104 lines
3.7 KiB
YAML
104 lines
3.7 KiB
YAML
---
|
|
argument_specs:
|
|
main:
|
|
short_description: Deploy an OPA server for AAP policy enforcement
|
|
description:
|
|
- Deploys Open Policy Agent with TLS (service-ca) and bearer-token authentication, loading
|
|
the Rego policies in opa_server_policy_dir and opa_server_policy_config as
|
|
data.aap_policy_config.
|
|
- Configures AAP's PolicyAsCode settings to use it and optionally attaches opa_query_path
|
|
to organizations, inventories, or job templates. AAP fails closed once a path is attached.
|
|
- The bearer token is generated on first run and stored in Vault at opa_server_vault_path.
|
|
options:
|
|
opa_server_namespace:
|
|
description: Namespace for the OPA server.
|
|
type: str
|
|
default: opa
|
|
opa_server_name:
|
|
description: Name for the Deployment, Service, and derived resources.
|
|
type: str
|
|
default: opa
|
|
opa_server_image:
|
|
description: OPA container image (pin an exact version).
|
|
type: str
|
|
default: docker.io/openpolicyagent/opa:1.21.1-static
|
|
opa_server_replicas:
|
|
description: Number of OPA replicas.
|
|
type: int
|
|
default: 1
|
|
opa_server_port:
|
|
description: HTTPS port OPA listens on and the Service exposes.
|
|
type: int
|
|
default: 8443
|
|
opa_server_log_level:
|
|
description: OPA log level.
|
|
type: str
|
|
choices: [debug, info, warn, error]
|
|
default: info
|
|
opa_server_decision_logs:
|
|
description: Log every decision (including job extra_vars) to the pod log.
|
|
type: bool
|
|
default: true
|
|
opa_server_resources:
|
|
description: Container resource requests and limits.
|
|
type: dict
|
|
opa_server_wait_timeout:
|
|
description: Seconds to wait for the OPA Deployment to become available.
|
|
type: int
|
|
default: 300
|
|
opa_server_policy_dir:
|
|
description: Directory whose *.rego files are loaded into OPA.
|
|
type: path
|
|
opa_server_policy_config:
|
|
description: Policy tunables exposed as data.aap_policy_config.
|
|
type: dict
|
|
opa_server_vault_mount:
|
|
description: Vault KV2 mount for the bearer token.
|
|
type: str
|
|
default: kv
|
|
opa_server_vault_path:
|
|
description: Vault KV2 path for the bearer token.
|
|
type: str
|
|
default: toallab/opa-server
|
|
opa_server_configure_aap:
|
|
description: Configure AAP's PolicyAsCode settings to use this server.
|
|
type: bool
|
|
default: true
|
|
opa_server_aap_url:
|
|
description: AAP gateway URL.
|
|
type: str
|
|
opa_server_aap_username:
|
|
description: AAP admin username.
|
|
type: str
|
|
default: admin
|
|
opa_server_aap_namespace:
|
|
description: Namespace of the AAP instance (holds the admin password secret).
|
|
type: str
|
|
default: aap
|
|
opa_server_aap_admin_secret:
|
|
description: Secret holding the AAP admin password (key password).
|
|
type: str
|
|
default: aap-admin-password
|
|
opa_server_aap_validate_certs:
|
|
description: Validate the AAP gateway certificate.
|
|
type: bool
|
|
default: true
|
|
opa_server_aap_request_timeout:
|
|
description: OPA_REQUEST_TIMEOUT in seconds.
|
|
type: float
|
|
default: 1.5
|
|
opa_server_aap_request_retries:
|
|
description: OPA_REQUEST_RETRIES.
|
|
type: int
|
|
default: 2
|
|
opa_server_aap_query_paths:
|
|
description: Resources to attach a policy to (type organizations|inventories|job_templates,
|
|
name, query_path).
|
|
type: list
|
|
elements: dict
|
|
default: []
|
|
opa_server_no_log:
|
|
description: Set to false to expose secret values in task output.
|
|
type: bool
|
|
default: true
|