Red Hat Ansible Automation Platform Operator Installation Guide

1. Navigate to Operators → Installed Operators, then click on the Ansible Automation Platform operator.
2. Locate the Automation controller tab, then click Create instance.

1. Create a postgres_configuration_secret .yaml file, following the template below:

   apiVersion: v1
   kind: Secret
   metadata:
     name: external-postgres-configuration
     namespace: <target_namespace> 1
   stringData:
     host: "<external_ip_or_url_resolvable_by_the_cluster>" 2
     port: "<external_port>" 3
     database: "<desired_database_name>"
     username: "<username_to_connect_as>"
     password: "<password_to_connect_with>" 4
     sslmode: "prefer" 5
     type: "unmanaged"
   type: Opaque

   1

   Namespace to create the secret in. This should be the same namespace you wish to deploy to.

   2

   The resolvable hostname for your database node.

   3

   External port defaults to 5432.

   4

   Value for variable password should not contain single or double quotes (', ") or backslashes (\) to avoid any issues during deployment, backup or restoration.

   5

   The variable sslmode is valid for external databases only. The allowed values are: prefer, disable, allow, require, verify-ca, and verify-full.

2. Apply external-postgres-configuration-secret.yml to your cluster using the oc create command.

   $ oc create -f external-postgres-configuration-secret.yml

3. When creating your AutomationController custom resource object, specify the secret on your spec, following the example below:

   apiVersion: awx.ansible.com/v1beta1
   kind: AutomationController
   metadata:
     name: controller-dev
   spec:
     postgres_configuration_secret: external-postgres-configuration

Procedure

1. List the existing PVCs in your deployment namespace:

   oc get pvc -n <namespace>

2. Identify the PVC associated with your previous deployment by comparing the old deployment name and the PVC name.

3. Delete the old PVC:

   oc delete pvc -n <namespace> <pvc-name>

   == Additional resources

   • For more information on running operators on OpenShift Container Platform, navigate to the OpenShift Container Platform product documentation and click the Operators - Working with Operators in OpenShift Container Platform guide.

1. Navigate to Operators → Installed Operators.
2. Locate the Automation hub entry, then click Create instance.

1. Navigate to Networking → Routes.
2. Under Location, click on the URL for your automation hub instance.

1. Create a postgres_configuration_secret .yaml file, following the template below:

   apiVersion: v1
   kind: Secret
   metadata:
     name: external-postgres-configuration
     namespace: <target_namespace> 1
   stringData:
     host: "<external_ip_or_url_resolvable_by_the_cluster>" 2
     port: "<external_port>" 3
     database: "<desired_database_name>"
     username: "<username_to_connect_as>"
     password: "<password_to_connect_with>" 4
     sslmode: "prefer" 5
     type: "unmanaged"
   type: Opaque

   1

   Namespace to create the secret in. This should be the same namespace you wish to deploy to.

   2

   The resolvable hostname for your database node.

   3

   External port defaults to 5432.

   4

   Value for variable password should not contain single or double quotes (', ") or backslashes (\) to avoid any issues during deployment, backup or restoration.

   5

   The variable sslmode is valid for external databases only. The allowed values are: prefer, disable, allow, require, verify-ca, and verify-full.

2. Apply external-postgres-configuration-secret.yml to your cluster using the oc create command.

   $ oc create -f external-postgres-configuration-secret.yml

3. When creating your AutomationHub custom resource object, specify the secret on your spec, following the example below:

   apiVersion: awx.ansible.com/v1beta1
   kind: AutomationHub
   metadata:
     name: hub-dev
   spec:
     postgres_configuration_secret: external-postgres-configuration

Procedure

1. List the existing PVCs in your deployment namespace:

   oc get pvc -n <namespace>

2. Identify the PVC associated with your previous deployment by comparing the old deployment name and the PVC name.

3. Delete the old PVC:

   oc delete pvc -n <namespace> <pvc-name>

   == Additional resources

   • For more information on running operators on OpenShift Container Platform, navigate to the OpenShift Container Platform product documentation and click the Operators - Working with Operators in OpenShift Container Platform guide.

1. Create a project for the operator

   oc new-project ansible-automation-platform

2. Create a file called sub.yaml.

3. Add the following YAML code to the sub.yaml file.

   ---
   apiVersion: v1
   kind: Namespace
   metadata:
     labels:
       openshift.io/cluster-monitoring: "true"
     name: ansible-automation-platform
   ---
   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: ansible-automation-platform-operator
     namespace: ansible-automation-platform
   spec:
     targetNamespaces:
       - ansible-automation-platform
   ---
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: ansible-automation-platform
     namespace: ansible-automation-platform
   spec:
     channel: 'stable-2.1'
     installPlanApproval: Automatic
     name: ansible-automation-platform-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
   ---
   apiVersion: automationcontroller.ansible.com/v1beta1
   kind: AutomationController
   metadata:
     name: example
     namespace: ansible-automation-platform
   spec:
     replicas: 1

   This file creates a Subscription object called ansible-automation-platform that subscribes the ansible-automation-platform namespace to the ansible-automation-platform-operator operator.

   It then creates an AutomationController object called example in the ansible-automation-platform namespace.

   To change the Automation controller name from example, edit the name field in the kind: AutomationController section of sub.yaml and replace <automation_controller_name> with the name you want to use:

   apiVersion: automationcontroller.ansible.com/v1beta1
   kind: AutomationController
   metadata:
     name: <automation_controller_name>
     namespace: ansible-automation-platform

4. Run the oc apply command to create the objects specified in the sub.yaml file:

   oc apply -f sub.yaml

Procedure

1. Navigate to Operator → Installed Operators.
2. Select the rh-sso project.
3. Select the Red Hat Single Sign-On Operator.
4. On the Red Hat Single Sign-On Operator details page select Keycloak.
5. Click Create instance.

6. Click YAML view.

   The default Keycloak custom resource is as follows:

   apiVersion: keycloak.org/v1alpha1
   kind: Keycloak
   metadata:
     name: example-keycloak
     labels:
   	app: sso
     namespace: aap
   spec:
     externalAccess:
   	enabled: true
     instances: 1

7. Click Create
8. When deployment is complete, you can use this credential to login to the administrative console.
9. You can find the credentials for the administrator in the credential-<custom-resource> (example keycloak) secret in the namespace.

Procedure

1. Navigate to Operator → Installed Operators.
2. Select the Red Hat Single Sign-On Operator project.
3. Select the Keycloak Realm tab and click Create Keycloak Realm.

4. On the Keycloak Realm form, select YAML view. Edit the YAML file as follows:

   kind: KeycloakRealm
   apiVersion: keycloak.org/v1alpha1
   metadata:
     name: ansible-automation-platform-keycloakrealm
     namespace: rh-sso
     labels:
       app: sso
       realm: ansible-automation-platform
   spec:
     realm:
       id: ansible-automation-platform
       realm: ansible-automation-platform
       enabled: true
       displayName: {PlatformNameShort}
     instanceSelector:
       matchLabels:
         app: sso

   Field	Description
   metadata.name	Set a unique value in metadata for the name of the configuration resource (CR).
   metadata.namespace	Set a unique value in metadata for the name of the configuration resource (CR).
   metadata.labels.app	Set labels to a unique value. This is used when creating the client CR.
   metadata.labels.realm	Set labels to a unique value. This is used when creating the client CR.
   spec.realm.id	Set the realm name and id. These must be the same.
   spec.realm.realm	Set the realm name and id. These must be the same.
   spec.realm.displayname	Set the name to display.

5. Click Create and wait for the process to complete.

Procedure

1. Navigate to Operator → Installed Operators.
2. Select the Red Hat Single Sign-On Operator project.
3. Select the Keycloak Client tab and click Create Keycloak Client.
4. On the Keycloak Realm form, select YAML view.

5. Replace the default YAML file with the following:

   kind: KeycloakClient
   apiVersion: keycloak.org/v1alpha1
   metadata:
     name: automation-hub-client-secret
     labels:
       app: sso
       realm: ansible-automation-platform
     namespace: rh-sso
   spec:
     realmSelector:
       matchLabels:
         app: sso
         realm: ansible-automation-platform
     client:
       name: Automation Hub
       clientId: automation-hub
       secret: <client-secret>                        1
       clientAuthenticatorType: client-secret
       description: Client for {HubNameStart}
       attributes:
         user.info.response.signature.alg: RS256
         request.object.signature.alg: RS256
       directAccessGrantsEnabled: true
       publicClient: true
       protocol: openid-connect
       standardFlowEnabled: true
       protocolMappers:
         - config:
             access.token.claim: "true"
             claim.name: "family_name"
             id.token.claim: "true"
             jsonType.label: String
             user.attribute: lastName
             userinfo.token.claim: "true"
           consentRequired: false
           name: family name
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
         - config:
             userinfo.token.claim: "true"
             user.attribute: email
             id.token.claim: "true"
             access.token.claim: "true"
             claim.name: email
             jsonType.label: String
           name: email
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
           consentRequired: false
         - config:
             multivalued: "true"
             access.token.claim: "true"
             claim.name: "resource_access.${client_id}.roles"
             jsonType.label: String
           name: client roles
           protocol: openid-connect
           protocolMapper: oidc-usermodel-client-role-mapper
           consentRequired: false
         - config:
             userinfo.token.claim: "true"
             user.attribute: firstName
             id.token.claim: "true"
             access.token.claim: "true"
             claim.name: given_name
             jsonType.label: String
           name: given name
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
           consentRequired: false
         - config:
             id.token.claim: "true"
             access.token.claim: "true"
             userinfo.token.claim: "true"
           name: full name
           protocol: openid-connect
           protocolMapper: oidc-full-name-mapper
           consentRequired: false
         - config:
             userinfo.token.claim: "true"
             user.attribute: username
             id.token.claim: "true"
             access.token.claim: "true"
             claim.name: preferred_username
             jsonType.label: String
           name: <username>
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
           consentRequired: false
         - config:
             access.token.claim: "true"
             claim.name: "group"
             full.path: "true"
             id.token.claim: "true"
             userinfo.token.claim: "true"
           consentRequired: false
           name: group
           protocol: openid-connect
           protocolMapper: oidc-group-membership-mapper
         - config:
             multivalued: 'true'
             id.token.claim: 'true'
             access.token.claim: 'true'
             userinfo.token.claim: 'true'
             usermodel.clientRoleMapping.clientId:  '{HubName}'
             claim.name: client_roles
             jsonType.label: String
           name: client_roles
           protocolMapper: oidc-usermodel-client-role-mapper
           protocol: openid-connect
         - config:
             id.token.claim: "true"
             access.token.claim: "true"
             included.client.audience: '{HubName}'
           protocol: openid-connect
           name: audience mapper
           protocolMapper: oidc-audience-mapper
     roles:
       - name: "hubadmin"
         description: "An administrator role for {HubNameStart}"

   1

   Replace this with a unique value.

6. Click Create and wait for the process to complete.

Procedure

1. Navigate to Operator → Installed Operators.
2. Select the Red Hat Single Sign-On Operator project.
3. Select the Keycloak Realm tab and click Create Keycloak User.
4. On the Keycloak User form, select YAML view.

5. Replace the default YAML file with the following:

   apiVersion: keycloak.org/v1alpha1
   kind: KeycloakUser
   metadata:
     name: hubadmin-user
     labels:
       app: sso
       realm: ansible-automation-platform
     namespace: rh-sso
   spec:
     realmSelector:
       matchLabels:
         app: sso
         realm: ansible-automation-platform
     user:
       username: hub_admin
       firstName: Hub
       lastName: Admin
       email: hub_admin@example.com
       enabled: true
       emailVerified: false
       credentials:
         - type: password
           value: <ch8ngeme>
       clientRoles:
         automation-hub:
           - hubadmin

6. Click Create and wait for the process to complete.

Procedure

1. Navigate to Operator → Operator Hub and search for the Ansible Automation Platform Operator.
2. Select the Ansible Automation Platform Operator project.
3. Click on the Operator tile.
4. Click Install.

5. Select a Project to install the Operator into. Red Hat recommends using the Operator recommended Namespace name.

   1. If you want to install the Operator into a project other than the recommended one, select Create Project from the drop down menu.
   2. Enter the Project name.
   3. Click Create.
6. Click Install.
7. When the Operator has been installed, click View Operator.

Procedure

1. Navigate to https://<sso_host>/auth/realms/ansible-automation-platform.
2. Copy the public_key value.
3. In the OpenShift Web UI, navigate to Workloads → Secrets.
4. Select the ansible-automation-platform project.
5. Click Create, and select From YAML.

6. Edit the following YAML to create the secret

   apiVersion: v1
   kind: Secret
   metadata:
     name: automation-hub-sso                       1
     namespace: ansible-automation-platform
   type: Opaque
   stringData:
     keycloak_host: "keycloak-rh-sso.apps-crc.testing"
     keycloak_port: "443"
     keycloak_protocol: "https"
     keycloak_realm: "ansible-automation-platform"
     keycloak_admin_role: "hubadmin"
     social_auth_keycloak_key: "automation-hub"
     social_auth_keycloak_secret: "client-secret"   2
     social_auth_keycloak_public_key: >-            3

   1

   This name is used in the next step when creating the automation hub instance.

   2

   If the secret was changed when creating the Keycloak client for automation hub be sure to change this value to match.

   3

   Enter the value of the public_key copied in Installing the Ansible Automation Platform Operator.

7. Click Create and wait for the process to complete.

Procedure

1. Navigate to Operator → Installed Operators.
2. Select the Ansible Automation Platform.
3. Select the Automation hub tab and click Create Automation hub.

4. Select YAML view. The YAML should be similar to:

   apiVersion: automationhub.ansible.com/v1beta1
   kind: AutomationHub
   metadata:
     name: private-ah                              1
     namespace: ansible-automation-platform
   spec:
     sso_secret: automation-hub-sso                2
     pulp_settings:
       verify_ssl: false
     route_tls_termination_mechanism: Edge
     ingress_type: Route
     loadbalancer_port: 80
     file_storage_size: 100Gi
     image_pull_policy: IfNotPresent
     web:
       replicas: 1
     file_storage_access_mode: ReadWriteMany
     content:
       log_level: INFO
       replicas: 2
     postgres_storage_requirements:
       limits:
         storage: 50Gi
       requests:
         storage: 8Gi
     api:
       log_level: INFO
       replicas: 1
     postgres_resource_requirements:
       limits:
         cpu: 1000m
         memory: 8Gi
       requests:
         cpu: 500m
         memory: 2Gi
     loadbalancer_protocol: http
     resource_manager:
       replicas: 1
     worker:
       replicas: 2

   1

   Set metadata.name to the name to use for the instance.

   2

   Set spec.sso_secret to the name of the secret created in Creating a Secret to hold the Red Hat Single Sign On connection details.

   Note

   This YAML turns off SSL verification (ssl_verify: false). If you are not using self-signed certificates for OpenShift this setting can be removed.

5. Click Create and wait for the process to complete.

Procedure

1. Navigate to Networking → Routes.
2. Select the project you used for the install.
3. Copy the location of the private-ah-web-svc service. The name of the service is different if you used a different name when creating the automation hub instance. This is used later to update the Red Hat Single Sign-On client.

Procedure

1. Navigate to Operator → Installed Operators.
2. Select the RH-SSO project.
3. Click Red Hat Single Sign-On Operator.
4. Select Keycloak Client.
5. Click on the automation-hub-client-secret client.
6. Select YAML.

7. Update the Client YAML to add the Valid Redirect URIs and Web Origins settings.

   redirectUris:
     - 'https://private-ah-ansible-automation-platform.apps-crc.testing/*'
   webOrigins:
     - 'https://private-ah-ansible-automation-platform.apps-crc.testing'

   Field	Description
   redirectURIs	This is the location determined in Determine Automation Hub Route. Be sure to add the /* to the end of the redirectUris setting.
   webOrigins	This is the location determined in Determine Automation Hub Route.

   Note

   Ensure the indentation is correct when entering these settings.

8. Click Save.

To verify connectivity

1. Navigate to the automation hub route.
2. Enter the hub_admin user credentials and sign in.
3. Red Hat Single Sign-On processes the authentication and redirects back to automation hub.