50 lines
2.0 KiB
YAML
50 lines
2.0 KiB
YAML
---
|
|
# Deploy an Open Policy Agent server on OpenShift and wire it into AAP's
|
|
# policy enforcement (policy as code).
|
|
#
|
|
# Authenticates via the aap-deployer ServiceAccount token used by deploy_aap.yml
|
|
# (same cluster). The token is stored in 1Password as vault_aap_deployer_token.
|
|
#
|
|
# Prerequisites:
|
|
# - AAP deployed (deploy_aap.yml) and aap_gateway_url set for the aap host
|
|
# - aap-deployer ServiceAccount RBAC current (re-run after RBAC changes):
|
|
# ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
|
|
#
|
|
# Policies live in roles/opa_server/files/policies; test them with:
|
|
# podman run --rm -v ./roles/opa_server/files:/files:Z docker.io/openpolicyagent/opa:1.21.1-static \
|
|
# test /files/policies /files/tests -v
|
|
#
|
|
# Attaching a policy (AAP fails closed — start with aap/smoke/allow_all):
|
|
# -e '{"opa_server_aap_query_paths": [{"type": "job_templates", "name": "Demo Job Template",
|
|
# "query_path": "aap/policy/decision"}]}'
|
|
#
|
|
# Usage:
|
|
# ansible-navigator run playbooks/deploy_opa.yml --mode stdout
|
|
|
|
- name: Deploy OPA server for AAP policy enforcement
|
|
hosts: aap
|
|
gather_facts: false
|
|
connection: local
|
|
|
|
environment:
|
|
K8S_AUTH_HOST: "{{ aap_k8s_api_url }}"
|
|
K8S_AUTH_API_KEY: "{{ vault_aap_deployer_token }}"
|
|
|
|
pre_tasks:
|
|
- name: Verify aap-deployer token and AAP URL are available
|
|
ansible.builtin.assert:
|
|
that:
|
|
- vault_aap_deployer_token is defined
|
|
- vault_aap_deployer_token | length > 0
|
|
- aap_gateway_url is defined
|
|
fail_msg: >-
|
|
vault_aap_deployer_token or aap_gateway_url is not set. Provision the ServiceAccount with:
|
|
ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
|
|
|
|
roles:
|
|
- role: opa_server
|
|
vars:
|
|
opa_server_aap_namespace: "{{ aap_operator_namespace | default('aap') }}"
|
|
opa_server_aap_admin_secret: "{{ aap_operator_platform_name | default('aap') }}-admin-password"
|
|
opa_server_aap_username: "{{ aap_operator_admin_user | default('admin') }}"
|