feat(v2): Adding support for integrating AAP as part of a MTV hook

[sabre1041]

Description

Added a role/playbook to integrate into MTV hook framework

Type of Change

• feat: A new feature
• fix: A bug fix
• docs: Documentation changes
• style: Formatting, missing semi colons, etc; no code change
• refactor: Refactoring production code
• test: Adding missing tests, refactoring tests; no production code change
• chore: Updating configs, etc; no production code change

Testing

The role documentation has the steps necessary for setting up the integration. Until a new EE is published, the following standalone playbook can be used instead of the one provided in the playbooks dir as part of this PR

---
- name: Invoke AAP Using an MTV Hook (Standalone)
  hosts: localhost
  connection: local
  gather_facts: false
  vars:
    aap_credentials_secret: "mtv-aap-credentials"
    aap_credentials_secret_namespace: ""
    namespace_file: /var/run/secrets/kubernetes.io/serviceaccount/namespace
    aap_organization: Default
    aap_job_template: mtv-migration-job-template
    aap_job_template_extra_vars: {}
    mtv_workload_file: workload.yml
    mtv_plan_file: plan.yml
    mtv_hook_secure_logging: "{{ secure_logging | default(true) }}"
    aap_job_template_wait: true
  tasks:
    - name: Read namespace from file
      when: aap_credentials_secret_namespace | trim | length == 0
      block:
        - name: Read namespace file
          ansible.builtin.slurp:
            src: "{{ namespace_file }}"
          register: __namespace_file_result

        - name: Set aap_credentials_secret_namespace from file
          ansible.builtin.set_fact:
            aap_credentials_secret_namespace: "{{ __namespace_file_result.content | b64decode | trim }}"

    - name: Load Variable Files
      ansible.builtin.include_vars:
        file: "{{ item.file }}"
        name: "{{ item.var }}"
      loop_control:
        label: "{{ item.file }} -> {{ item.var }}"
      loop:
        - { file: '{{ mtv_workload_file }}', var: 'workload' }
        - { file: '{{ mtv_plan_file }}', var: 'plan' }

    - name: Retrieve AAP Credentials Secret
      no_log: "{{ mtv_hook_secure_logging }}"
      kubernetes.core.k8s_info:
        api_version: v1
        kind: Secret
        name: "{{ aap_credentials_secret }}"
        namespace: "{{ aap_credentials_secret_namespace | default(omit) }}"
      register: __aap_credentials_secret_result

    - name: Validate Required Secret Keys
      vars:
        __secret_data: "{{ __aap_credentials_secret_result.resources[0].data | default({}) }}"
        __has_token: "{{ 'aap_token' in __secret_data }}"
        __has_userpass: "{{ 'aap_username' in __secret_data and 'aap_password' in __secret_data }}"
      ansible.builtin.assert:
        that:
          - __aap_credentials_secret_result.resources | length > 0
          - "'aap_controller_hostname' in __secret_data"
          - __has_token or __has_userpass
          - not (__has_token and __has_userpass)
        fail_msg: >-
          Secret '{{ aap_credentials_secret }}' must contain 'aap_controller_hostname'
          and either 'aap_token' or both 'aap_username' and 'aap_password' (not both methods).
        quiet: true

    - name: Set AAP Credential Facts
      no_log: "{{ mtv_hook_secure_logging }}"
      vars:
        __secret_data: "{{ __aap_credentials_secret_result.resources[0].data }}"
      ansible.builtin.set_fact:
        __aap_controller_hostname: >-
          {{ __secret_data.aap_controller_hostname | default('', True) | b64decode }}
        __aap_token: >-
          {{ __secret_data.aap_token | default('', True) | b64decode | default(omit) }}
        __aap_username: >-
          {{ __secret_data.aap_username | default('', True) | b64decode | default(omit) }}
        __aap_password: >-
          {{ __secret_data.aap_password | default('', True) | b64decode | default(omit) }}
        __aap_validate_certs: >-
          {{ __secret_data.aap_validate_certs | default('', True) | b64decode | default(true, True) }}

    - name: Launch Job Template
      ansible.builtin.include_role:
        name: infra.aap_configuration.controller_job_launch
      vars:
        aap_hostname: "{{ __aap_controller_hostname }}"
        aap_token: "{{ __aap_token | default(omit) }}"
        aap_username: "{{ __aap_username | default(omit) }}"
        aap_password: "{{ __aap_password | default(omit) }}"
        aap_validate_certs: "{{ __aap_validate_certs }}"
        controller_launch_jobs:
          - name: "{{ aap_job_template }}"
            organization: "{{ aap_organization }}"
            extra_vars: "{{ aap_job_template_extra_vars | combine({'workload': workload, 'plan': plan}) }}"
            wait: "{{ aap_job_template_wait }}"
...

[tech2734]

Looks great — clean role structure, solid credential handling, and thorough README. Two minor nits:

1. Playbook task name: playbooks/mtv_hook_invoke_aap.yml line 12 says "Create MTV provider for source-target pair" — looks like a copy-paste from the provider playbook. Should probably be "Invoke AAP using MTV hook" or similar.

2. Missing role_name in meta/main.yml: The other roles in the collection explicitly set role_name: in galaxy_info. Worth adding role_name: mtv_hook_invoke_aap for consistency.

Neither is a blocker. Approving.

[sabre1041]

@tech2734 updated PR based on your feedback

[tech2734]

Both previously flagged items are fixed — role_name added to meta and playbook task name corrected.

One minor nit: the play name in playbooks/mtv_hook_invoke_aap.yml still has a trailing "Source" (Invoke AAP From an MTV Hook Source) which reads a bit awkwardly. Not a blocker.