---
# Point the AAP controller at OPA (PolicyAsCode settings) and optionally attach
# query paths to organizations, inventories, or job templates.

- name: Read AAP admin password
  kubernetes.core.k8s_info:
    api_version: v1
    kind: Secret
    namespace: "{{ opa_server_aap_namespace }}"
    name: "{{ opa_server_aap_admin_secret }}"
  register: __opa_server_aap_admin
  no_log: true

- name: Read the service CA bundle
  kubernetes.core.k8s_info:
    api_version: v1
    kind: ConfigMap
    namespace: "{{ opa_server_namespace }}"
    name: openshift-service-ca.crt
  register: __opa_server_service_ca

- name: Resolve AAP API connection
  ansible.builtin.set_fact:
    __opa_server_aap_api: "{{ opa_server_aap_url | regex_replace('/$', '') }}/api/controller/v2"
    __opa_server_aap_password: "{{ __opa_server_aap_admin.resources[0].data.password | b64decode }}"
    __opa_server_aap_settings:
      OPA_HOST: "{{ __opa_server_host }}"
      OPA_PORT: "{{ opa_server_port | int }}"
      OPA_SSL: true
      OPA_AUTH_TYPE: Token
      OPA_AUTH_CA_CERT: "{{ __opa_server_service_ca.resources[0].data['service-ca.crt'] }}"
      OPA_REQUEST_TIMEOUT: "{{ opa_server_aap_request_timeout | float }}"
      OPA_REQUEST_RETRIES: "{{ opa_server_aap_request_retries | int }}"
  no_log: true

- name: Read AAP policy-as-code settings
  ansible.builtin.uri:
    url: "{{ __opa_server_aap_api }}/settings/policyascode/"
    user: "{{ opa_server_aap_username }}"
    password: "{{ __opa_server_aap_password }}"
    force_basic_auth: true
    validate_certs: "{{ opa_server_aap_validate_certs }}"
  register: __opa_server_aap_current
  no_log: "{{ opa_server_no_log }}"

# The token reads back as $encrypted$, so it is only resent when unset or rotated
- name: Configure AAP policy-as-code settings
  ansible.builtin.uri:
    url: "{{ __opa_server_aap_api }}/settings/policyascode/"
    method: PATCH
    user: "{{ opa_server_aap_username }}"
    password: "{{ __opa_server_aap_password }}"
    force_basic_auth: true
    validate_certs: "{{ opa_server_aap_validate_certs }}"
    body_format: json
    body: "{{ __opa_server_aap_settings | combine({'OPA_AUTH_TOKEN': __opa_server_token}) }}"
  changed_when: true
  when: >-
    (__opa_server_aap_current.json | dict2items
     | selectattr('key', 'in', __opa_server_aap_settings.keys() | list)
     | items2dict) != __opa_server_aap_settings
    or (__opa_server_aap_current.json.OPA_AUTH_TOKEN | default('')) | length == 0
    or __opa_server_token_generated | bool
  no_log: "{{ opa_server_no_log }}"

- name: Look up resources to attach policies to
  ansible.builtin.uri:
    url: "{{ __opa_server_aap_api }}/{{ item.type }}/?name={{ item.name | urlencode }}"
    user: "{{ opa_server_aap_username }}"
    password: "{{ __opa_server_aap_password }}"
    force_basic_auth: true
    validate_certs: "{{ opa_server_aap_validate_certs }}"
  register: __opa_server_aap_targets
  failed_when: >-
    __opa_server_aap_targets.status != 200 or __opa_server_aap_targets.json.count != 1
  loop: "{{ opa_server_aap_query_paths }}"
  loop_control:
    label: "{{ item.type }}/{{ item.name }}"

- name: Attach OPA query paths
  ansible.builtin.uri:
    url: "{{ __opa_server_aap_api }}/{{ item.item.type }}/{{ item.json.results[0].id }}/"
    method: PATCH
    user: "{{ opa_server_aap_username }}"
    password: "{{ __opa_server_aap_password }}"
    force_basic_auth: true
    validate_certs: "{{ opa_server_aap_validate_certs }}"
    body_format: json
    body:
      opa_query_path: "{{ item.item.query_path }}"
  changed_when: true
  when: item.json.results[0].opa_query_path | default('') != item.item.query_path
  loop: "{{ __opa_server_aap_targets.results }}"
  loop_control:
    label: "{{ item.item.type }}/{{ item.item.name }} -> {{ item.item.query_path }}"