From 4f481bac79e05873a76707d0f6a5c77961bccafe Mon Sep 17 00:00:00 2001
From: Juliano Mohr <1110178+juliaaano@users.noreply.github.com>
Date: Tue, 7 Jul 2026 09:11:16 -0300
Subject: [PATCH] Fix ROSA IdP tasks for no-bastion deployments

---
 roles/ocp4_workload_authentication/tasks/setup_keycloak.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roles/ocp4_workload_authentication/tasks/setup_keycloak.yml b/roles/ocp4_workload_authentication/tasks/setup_keycloak.yml
index 2f8e60a..b7734d1 100644
--- a/roles/ocp4_workload_authentication/tasks/setup_keycloak.yml
+++ b/roles/ocp4_workload_authentication/tasks/setup_keycloak.yml
@@ -105,7 +105,7 @@
   when: _ocp4_workload_authentication_auth_method == 'rosa'
   block:
   - name: Delete existing ROSA IdP if present
-    delegate_to: "{{ groups['bastions'][0] }}"
+    delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}"
     ansible.builtin.command: >-
       rosa delete idp {{ ocp4_workload_authentication_keycloak_default_realm }}
       --cluster {{ ocp4_workload_authentication_rosa_cluster_name | default('rosa-' ~ guid) }}
@@ -114,7 +114,7 @@
     changed_when: false
 
   - name: Create ROSA OpenID identity provider
-    delegate_to: "{{ groups['bastions'][0] }}"
+    delegate_to: "{{ (groups['bastions'] | default(['localhost']))[0] }}"
     ansible.builtin.command: >-
       rosa create idp
       --cluster {{ ocp4_workload_authentication_rosa_cluster_name | default('rosa-' ~ guid) }}