I should have also said that not just admins can use the playbook. The credentials to oVirt should be stored ansible-vault so that they are not visible. Its a bit of a step up and more than a bit of a learning curve but if you use Ansible Tower (or AWX) you can trivially allow an end user to run that playbook without them ever knowing the credentials to oVirt. You can do exactly the same thing with other products, for example Oracle RDBMS. We use Ansible playbooks to allow first level support to extend Oracle tablespaces, and shut/no shut ports on Cisco switches. This without them ever knowing the credentials to the thing they are affecting.
I don't want to be Red Hat's marketing department but Ansible Tower (nowadays Ansible Automation Platform) is the only product I've ever used that lives up to the marketing hype.