96 lines
3.7 KiB
YAML
96 lines
3.7 KiB
YAML
---
|
|
# Point the AAP controller at OPA (PolicyAsCode settings) and optionally attach
|
|
# query paths to organizations, inventories, or job templates.
|
|
|
|
- name: Read AAP admin password
|
|
kubernetes.core.k8s_info:
|
|
api_version: v1
|
|
kind: Secret
|
|
namespace: "{{ opa_server_aap_namespace }}"
|
|
name: "{{ opa_server_aap_admin_secret }}"
|
|
register: __opa_server_aap_admin
|
|
no_log: true
|
|
|
|
- name: Read the service CA bundle
|
|
kubernetes.core.k8s_info:
|
|
api_version: v1
|
|
kind: ConfigMap
|
|
namespace: "{{ opa_server_namespace }}"
|
|
name: openshift-service-ca.crt
|
|
register: __opa_server_service_ca
|
|
|
|
- name: Resolve AAP API connection
|
|
ansible.builtin.set_fact:
|
|
__opa_server_aap_api: "{{ opa_server_aap_url | regex_replace('/$', '') }}/api/controller/v2"
|
|
__opa_server_aap_password: "{{ __opa_server_aap_admin.resources[0].data.password | b64decode }}"
|
|
__opa_server_aap_settings:
|
|
OPA_HOST: "{{ __opa_server_host }}"
|
|
OPA_PORT: "{{ opa_server_port | int }}"
|
|
OPA_SSL: true
|
|
OPA_AUTH_TYPE: Token
|
|
OPA_AUTH_CA_CERT: "{{ __opa_server_service_ca.resources[0].data['service-ca.crt'] }}"
|
|
OPA_REQUEST_TIMEOUT: "{{ opa_server_aap_request_timeout | float }}"
|
|
OPA_REQUEST_RETRIES: "{{ opa_server_aap_request_retries | int }}"
|
|
no_log: true
|
|
|
|
- name: Read AAP policy-as-code settings
|
|
ansible.builtin.uri:
|
|
url: "{{ __opa_server_aap_api }}/settings/policyascode/"
|
|
user: "{{ opa_server_aap_username }}"
|
|
password: "{{ __opa_server_aap_password }}"
|
|
force_basic_auth: true
|
|
validate_certs: "{{ opa_server_aap_validate_certs }}"
|
|
register: __opa_server_aap_current
|
|
no_log: "{{ opa_server_no_log }}"
|
|
|
|
# The token reads back as $encrypted$, so it is only resent when unset or rotated
|
|
- name: Configure AAP policy-as-code settings
|
|
ansible.builtin.uri:
|
|
url: "{{ __opa_server_aap_api }}/settings/policyascode/"
|
|
method: PATCH
|
|
user: "{{ opa_server_aap_username }}"
|
|
password: "{{ __opa_server_aap_password }}"
|
|
force_basic_auth: true
|
|
validate_certs: "{{ opa_server_aap_validate_certs }}"
|
|
body_format: json
|
|
body: "{{ __opa_server_aap_settings | combine({'OPA_AUTH_TOKEN': __opa_server_token}) }}"
|
|
changed_when: true
|
|
when: >-
|
|
(__opa_server_aap_current.json | dict2items
|
|
| selectattr('key', 'in', __opa_server_aap_settings.keys() | list)
|
|
| items2dict) != __opa_server_aap_settings
|
|
or (__opa_server_aap_current.json.OPA_AUTH_TOKEN | default('')) | length == 0
|
|
or __opa_server_token_generated | bool
|
|
no_log: "{{ opa_server_no_log }}"
|
|
|
|
- name: Look up resources to attach policies to
|
|
ansible.builtin.uri:
|
|
url: "{{ __opa_server_aap_api }}/{{ item.type }}/?name={{ item.name | urlencode }}"
|
|
user: "{{ opa_server_aap_username }}"
|
|
password: "{{ __opa_server_aap_password }}"
|
|
force_basic_auth: true
|
|
validate_certs: "{{ opa_server_aap_validate_certs }}"
|
|
register: __opa_server_aap_targets
|
|
failed_when: >-
|
|
__opa_server_aap_targets.status != 200 or __opa_server_aap_targets.json.count != 1
|
|
loop: "{{ opa_server_aap_query_paths }}"
|
|
loop_control:
|
|
label: "{{ item.type }}/{{ item.name }}"
|
|
|
|
- name: Attach OPA query paths
|
|
ansible.builtin.uri:
|
|
url: "{{ __opa_server_aap_api }}/{{ item.item.type }}/{{ item.json.results[0].id }}/"
|
|
method: PATCH
|
|
user: "{{ opa_server_aap_username }}"
|
|
password: "{{ __opa_server_aap_password }}"
|
|
force_basic_auth: true
|
|
validate_certs: "{{ opa_server_aap_validate_certs }}"
|
|
body_format: json
|
|
body:
|
|
opa_query_path: "{{ item.item.query_path }}"
|
|
changed_when: true
|
|
when: item.json.results[0].opa_query_path | default('') != item.item.query_path
|
|
loop: "{{ __opa_server_aap_targets.results }}"
|
|
loop_control:
|
|
label: "{{ item.item.type }}/{{ item.item.name }} -> {{ item.item.query_path }}"
|