Red Hat Ansible Automation Platform Installation Guide

This scenario includes installation of automation controller, including the web frontend, REST API backend, and database on a single machine. It installs PostgreSQL, and configures the automation controller to use that as its database. This is considered the standard automation controller installation scenario.

See "Installing automation controller with a database on the same node" in Installing Red Hat Ansible Automation Platform components on a single machine to get started.

This scenario includes installation of the automation controller server on a single machine and configures communication with a remote PostgreSQL instance as its database. This remote PostgreSQL can be a server you manage, or can be provided by a cloud service such as Amazon RDS.

See "Installing automation controller with an external managed database" in Installing Red Hat Ansible Automation Platform components on a single machine to get started.

This scenario includes installation of automation hub, including the web frontend, REST API backend, and database on a single machine. It installs PostgreSQL, and configures the automation hub to use that as its database.

See "Installing automation hub with a database on the same node" in Installing Red Hat Ansible Automation Platform components on a single machine to get started.

This scenario includes installation of the automation hub server on a single machine, and installs a remote PostgreSQL database, managed by the Red Hat Ansible Automation Platform installer.

See "Installing automation hub with an external database" in Installing Red Hat Ansible Automation Platform components on a single machine to get started.

This scenario includes installation of automation controller and automation hub with a database on the automation controller node, or a non-installer managed database.

See "Installing Red Hat Ansible Automation Platform with a database on the automation controller node or non-installer managed database" in Installing Red Hat Ansible Automation Platform to get started.

This scenario includes installation of automation controller and automation hub and configures communication with a remote PostgreSQL instance as its database. This remote PostgreSQL can be a server you manage, or can be provided by a cloud service such as Amazon RDS.

See "Installing Red Hat Ansible Automation Platform with an external managed database" in Installing Red Hat Ansible Automation Platform to get started.

This scenario includes installation of multiple automation controller nodes and an automation hub instance and configures communication with a remote PostgreSQL instance as its database. This remote PostgreSQL can be a server you manage, or can be provided by a cloud service such as Amazon RDS. In this scenario, all automation controller are active and can execute jobs, and any node can receive HTTP requests.

See "Installing a multi-node Red Hat Ansible Automation Platform with an external managed database" in Multi-machine cluster intallation to get started.

You can use the Red Hat Ansible Automation Platform installer inventory file to specify your installation scenario.

This example describes how you can populate the inventory file for a single node installation of automation controller.

[automationcontroller]
127.0.0.1 ansible_connection=local

[database]

[all:vars]
admin_password='password'

pg_host=''
pg_port=''

pg_database='awx'
pg_username='awx'
pg_password='password'

You can pass flags and extra variables when installing automation controller.

:

Use the -- separator to add any Ansible arguments you wish to apply. For example: ./setup.sh -i my_awesome_inventory.yml -e matburt_is_country_gold=True — -K.

./setup.sh -e upgrade_ansible_with_tower=1

./setup.sh -e nginx_disable_https=true

./setup.sh -e 'restore_backup_file=/path/to/nondefault/location' -r

*

To override an inventory file used by passing it as an argument to the setup script:

You can run the setup script once you finish updating the inventory file with required parameters for installing your Private Automation Hub.

The installation will begin.

Once the installation completes, you can verify your automation controller has been installed successfully by logging in with the admin credentials you inserted into the inventory file.

Your automation controller is now ready for initial configuration.

You can use the Red Hat Ansible Automation Platform installer inventory file to specify your installation scenario.

This example describes how you can populate the inventory file to deploy an installation of automation controller with an external database.

[automationcontroller]
127.0.0.1 ansible_connection=local


[database]
database.example.com

[all:vars]
admin_password='password'
pg_password='password'

pg_host='database.example.com'
pg_port='5432'

pg_database='awx'
pg_username='awx'

You can pass flags and extra variables when installing automation controller.

:

Use the -- separator to add any Ansible arguments you wish to apply. For example: ./setup.sh -i my_awesome_inventory.yml -e matburt_is_country_gold=True — -K.

./setup.sh -e upgrade_ansible_with_tower=1

./setup.sh -e nginx_disable_https=true

./setup.sh -e 'restore_backup_file=/path/to/nondefault/location' -r

*

To override an inventory file used by passing it as an argument to the setup script:

You can run the setup script once you finish updating the inventory file with required parameters for installing your Private Automation Hub.

The installation will begin.

Once the installation completes, you can verify your automation controller has been installed successfully by logging in with the admin credentials you inserted into the inventory file.

Your automation controller is now ready for initial configuration.

You can use the following settings when installing automation hub:

You can use the Red Hat Ansible Automation Platform installer inventory file to specify your installation scenario.

This example describes how you can populate the inventory file to deploy a standalone instance of automation hub.

[automationcontroller]


[automationhub]
127.0.0.1 ansible_connection=local

[all:vars]
automationhub_admin_password= <PASSWORD>

automationhub_pg_host=''
automationhub_pg_port=''

automationhub_pg_database='automationhub'
automationhub_pg_username='automationhub'
automationhub_pg_password=<PASSWORD>
automationhub_pg_sslmode='prefer'

# The default install will deploy a TLS enabled Automation Hub.
# If for some reason this is not the behavior wanted one can
# disable TLS enabled deployment.
#
# automationhub_disable_https = False
# The default install will generate self-signed certificates for the Automation
# Hub service. If you are providing valid certificate via automationhub_ssl_cert
# and automationhub_ssl_key, one should toggle that value to True.
#
# automationhub_ssl_validate_certs = False
# SSL-related variables
# If set, this will install a custom CA certificate to the system trust store.
# custom_ca_cert=/path/to/ca.crt
# Certificate and key to install in Automation Hub node
# automationhub_ssl_cert=/path/to/automationhub.cert
# automationhub_ssl_key=/path/to/automationhub.key

You can pass flags and extra variables when installing automation controller.

:

Use the -- separator to add any Ansible arguments you wish to apply. For example: ./setup.sh -i my_awesome_inventory.yml -e matburt_is_country_gold=True — -K.

./setup.sh -e upgrade_ansible_with_tower=1

./setup.sh -e nginx_disable_https=true

./setup.sh -e 'restore_backup_file=/path/to/nondefault/location' -r

*

To override an inventory file used by passing it as an argument to the setup script:

You can run the setup script once you finish updating the inventory file with required parameters for installing your Private Automation Hub.

The installation will begin.

Once the installation completes, you can verify your automation hub has been installed successfully by logging in with the admin credentials you inserted into the inventory file.

Your automation hub is now ready for initial configuration.

You can use the following settings when installing automation hub:

You can use the Red Hat Ansible Automation Platform installer inventory file to specify your installation scenario.

This example describes how you can populate the inventory file to deploy a standalone instance of automation hub.

[automationcontroller]


[automationhub]
127.0.0.1 ansible_connection=local

[database]
host2

[all:vars]
automationhub_admin_password= <PASSWORD>

automationhub_pg_host=''
automationhub_pg_port=''

automationhub_pg_database='automationhub'
automationhub_pg_username='automationhub'
automationhub_pg_password=<PASSWORD>
automationhub_pg_sslmode='prefer'

# The default install will deploy a TLS enabled Automation Hub.
# If for some reason this is not the behavior wanted one can
# disable TLS enabled deployment.
#
# automationhub_disable_https = False
# The default install will generate self-signed certificates for the Automation
# Hub service. If you are providing valid certificate via automationhub_ssl_cert
# and automationhub_ssl_key, one should toggle that value to True.
#
# automationhub_ssl_validate_certs = False
# SSL-related variables
# If set, this will install a custom CA certificate to the system trust store.
# custom_ca_cert=/path/to/ca.crt
# Certificate and key to install in Automation Hub node
# automationhub_ssl_cert=/path/to/automationhub.cert
# automationhub_ssl_key=/path/to/automationhub.key

You can pass flags and extra variables when installing automation controller.

:

Use the -- separator to add any Ansible arguments you wish to apply. For example: ./setup.sh -i my_awesome_inventory.yml -e matburt_is_country_gold=True — -K.

./setup.sh -e upgrade_ansible_with_tower=1

./setup.sh -e nginx_disable_https=true

./setup.sh -e 'restore_backup_file=/path/to/nondefault/location' -r

*

To override an inventory file used by passing it as an argument to the setup script:

You can run the setup script once you finish updating the inventory file with required parameters for installing your Private Automation Hub.

The installation will begin.

Once the installation completes, you can verify your automation controller has been installed successfully by logging in with the admin credentials you inserted into the inventory file.

Your automation controller is now ready for initial configuration.

You can use the following settings when installing automation hub:

You can use the Red Hat Ansible Automation Platform installer inventory file to specify your installation scenario.

This example describes how you can populate the inventory file to install Red Hat Ansible Automation Platform. This installation inventory file includes both automation controller and automation hub with a database on the automation controller node or non-installer managed database.

[automationcontroller]
tower.acme.org

[automationhub]
automationhub.acme.org

[all:vars]
admin_password='<password>'
pg_host='database-01.acme.org'
pg_port='5432'
pg_database='awx'
pg_username='awx'
pg_password='<password>'
pg_sslmode='prefer'  # set to 'verify-full' for client-side enforced SSL

# Automation Hub Configuration
#
automationhub_admin_password='<password>'
automationhub_pg_host='database-01.acme.org'
automationhub_pg_port='5432'
automationhub_pg_database='automationhub'
automationhub_pg_username='automationhub'
automationhub_pg_password='<password>'
automationhub_pg_sslmode='prefer'

# The default install will deploy a TLS enabled Automation Hub.
# If for some reason this is not the behavior wanted one can
# disable TLS enabled deployment.
#
# automationhub_disable_https = False
# The default install will generate self-signed certificates for the Automation
# Hub service. If you are providing valid certificate via automationhub_ssl_cert
# and automationhub_ssl_key, one should toggle that value to True.
#
# automationhub_ssl_validate_certs = False
# Isolated Tower nodes automatically generate an RSA key for authentication;
# To disable this behavior, set this value to false
# isolated_key_generation=true
# SSL-related variables
# If set, this will install a custom CA certificate to the system trust store.
# custom_ca_cert=/path/to/ca.crt
# Certificate and key to install in nginx for the web UI and API
# web_server_ssl_cert=/path/to/tower.cert
# web_server_ssl_key=/path/to/tower.key
# Certificate and key to install in Automation Hub node
# automationhub_ssl_cert=/path/to/automationhub.cert
# automationhub_ssl_key=/path/to/automationhub.key
# Server-side SSL settings for PostgreSQL (when we are installing it).
# postgres_use_ssl=False
# postgres_ssl_cert=/path/to/pgsql.crt
# postgres_ssl_key=/path/to/pgsql.key

You can pass flags and extra variables when installing automation controller.

:

Use the -- separator to add any Ansible arguments you wish to apply. For example: ./setup.sh -i my_awesome_inventory.yml -e matburt_is_country_gold=True — -K.

./setup.sh -e upgrade_ansible_with_tower=1

./setup.sh -e nginx_disable_https=true

./setup.sh -e 'restore_backup_file=/path/to/nondefault/location' -r

*

To override an inventory file used by passing it as an argument to the setup script:

You can run the setup script once you finish updating the inventory file with required parameters for installing your Private Automation Hub.

The installation will begin.

Once the installation completes, you can verify your automation controller has been installed successfully by logging in with the admin credentials you inserted into the inventory file.

Your automation controller is now ready for initial configuration.

Once the installation completes, you can verify your automation hub has been installed successfully by logging in with the admin credentials you inserted into the inventory file.

Your automation hub is now ready for initial configuration.

You can use the following settings when installing automation hub:

You can use the Red Hat Ansible Automation Platform installer inventory file to specify your installation scenario.

This example describes how you can populate the inventory file to install Red Hat Ansible Automation Platform. This installation inventory file includes both automation controller and automation hub with an external managed database.

[automationcontroller]
tower.acme.org

[automationhub]
automationhub.acme.org

[database]
database-01.acme.org

[all:vars]
admin_password='<password>'
pg_host='database-01.acme.org'
pg_port='5432'
pg_database='awx'
pg_username='awx'
pg_password='<password>'
pg_sslmode='prefer'  # set to 'verify-full' for client-side enforced SSL

# Automation Hub Configuration
#
automationhub_admin_password='<password>'
automationhub_pg_host='database-01.acme.org'
automationhub_pg_port='5432'
automationhub_pg_database='automationhub'
automationhub_pg_username='automationhub'
automationhub_pg_password='<password>'
automationhub_pg_sslmode='prefer'

# The default install will deploy a TLS enabled Automation Hub.
# If for some reason this is not the behavior wanted one can
# disable TLS enabled deployment.
#
# automationhub_disable_https = False
# The default install will generate self-signed certificates for the Automation
# Hub service. If you are providing valid certificate via automationhub_ssl_cert
# and automationhub_ssl_key, one should toggle that value to True.
#
# automationhub_ssl_validate_certs = False
# Isolated Tower nodes automatically generate an RSA key for authentication;
# To disable this behavior, set this value to false
# isolated_key_generation=true
# SSL-related variables
# If set, this will install a custom CA certificate to the system trust store.
# custom_ca_cert=/path/to/ca.crt
# Certificate and key to install in nginx for the web UI and API
# web_server_ssl_cert=/path/to/tower.cert
# web_server_ssl_key=/path/to/tower.key
# Certificate and key to install in Automation Hub node
# automationhub_ssl_cert=/path/to/automationhub.cert
# automationhub_ssl_key=/path/to/automationhub.key
# Server-side SSL settings for PostgreSQL (when we are installing it).
# postgres_use_ssl=False
# postgres_ssl_cert=/path/to/pgsql.crt
# postgres_ssl_key=/path/to/pgsql.key

You can pass flags and extra variables when installing automation controller.

:

Use the -- separator to add any Ansible arguments you wish to apply. For example: ./setup.sh -i my_awesome_inventory.yml -e matburt_is_country_gold=True — -K.

./setup.sh -e upgrade_ansible_with_tower=1

./setup.sh -e nginx_disable_https=true

./setup.sh -e 'restore_backup_file=/path/to/nondefault/location' -r

*

To override an inventory file used by passing it as an argument to the setup script:

You can run the setup script once you finish updating the inventory file with required parameters for installing your Private Automation Hub.

The installation will begin.

Once the installation completes, you can verify your automation controller has been installed successfully by logging in with the admin credentials you inserted into the inventory file.

Your automation controller is now ready for initial configuration.

You can use the following settings when installing automation hub:

You can use the Red Hat Ansible Automation Platform installer inventory file to specify your installation scenario.

This example describes how you can populate the inventory file for a multi-node cluster installation of automation controller.

[automationcontroller]
host1
host11
host12


[automationhub]
host2

[database]
host3

[all:vars]
ansible_become=true

admin_password='password'

pg_host='dbnode.example.com'
pg_port='5432'

pg_database='tower'
pg_username='tower'
pg_password='password'

You can pass flags and extra variables when installing automation controller.

:

Use the -- separator to add any Ansible arguments you wish to apply. For example: ./setup.sh -i my_awesome_inventory.yml -e matburt_is_country_gold=True — -K.

./setup.sh -e upgrade_ansible_with_tower=1

./setup.sh -e nginx_disable_https=true

./setup.sh -e 'restore_backup_file=/path/to/nondefault/location' -r

*

To override an inventory file used by passing it as an argument to the setup script:

You can run the setup script once you finish updating the inventory file with required parameters for installing your Private Automation Hub.

The installation will begin.

Once the installation completes, you can verify your automation controller has been installed successfully by logging in with the admin credentials you inserted into the inventory file.

Your automation controller is now ready for initial configuration.

When Tower is configured with REMOTE_HOST_HEADERS = ['HTTP_X_FORWARDED_FOR', 'REMOTE_ADDR', 'REMOTE_HOST'], it assumes that the value of X-Forwarded-For has originated from the proxy/load balancer sitting in front of Tower. In a scenario where Tower is still reachable without use of the proxy/load balancer or when the proxy does not validate the header, X-Forwarded-For can be spoofed fairly easily to fake the originating IP addresses. Using HTTP_X_FORWARDED_FOR in the REMOTE_HOST_HEADERS setting poses a vulnerability that essentially gives users access to certain resources that they should not have.

{ControllerNameStart} nodes connect to all other automation controller nodes via websockets. This interconnect is used to distribute all websocket emitted messages to all other automation controller nodes. This is required because any browser client websocket can subscribe to any job that may be running on any automation controller node. Websocket clients are not routed to specific automation controller nodes. Any automation controller node can handle any websocket request and each automation controller node must know about all websocket messages destined for all clients.

{ControllerNameStart} will automatically handle discovery of other automation controller nodes via the Instance record in the database.

You can control how automation controller collects data by setting your participation level in the User Interface tab in the settings menu.