---
# Deploy Red Hat OpenShift AI 3.5 Models-as-a-Service and publish the existing
# llama-coder (llama.cpp) server through it as an ExternalModel.
#
# WARNING: the MaaS database is a single-instance CloudNativePG cluster intended
# for demo/dev use — not production.
#
# Technology Preview: MaaS is GA in 3.5, but ExternalModel (used here to front
# llama.cpp instead of a KServe LLMInferenceService) is Technology Preview.
#
# Prerequisites:
#   - OpenShift cluster deployed (deploy_openshift.yml) with cert-manager
#   - rhoai-deployer ServiceAccount provisioned (re-run after RBAC changes):
#       ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
#   - vault_rhoai_deployer_token set in host_vars (see hashivault_secrets.yml)
#   - llama-coder running in llm-coding-assistant with secret llama-coder-api-key
#
# Usage:
#   ansible-navigator run playbooks/deploy_rhoai_maas.yml --mode stdout

- name: Deploy OpenShift AI Models-as-a-Service
  hosts: sno.openshift.toal.ca
  gather_facts: false
  connection: local

  environment:
    K8S_AUTH_HOST: "{{ rhoai_maas_k8s_api_url | default('https://api.' ~ ocp_cluster_name ~ '.' ~ ocp_base_domain ~ ':6443') }}"
    K8S_AUTH_API_KEY: "{{ vault_rhoai_deployer_token }}"

  pre_tasks:
    - name: Verify rhoai-deployer token is available
      ansible.builtin.assert:
        that:
          - vault_rhoai_deployer_token is defined
          - vault_rhoai_deployer_token | length > 0
        fail_msg: >-
          vault_rhoai_deployer_token is not set. Provision the ServiceAccount with:
          ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
          Then reference kv/data/toallab/rhoai-deployer:token as vault_rhoai_deployer_token.

  roles:
    - role: cloudnativepg_operator
      vars:
        cloudnativepg_operator_cluster_namespace: rhoai-maas-db
        cloudnativepg_operator_cluster_name: maas-postgres
        cloudnativepg_operator_owner_user: maas
        cloudnativepg_operator_max_connections: 100
        cloudnativepg_operator_databases:
          - name: maas
            dbname: maas
        cloudnativepg_operator_secrets:
          - name: maas-postgres-secret
            database: maas
        cloudnativepg_operator_vault_path: cloudnativepg/maas-postgres
    - role: rhoai_maas