---
# Deploy Automation Orchestrator on OpenShift via its OLM operator, backed by a
# CloudNativePG-provisioned PostgreSQL cluster.
#
# WARNING: CloudNativePG here is a single-instance, operator-provisioned PostgreSQL
# cluster intended for demo/dev use — not production. For production, disable the
# cloudnativepg_operator role below and point automation_orchestrator_operator's
# postgres_* variables at a customer-managed PostgreSQL instance instead.
#
# Authenticates via the same aap-deployer ServiceAccount token used by deploy_aap.yml
# (same cluster). The token is stored in 1Password as vault_aap_deployer_token.
#
# Modeled on https://github.com/ansible/aapctl (aap-plus install path).
#
# Prerequisites:
#   - OpenShift cluster deployed (deploy_openshift.yml)
#   - aap-deployer ServiceAccount provisioned (re-run after RBAC changes):
#       ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
#   - CloudNativePG uses Manual install-plan approval; the role approves its
#     InstallPlan. Automation Orchestrator installs from redhat-operators and
#     adopts an existing operator install when its namespace is set in inventory.
#   - Pre-release AO builds additionally need a custom CatalogSource and an
#     ImageDigestMirrorSet (see automation_orchestrator_operator defaults).
#
# Keycloak OIDC (--tags ao_configure_oidc, run after the install):
#   - Keycloak settings come from the openshift host (keycloak_url, keycloak_realm,
#     keycloak_admin_user, vault_keycloak_admin_password).
#   - automation_orchestrator_oidc_group_mappings in host_vars for the aap host.
#   - The client secret is generated by Keycloak and read back each run (not vaulted).
#
# Usage:
#   ansible-navigator run playbooks/deploy_automation_orchestrator.yml --mode stdout
#   ansible-navigator run playbooks/deploy_automation_orchestrator.yml --mode stdout --tags ao_configure_oidc

- name: Install Automation Orchestrator
  hosts: aap
  gather_facts: false
  connection: local

  environment:
    K8S_AUTH_HOST: "{{ aap_k8s_api_url }}"
    K8S_AUTH_API_KEY: "{{ vault_aap_deployer_token }}"

  pre_tasks:
    - name: Verify aap-deployer token is available
      ansible.builtin.assert:
        that:
          - vault_aap_deployer_token is defined
          - vault_aap_deployer_token | length > 0
        fail_msg: >-
          vault_aap_deployer_token is not set. Provision the ServiceAccount with:
          ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
          Then save the displayed token to 1Password as vault_aap_deployer_token.

  roles:
    - role: cloudnativepg_operator
    - role: automation_orchestrator_operator

# ---------------------------------------------------------------------------
# Configure Keycloak OIDC login (optional, run after the install)
# ---------------------------------------------------------------------------
- name: Configure Keycloak OIDC for Automation Orchestrator
  hosts: aap
  gather_facts: false
  connection: local

  tags:
    - never
    - ao_configure_oidc

  vars:
    __ao_keycloak_host: "{{ hostvars[groups['openshift'][0]] }}"
    automation_orchestrator_oidc_keycloak_url: "{{ __ao_keycloak_host.keycloak_url }}{{ __ao_keycloak_host.keycloak_context | default('') }}"
    automation_orchestrator_oidc_keycloak_realm: "{{ __ao_keycloak_host.keycloak_realm }}"
    automation_orchestrator_oidc_keycloak_admin_user: "{{ __ao_keycloak_host.keycloak_admin_user }}"
    automation_orchestrator_oidc_keycloak_admin_password: "{{ __ao_keycloak_host.vault_keycloak_admin_password }}"
    automation_orchestrator_oidc_keycloak_validate_certs: "{{ __ao_keycloak_host.keycloak_validate_certs | default(true) }}"

  environment:
    K8S_AUTH_HOST: "{{ aap_k8s_api_url }}"
    K8S_AUTH_API_KEY: "{{ vault_aap_deployer_token }}"

  roles:
    - role: automation_orchestrator_oidc