33 lines
1.3 KiB
YAML
33 lines
1.3 KiB
YAML
---
|
|
# Deploy an Open Policy Agent server for AAP policy enforcement (policy as code)
|
|
# and point AAP's controller at it.
|
|
#
|
|
# OPA serves TLS with a service-ca certificate and requires a bearer token
|
|
# (--authentication=token, system.authz policy). AAP connects in-cluster with
|
|
# OPA_SSL=true, OPA_AUTH_TYPE=Token and the service CA bundle.
|
|
#
|
|
# AAP fails closed: once a resource has an opa_query_path, any OPA error or
|
|
# violation blocks its jobs. Nothing is attached unless opa_server_aap_query_paths
|
|
# lists it.
|
|
#
|
|
# All tasks are idempotent (kubernetes.core.k8s state: present).
|
|
|
|
- name: Resolve OPA bearer token from Vault
|
|
ansible.builtin.include_tasks: vault_token.yml
|
|
|
|
- name: Deploy OPA server
|
|
ansible.builtin.include_tasks: deploy.yml
|
|
|
|
- name: Configure AAP policy enforcement
|
|
ansible.builtin.include_tasks: aap.yml
|
|
when: opa_server_configure_aap | bool
|
|
|
|
- name: Display OPA deployment summary
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "OPA server ready!"
|
|
- " Endpoint : https://{{ __opa_server_host }}:{{ opa_server_port }} (in-cluster)"
|
|
- " Policies : {{ __opa_server_policies.keys() | list | join(', ') }}"
|
|
- " Query paths : aap/policy/decision, aap/smoke/allow_all, aap/smoke/deny_all"
|
|
- " Token : Vault {{ opa_server_vault_mount }}/{{ opa_server_vault_path }}"
|