sales-demos-orchestrator-configlisted

Configure Automation Orchestrator post-install — connect it to AAP via OIDC (SSO login) and an AAP integration (so AO can see job templates, workflows, inventories), and allow AAP through AO's SSRF check on every component that reaches it. Runs playbooks/configure_ao.yml. TRIGGER when: the user asks to configure AO, connect AO to AAP, set up SSO for AO, set up OIDC on AO, asks why AO has no integrations, says AO login only shows local accounts, asks why AO cannot see AAP job templates, says an AO workflow's AAP step fails with 'base_url is not permitted by SSRF policy', or says an AAP step's Organization dropdown shows 'AAP Authentication Failed'. SKIP: if AO is not installed (that is sales-demos-orchestrator), or if the user wants to create or edit workflows in AO (that is the AO UI/API directly).
ericcames/sales.demos · ★ 1 · AI & Automation · score 67

Install: claude install-skill ericcames/sales.demos

# sales-demos-orchestrator-config Connects a running Automation Orchestrator to this environment's AAP instance. Takes about **2 minutes**, plus about a minute more the first time, while the AO components restart. This skill contains **no logic**. All the work is in [`playbooks/configure_ao.yml`](../../../playbooks/configure_ao.yml). See `CLAUDE.md` → *Skills and playbooks*. **`install_ao.yml` must have run first** — AO needs to be up and serving its Route before this can configure it. ## What it does 1. Reads the AO **Route** from the cluster to get the live URL. 2. Writes the **SSRF allowlist** into the ConfigMap `ao-admin-settings`: `APP_INTEGRATION_URL_ALLOWED_HOSTS` (the AAP hostname) and `APP_OIDC_ALLOW_PRIVATE_NETWORKS`. AAP resolves to a private IP inside the cluster, which AO's SSRF protection blocks by default. - **Every AO Deployment already loads that ConfigMap** through an optional `envFrom`. That matters because browsing AAP runs in `ao-backend`, but **running** an AAP step in a workflow runs in `ao-worker` (#621). - **If the ConfigMap changed,** it restarts the `ao-backend`, `ao-worker` and `ao-background-worker` pods and waits for them to be ready. - **If an older run patched the variables directly onto a Deployment,** it removes them, so the ConfigMap is the one source. - **Then it runs `printenv` inside an `ao-worker` pod** and fails if the AAP hostname is not there. 3. Sets up AAP as an **OIDC identity prov