keystone: create k8s identity providers and protocols

Author: skrobul

ansible/roles/keystone_bootstrap/defaults/main.yml

@@ -69,6 +69,10 @@ keystone_bootstrap_groups:
     #   - project: shared-services
     #     role: reader
 
+# k8s identity providers; override with your cluster issuers
+keystone_k8s_identity:
+  providers: []
+
 # k8s service account groups and their project role assignments
 # Each group can have project_roles with an optional domain to scope the project lookup
 keystone_bootstrap_k8s_groups:

ansible/roles/keystone_bootstrap/tasks/k8s.yml

@@ -30,6 +30,21 @@
             any_one_of:
               - keystone
 
+- name: Create k8s identity providers
+  openstack.cloud.federation_idp:
+    name: "{{ item.name }}"
+    is_enabled: true
+    remote_ids:
+      - "{{ item.issuer }}"
+  loop: "{{ keystone_k8s_identity.providers }}"
+
+- name: Create k8s openid protocols
+  openstack.cloud.keystone_federation_protocol:
+    name: openid
+    idp: "{{ item.name }}"
+    mapping: k8s-mapping
+  loop: "{{ keystone_k8s_identity.providers }}"
+
 - name: Create k8s service account group mappings
   ansible.builtin.include_tasks: k8s_group.yml
   loop: "{{ keystone_bootstrap_k8s_groups }}"