---
argument_specs:
  main:
    short_description: Deploy an OPA server for AAP policy enforcement
    description:
      - Deploys Open Policy Agent with TLS (service-ca) and bearer-token authentication, loading
        the Rego policies in opa_server_policy_dir and opa_server_policy_config as
        data.aap_policy_config.
      - Configures AAP's PolicyAsCode settings to use it and optionally attaches opa_query_path
        to organizations, inventories, or job templates. AAP fails closed once a path is attached.
      - The bearer token is generated on first run and stored in Vault at opa_server_vault_path.
    options:
      opa_server_namespace:
        description: Namespace for the OPA server.
        type: str
        default: opa
      opa_server_name:
        description: Name for the Deployment, Service, and derived resources.
        type: str
        default: opa
      opa_server_image:
        description: OPA container image (pin an exact version).
        type: str
        default: docker.io/openpolicyagent/opa:1.21.1-static
      opa_server_replicas:
        description: Number of OPA replicas.
        type: int
        default: 1
      opa_server_port:
        description: HTTPS port OPA listens on and the Service exposes.
        type: int
        default: 8443
      opa_server_log_level:
        description: OPA log level.
        type: str
        choices: [debug, info, warn, error]
        default: info
      opa_server_decision_logs:
        description: Log every decision (including job extra_vars) to the pod log.
        type: bool
        default: true
      opa_server_resources:
        description: Container resource requests and limits.
        type: dict
      opa_server_wait_timeout:
        description: Seconds to wait for the OPA Deployment to become available.
        type: int
        default: 300
      opa_server_policy_dir:
        description: Directory whose *.rego files are loaded into OPA.
        type: path
      opa_server_policy_config:
        description: Policy tunables exposed as data.aap_policy_config.
        type: dict
      opa_server_vault_mount:
        description: Vault KV2 mount for the bearer token.
        type: str
        default: kv
      opa_server_vault_path:
        description: Vault KV2 path for the bearer token.
        type: str
        default: toallab/opa-server
      opa_server_configure_aap:
        description: Configure AAP's PolicyAsCode settings to use this server.
        type: bool
        default: true
      opa_server_aap_url:
        description: AAP gateway URL.
        type: str
      opa_server_aap_username:
        description: AAP admin username.
        type: str
        default: admin
      opa_server_aap_namespace:
        description: Namespace of the AAP instance (holds the admin password secret).
        type: str
        default: aap
      opa_server_aap_admin_secret:
        description: Secret holding the AAP admin password (key password).
        type: str
        default: aap-admin-password
      opa_server_aap_validate_certs:
        description: Validate the AAP gateway certificate.
        type: bool
        default: true
      opa_server_aap_request_timeout:
        description: OPA_REQUEST_TIMEOUT in seconds.
        type: float
        default: 1.5
      opa_server_aap_request_retries:
        description: OPA_REQUEST_RETRIES.
        type: int
        default: 2
      opa_server_aap_query_paths:
        description: Resources to attach a policy to (type organizations|inventories|job_templates,
          name, query_path).
        type: list
        elements: dict
        default: []
      opa_server_no_log:
        description: Set to false to expose secret values in task output.
        type: bool
        default: true