---
# Deploy an Open Policy Agent server for AAP policy enforcement (policy as code)
# and point AAP's controller at it.
#
# OPA serves TLS with a service-ca certificate and requires a bearer token
# (--authentication=token, system.authz policy). AAP connects in-cluster with
# OPA_SSL=true, OPA_AUTH_TYPE=Token and the service CA bundle.
#
# AAP fails closed: once a resource has an opa_query_path, any OPA error or
# violation blocks its jobs. Nothing is attached unless opa_server_aap_query_paths
# lists it.
#
# All tasks are idempotent (kubernetes.core.k8s state: present).

- name: Resolve OPA bearer token from Vault
  ansible.builtin.include_tasks: vault_token.yml

- name: Deploy OPA server
  ansible.builtin.include_tasks: deploy.yml

- name: Configure AAP policy enforcement
  ansible.builtin.include_tasks: aap.yml
  when: opa_server_configure_aap | bool

- name: Display OPA deployment summary
  ansible.builtin.debug:
    msg:
      - "OPA server ready!"
      - "  Endpoint    : https://{{ __opa_server_host }}:{{ opa_server_port }} (in-cluster)"
      - "  Policies    : {{ __opa_server_policies.keys() | list | join(', ') }}"
      - "  Query paths : aap/policy/decision, aap/smoke/allow_all, aap/smoke/deny_all"
      - "  Token       : Vault {{ opa_server_vault_mount }}/{{ opa_server_vault_path }}"