85 lines
3.8 KiB
YAML
85 lines
3.8 KiB
YAML
---
|
|
# Deploy Automation Orchestrator on OpenShift via its OLM operator, backed by a
|
|
# CloudNativePG-provisioned PostgreSQL cluster.
|
|
#
|
|
# WARNING: CloudNativePG here is a single-instance, operator-provisioned PostgreSQL
|
|
# cluster intended for demo/dev use — not production. For production, disable the
|
|
# cloudnativepg_operator role below and point automation_orchestrator_operator's
|
|
# postgres_* variables at a customer-managed PostgreSQL instance instead.
|
|
#
|
|
# Authenticates via the same aap-deployer ServiceAccount token used by deploy_aap.yml
|
|
# (same cluster). The token is stored in 1Password as vault_aap_deployer_token.
|
|
#
|
|
# Modeled on https://github.com/ansible/aapctl (aap-plus install path).
|
|
#
|
|
# Prerequisites:
|
|
# - OpenShift cluster deployed (deploy_openshift.yml)
|
|
# - aap-deployer ServiceAccount provisioned (re-run after RBAC changes):
|
|
# ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
|
|
# - CloudNativePG uses Manual install-plan approval; the role approves its
|
|
# InstallPlan. Automation Orchestrator installs from redhat-operators and
|
|
# adopts an existing operator install when its namespace is set in inventory.
|
|
# - Pre-release AO builds additionally need a custom CatalogSource and an
|
|
# ImageDigestMirrorSet (see automation_orchestrator_operator defaults).
|
|
#
|
|
# Keycloak OIDC (--tags ao_configure_oidc, run after the install):
|
|
# - Keycloak settings come from the openshift host (keycloak_url, keycloak_realm,
|
|
# keycloak_admin_user, vault_keycloak_admin_password).
|
|
# - automation_orchestrator_oidc_group_mappings in host_vars for the aap host.
|
|
# - The client secret is generated by Keycloak and read back each run (not vaulted).
|
|
#
|
|
# Usage:
|
|
# ansible-navigator run playbooks/deploy_automation_orchestrator.yml --mode stdout
|
|
# ansible-navigator run playbooks/deploy_automation_orchestrator.yml --mode stdout --tags ao_configure_oidc
|
|
|
|
- name: Install Automation Orchestrator
|
|
hosts: aap
|
|
gather_facts: false
|
|
connection: local
|
|
|
|
environment:
|
|
K8S_AUTH_HOST: "{{ aap_k8s_api_url }}"
|
|
K8S_AUTH_API_KEY: "{{ vault_aap_deployer_token }}"
|
|
|
|
pre_tasks:
|
|
- name: Verify aap-deployer token is available
|
|
ansible.builtin.assert:
|
|
that:
|
|
- vault_aap_deployer_token is defined
|
|
- vault_aap_deployer_token | length > 0
|
|
fail_msg: >-
|
|
vault_aap_deployer_token is not set. Provision the ServiceAccount with:
|
|
ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
|
|
Then save the displayed token to 1Password as vault_aap_deployer_token.
|
|
|
|
roles:
|
|
- role: cloudnativepg_operator
|
|
- role: automation_orchestrator_operator
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Configure Keycloak OIDC login (optional, run after the install)
|
|
# ---------------------------------------------------------------------------
|
|
- name: Configure Keycloak OIDC for Automation Orchestrator
|
|
hosts: aap
|
|
gather_facts: false
|
|
connection: local
|
|
|
|
tags:
|
|
- never
|
|
- ao_configure_oidc
|
|
|
|
vars:
|
|
__ao_keycloak_host: "{{ hostvars[groups['openshift'][0]] }}"
|
|
automation_orchestrator_oidc_keycloak_url: "{{ __ao_keycloak_host.keycloak_url }}{{ __ao_keycloak_host.keycloak_context | default('') }}"
|
|
automation_orchestrator_oidc_keycloak_realm: "{{ __ao_keycloak_host.keycloak_realm }}"
|
|
automation_orchestrator_oidc_keycloak_admin_user: "{{ __ao_keycloak_host.keycloak_admin_user }}"
|
|
automation_orchestrator_oidc_keycloak_admin_password: "{{ __ao_keycloak_host.vault_keycloak_admin_password }}"
|
|
automation_orchestrator_oidc_keycloak_validate_certs: "{{ __ao_keycloak_host.keycloak_validate_certs | default(true) }}"
|
|
|
|
environment:
|
|
K8S_AUTH_HOST: "{{ aap_k8s_api_url }}"
|
|
K8S_AUTH_API_KEY: "{{ vault_aap_deployer_token }}"
|
|
|
|
roles:
|
|
- role: automation_orchestrator_oidc
|