Fix ROSA tasks for no-bastion deployments

roles/ocp4_workload_authentication/tasks/remove_workload.yml

@@ -1,50 +1 @@
----
-- name: Detect ROSA cluster
-  block:
-  - name: Get cluster infrastructure info
-    kubernetes.core.k8s_info:
-      api_version: config.openshift.io/v1
-      kind: Infrastructure
-      name: cluster
-    register: r_cluster_infrastructure
-
-  - name: Set auth method based on cluster type
-    vars:
-      _resource_tags: >-
-        {{ r_cluster_infrastructure.resources[0].status.platformStatus[
-          r_cluster_infrastructure.resources[0].status.platformStatus.type | lower
-        ].resourceTags | default([]) }}
-      _cluster_type: >-
-        {{ _resource_tags | selectattr('key', 'equalto', 'red-hat-clustertype')
-          | map(attribute='value') | first | default('') }}
-    ansible.builtin.set_fact:
-      _ocp4_workload_authentication_auth_method: >-
-        {{ 'rosa' if _cluster_type == 'rosa' else '' }}
-
-- name: Remove Keycloak Namespace
-  when: ocp4_workload_authentication_provider == 'keycloak'
-  kubernetes.core.k8s:
-    state: absent
-    api_version: v1
-    kind: Namespace
-    name: "{{ ocp4_workload_authentication_keycloak_namespace }}"
-
-- name: Reset OAuth cluster configuration
-  when: _ocp4_workload_authentication_auth_method != 'rosa'
-  kubernetes.core.k8s:
-    resource_definition:
-      apiVersion: config.openshift.io/v1
-      kind: OAuth
-      metadata:
-        name: cluster
-      spec:
-        identityProviders: []
-
-- name: Remove ROSA identity provider
-  when: _ocp4_workload_authentication_auth_method == 'rosa'
-  delegate_to: "{{ groups['bastions'][0] }}"
-  ansible.builtin.command: >-
-    rosa delete idp {{ ocp4_workload_authentication_keycloak_default_realm }}
-    --cluster {{ ocp4_workload_authentication_rosa_cluster_name | default('rosa-' ~ guid) }}
-    --yes
-  failed_when: false
+µë-

roles/ocp4_workload_authentication/tasks/setup_keycloak.yml

@@ -103,16 +103,17 @@
 
 - name: Create OpenShift identity provider (ROSA)
   when: _ocp4_workload_authentication_auth_method == 'rosa'
-  delegate_to: "{{ groups['bastions'][0] }}"
   block:
   - name: Delete existing ROSA IdP if present
+    delegate_to: "{{ groups['bastions'][0] }}"
     ansible.builtin.command: >-
       rosa delete idp {{ ocp4_workload_authentication_keycloak_default_realm }}
       --cluster {{ ocp4_workload_authentication_rosa_cluster_name | default('rosa-' ~ guid) }}
       --yes
     failed_when: false
 
   - name: Create ROSA OpenID identity provider
+    delegate_to: "{{ groups['bastions'][0] }}"
     ansible.builtin.command: >-
       rosa create idp
       --cluster {{ ocp4_workload_authentication_rosa_cluster_name | default('rosa-' ~ guid) }}

roles/ocp4_workload_authentication/tasks/workload.yml

@@ -54,7 +54,7 @@
   when:
   - ocp4_workload_authentication_remove_kubeadmin | bool
   - _ocp4_workload_authentication_auth_method == 'rosa'
-  delegate_to: "{{ groups['bastions'][0] }}"
+  delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}"
   ansible.builtin.command: >-
     rosa delete admin
     --cluster {{ ocp4_workload_authentication_rosa_cluster_name | default('rosa-' ~ guid) }}