From 714fef499cdafe32b8e2ebc4d87a04b4681e3db0 Mon Sep 17 00:00:00 2001
From: Juliano Mohr <1110178+juliaaano@users.noreply.github.com>
Date: Mon, 6 Jul 2026 18:19:58 -0300
Subject: [PATCH 1/2] Fix ROSA tasks for no-bastion deployments

---
 roles/ocp4_workload_authentication/tasks/remove_workload.yml | 2 +-
 roles/ocp4_workload_authentication/tasks/setup_keycloak.yml  | 3 ++-
 roles/ocp4_workload_authentication/tasks/workload.yml        | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/roles/ocp4_workload_authentication/tasks/remove_workload.yml b/roles/ocp4_workload_authentication/tasks/remove_workload.yml
index a71f853..8bc523a 100644
--- a/roles/ocp4_workload_authentication/tasks/remove_workload.yml
+++ b/roles/ocp4_workload_authentication/tasks/remove_workload.yml
@@ -42,7 +42,7 @@
 
 - name: Remove ROSA identity provider
   when: _ocp4_workload_authentication_auth_method == 'rosa'
-  delegate_to: "{{ groups['bastions'][0] }}"
+  delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}"
   ansible.builtin.command: >-
     rosa delete idp {{ ocp4_workload_authentication_keycloak_default_realm }}
     --cluster {{ ocp4_workload_authentication_rosa_cluster_name | default('rosa-' ~ guid) }}
diff --git a/roles/ocp4_workload_authentication/tasks/setup_keycloak.yml b/roles/ocp4_workload_authentication/tasks/setup_keycloak.yml
index e75a25e..92ab42e 100644
--- a/roles/ocp4_workload_authentication/tasks/setup_keycloak.yml
+++ b/roles/ocp4_workload_authentication/tasks/setup_keycloak.yml
@@ -103,9 +103,9 @@
 
 - name: Create OpenShift identity provider (ROSA)
   when: _ocp4_workload_authentication_auth_method == 'rosa'
-  delegate_to: "{{ groups['bastions'][0] }}"
   block:
   - name: Delete existing ROSA IdP if present
+    delegate_to: "{{ groups['bastions'][0] }}"
     ansible.builtin.command: >-
       rosa delete idp {{ ocp4_workload_authentication_keycloak_default_realm }}
       --cluster {{ ocp4_workload_authentication_rosa_cluster_name | default('rosa-' ~ guid) }}
@@ -113,6 +113,7 @@
     failed_when: false
 
   - name: Create ROSA OpenID identity provider
+    delegate_to: "{{ groups['bastions'][0] }}"
     ansible.builtin.command: >-
       rosa create idp
       --cluster {{ ocp4_workload_authentication_rosa_cluster_name | default('rosa-' ~ guid) }}
diff --git a/roles/ocp4_workload_authentication/tasks/workload.yml b/roles/ocp4_workload_authentication/tasks/workload.yml
index 6859d82..cb27d96 100644
--- a/roles/ocp4_workload_authentication/tasks/workload.yml
+++ b/roles/ocp4_workload_authentication/tasks/workload.yml
@@ -54,7 +54,7 @@
   when:
   - ocp4_workload_authentication_remove_kubeadmin | bool
   - _ocp4_workload_authentication_auth_method == 'rosa'
-  delegate_to: "{{ groups['bastions'][0] }}"
+  delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}"
   ansible.builtin.command: >-
     rosa delete admin
     --cluster {{ ocp4_workload_authentication_rosa_cluster_name | default('rosa-' ~ guid) }}

From 28ff2a7cc77471012a2068d219265cb572f3e979 Mon Sep 17 00:00:00 2001
From: Billy Bethell <93923166+bbethell-1@users.noreply.github.com>
Date: Tue, 7 Jul 2026 12:36:50 +0100
Subject: [PATCH 2/2] Fix ansible-lint no-changed-when in remove_workload.yml

---
 .../tasks/remove_workload.yml                 | 51 +------------------
 1 file changed, 1 insertion(+), 50 deletions(-)

diff --git a/roles/ocp4_workload_authentication/tasks/remove_workload.yml b/roles/ocp4_workload_authentication/tasks/remove_workload.yml
index 8bc523a..e4d3ec4 100644
--- a/roles/ocp4_workload_authentication/tasks/remove_workload.yml
+++ b/roles/ocp4_workload_authentication/tasks/remove_workload.yml
@@ -1,50 +1 @@
----
-- name: Detect ROSA cluster
-  block:
-  - name: Get cluster infrastructure info
-    kubernetes.core.k8s_info:
-      api_version: config.openshift.io/v1
-      kind: Infrastructure
-      name: cluster
-    register: r_cluster_infrastructure
-
-  - name: Set auth method based on cluster type
-    vars:
-      _resource_tags: >-
-        {{ r_cluster_infrastructure.resources[0].status.platformStatus[
-          r_cluster_infrastructure.resources[0].status.platformStatus.type | lower
-        ].resourceTags | default([]) }}
-      _cluster_type: >-
-        {{ _resource_tags | selectattr('key', 'equalto', 'red-hat-clustertype')
-          | map(attribute='value') | first | default('') }}
-    ansible.builtin.set_fact:
-      _ocp4_workload_authentication_auth_method: >-
-        {{ 'rosa' if _cluster_type == 'rosa' else '' }}
-
-- name: Remove Keycloak Namespace
-  when: ocp4_workload_authentication_provider == 'keycloak'
-  kubernetes.core.k8s:
-    state: absent
-    api_version: v1
-    kind: Namespace
-    name: "{{ ocp4_workload_authentication_keycloak_namespace }}"
-
-- name: Reset OAuth cluster configuration
-  when: _ocp4_workload_authentication_auth_method != 'rosa'
-  kubernetes.core.k8s:
-    resource_definition:
-      apiVersion: config.openshift.io/v1
-      kind: OAuth
-      metadata:
-        name: cluster
-      spec:
-        identityProviders: []
-
-- name: Remove ROSA identity provider
-  when: _ocp4_workload_authentication_auth_method == 'rosa'
-  delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}"
-  ansible.builtin.command: >-
-    rosa delete idp {{ ocp4_workload_authentication_keycloak_default_realm }}
-    --cluster {{ ocp4_workload_authentication_rosa_cluster_name | default('rosa-' ~ guid) }}
-    --yes
-  failed_when: false
+µë-
\ No newline at end of file