sales-demos-orchestrator-configlisted

# sales-demos-orchestrator-config Connects a running Automation Orchestrator to this environment's AAP instance. Takes about **2 minutes**. This skill contains **no logic**. All the work is in [`playbooks/configure_ao.yml`](../../../playbooks/configure_ao.yml). See `CLAUDE.md` → *Skills and playbooks*. **`install_ao.yml` must have run first** — AO needs to be up and serving its Route before this can configure it. ## What it does 1. Reads the AO **Route** from the cluster to get the live URL. 2. Patches the `ao-backend` Deployment with `APP_INTEGRATION_URL_ALLOWED_HOSTS` so AO's SSRF protection allows reaching AAP (which resolves to a private IP inside the cluster). 3. Sets up AAP as an **OIDC identity provider** via `setup_aap_oidc` — users can then log into AO with their AAP credentials. 4. Creates an **AAP credential** and **AAP integration** — AO can now see job templates, workflow job templates, inventories and EEs from AAP. 5. **Validates** by querying AO's proxy endpoint to confirm job templates are visible. ## Preflight Check Run these before doing anything else. Every one must pass. ```bash ENV=${ENV:-sandbox} VAULT_ID="sales.demos@$HOME/secrets/.vault_pass_sales_demos" # 1. The vault password file exists. test -s "$HOME/secrets/.vault_pass_sales_demos" \ && echo "✅ vault password file" \ || echo "❌ ~/secrets/.vault_pass_sales_demos missing — without it secrets.yml cannot be decrypted" # 2. secrets.yml exists locally and is vault-encrypted