --mode stdout

- name: Deploy OPA server for AAP policy enforcement
  hosts: aap
  gather_facts: false
  connection: local

  environment:
    K8S_AUTH_HOST: "{{ aap_k8s_api_url }}"
    K8S_AUTH_API_KEY: "{{ vault_aap_deployer_token }}"

  pre_tasks:
    - name: Verify aap-deployer token and AAP URL are available
      ansible.builtin.assert:
        that:
          - vault_aap_deployer_token is defined
          - vault_aap_deployer_token | length > 0
          - aap_gateway_url is defined
        fail_msg: >-
          vault_aap_deployer_token or aap_gateway_url is not set. Provision the ServiceAccount with:
          ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts

  roles:
    - role: opa_server
      vars:
        opa_server_aap_namespace: "{{ aap_operator_namespace | default('aap') }}"
        opa_server_aap_admin_secret: "{{ aap_operator_platform_name | default('aap') }}-admin-password"
        opa_server_aap_username: "{{ aap_operator_admin_user | default('admin') }}"