39 lines
2.0 KiB
YAML
39 lines
2.0 KiB
YAML
---
|
|
# --- Automation Orchestrator instance ---
|
|
# Defaults track the automation_orchestrator_operator role's variables when set.
|
|
automation_orchestrator_oidc_namespace: "{{ automation_orchestrator_operator_app_namespace | default('automation-orchestrator') }}"
|
|
automation_orchestrator_oidc_instance_name: "{{ automation_orchestrator_operator_instance_name | default('automation-orchestrator') }}"
|
|
# Public base URL of the AO UI/API; "" derives it from the instance's Route.
|
|
automation_orchestrator_oidc_url: ""
|
|
automation_orchestrator_oidc_admin_user: admin
|
|
automation_orchestrator_oidc_validate_certs: true
|
|
|
|
# --- Keycloak ---
|
|
automation_orchestrator_oidc_keycloak_url: ""
|
|
automation_orchestrator_oidc_keycloak_realm: ""
|
|
automation_orchestrator_oidc_keycloak_admin_user: ""
|
|
automation_orchestrator_oidc_keycloak_admin_password: ""
|
|
automation_orchestrator_oidc_keycloak_validate_certs: true
|
|
automation_orchestrator_oidc_client_id: automation-orchestrator
|
|
# Create the Keycloak groups named in group_mappings (membership is managed in Keycloak).
|
|
automation_orchestrator_oidc_create_keycloak_groups: true
|
|
|
|
# --- AO identity provider ---
|
|
automation_orchestrator_oidc_provider_name: Keycloak
|
|
# Keycloak group (from the "groups" claim) -> AO built-in group (admins, auditors, users).
|
|
# Users in no mapped group are refused login.
|
|
automation_orchestrator_oidc_group_mappings: []
|
|
# - idp_group: ao-admins
|
|
# group: admins
|
|
automation_orchestrator_oidc_rp_initiated_logout: true
|
|
# PATCH the provider even when its config is unchanged (e.g. to push a rotated client secret).
|
|
automation_orchestrator_oidc_force_update: false
|
|
|
|
# The backend rejects OIDC issuers that resolve to private IPs unless this is set, and
|
|
# the AutomationOrchestrator CR has no field for it — so the role sets the env var on the
|
|
# backend Deployment directly. Re-run the role if the operator ever reverts it.
|
|
automation_orchestrator_oidc_allow_private_networks: true
|
|
|
|
# --- Debugging ---
|
|
automation_orchestrator_oidc_no_log: true
|