Chapter 9. Patch releases

We are writing to inform you of an issue discovered during the final sign-off process for the Ansible Lightspeed 2.6 release that impacts a subset of customers.

Ansible Lightspeed customers who deploy using the Red Hat OpenShift Container Platform (OCP) installer will encounter a specific error when attempting to use the Chatbot feature to retrieve information about Ansible Automation Platform. This manifests as a 403 Forbidden error.

A similar issue also affects customers who utilize the containerized installer with the Enterprise topology. Crucially, this issue does not affect customers using the containerized installer with the Growth or All-in-One topology.

The 403 error is caused by a Cross-Site Request Forgery (CSRF) protection mechanism not correctly recognizing the origin of the Chatbot’s request in the affected deployment configurations. This prevents the Chatbot from functioning as intended for these specific customer segments.

We have identified a viable workaround that can be implemented by affected customers immediately:

Customers must edit their AnsibleAutomationPlatform kind value in the configuration to include a new extra_setting variable and wait for redeployment.

Example:

kind: AnsibleAutomationPlatform
  spec:
    lightspeed:
      extra_settings:
        - setting: CSRF_TRUSTED_ORIGINS
          value: 'https://gateway-onprem-signoff-26.apps.aap-test2.w6n5.p1.openshiftapps.com'

kind: AnsibleAutomationPlatform
  spec:
    lightspeed:
      extra_settings:
        - setting: CSRF_TRUSTED_ORIGINS
          value: 'https://gateway-onprem-signoff-26.apps.aap-test2.w6n5.p1.openshiftapps.com'

Our engineering team is prioritizing a permanent fix for this issue, which will be included in a forthcoming patch release. We will provide updates on the timeline for the fix shortly.

Please disseminate this information to your relevant customer-facing and support teams so they can proactively assist customers encountering this issue with the provided workaround.

Thank you for your understanding and continued support.

Availability to deploy and configure Ansible MCP servers

Added the new Ansible Automation Platform MCP Server to the 2.6 stream.(AAP-58863)

Event-Driven Ansible event-stream mTLS configuration added to installer.(AAP-46070)

RFC 2818 is now enforced between the lightspeed service and the identity provider (gateway) during the OAuth2 authorisation.

Ability to deploy Red Hat Ansible Lightspeed on new containerized installations of Ansible Automation Platform 2.6

You can deploy and use Red Hat Ansible Lightspeed when you install or upgrade to a containerized installation of Ansible Automation Platform 2.6.

Red Hat Ansible Lightspeed includes two main components that enhance your automation experience with generative artificial intelligence (AI):

Ansible Lightspeed intelligent assistant, which is an AI-powered, intuitive chat interface embedded within the Ansible Automation Platform.

The integration of Red Hat Ansible Lightspeed intelligent assistant with the Model Context Protocol (MCP) server is available as a Technology Preview release. This integration enhances the user experience by delivering relevant, dynamically sourced data results to your queries.

Ansible Lightspeed coding assistant, which is a generative AI service that works with IBM watsonx Code Assistant to help developers create and maintain Ansible content more efficiently.

For more information, see Deploying Red Hat Ansible Lightspeed on containerized Ansible Automation Platform in the containerized install user guide.

Fixed an issue where the envoy.log for automation gateway did not receive logs after it was rotated.(AAP-51779)

Fixed an issue where REDHAT_CANDLEPIN_VERIFY was not being used for the correct CA permissions so that the controller could not make requests to subscription.rhsm.redhat.com.(AAP-55183)

Fixed an issue where there was stability issue on long-running jobs, clusters under heavy load, and network flakiness.(AAP-53742)