59 lines
1.8 KiB
YAML
59 lines
1.8 KiB
YAML
---
|
|
# --- Deployment ---
|
|
opa_server_namespace: opa
|
|
opa_server_name: opa
|
|
opa_server_image: docker.io/openpolicyagent/opa:1.21.1-static
|
|
opa_server_replicas: 1
|
|
opa_server_port: 8443
|
|
opa_server_log_level: info
|
|
# Log every decision (including the job's extra_vars) to the pod log for auditing.
|
|
opa_server_decision_logs: true
|
|
opa_server_resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 256Mi
|
|
opa_server_wait_timeout: 300
|
|
|
|
# --- Policies ---
|
|
# Every *.rego file in this directory is loaded into the server.
|
|
opa_server_policy_dir: "{{ role_path }}/files/policies"
|
|
# Exposed to policies as data.aap_policy_config (see files/policies/aap_policy.rego).
|
|
opa_server_policy_config:
|
|
allowed_ee_registries:
|
|
- aap.toal.ca/
|
|
- registry.redhat.io/
|
|
forbidden_extra_vars:
|
|
- ansible_password
|
|
- ansible_become_password
|
|
- ansible_ssh_pass
|
|
- ansible_become_pass
|
|
change_freeze: false
|
|
change_freeze_exempt_teams: []
|
|
|
|
# --- Bearer token (OPA --authentication=token) ---
|
|
# Generated on first run and stored in Vault; reused afterwards.
|
|
opa_server_vault_mount: kv
|
|
opa_server_vault_path: toallab/opa-server
|
|
|
|
# --- AAP integration ---
|
|
opa_server_configure_aap: true
|
|
opa_server_aap_url: "{{ aap_gateway_url }}"
|
|
opa_server_aap_username: admin
|
|
opa_server_aap_namespace: aap
|
|
opa_server_aap_admin_secret: aap-admin-password
|
|
opa_server_aap_validate_certs: true
|
|
opa_server_aap_request_timeout: 1.5
|
|
opa_server_aap_request_retries: 2
|
|
# Attach a policy to AAP resources. Jobs fail closed: any OPA error or violation
|
|
# blocks the launch, so start with aap/smoke/allow_all and a test resource.
|
|
# - type: organizations | inventories | job_templates
|
|
# name: Default
|
|
# query_path: aap/policy/decision
|
|
opa_server_aap_query_paths: []
|
|
|
|
# --- Debugging ---
|
|
opa_server_no_log: true
|