Managing Red Hat Certified and Ansible Galaxy collections in automation hub

Procedure

1. Log in to console.redhat.com.
2. Navigate to Automation Hub → Collections.
3. Use the toggle switch on each collection to determine whether to exclude it from your synclist.
4. When you finish managing collections for your synclist, navigate to Automation Hub → Repo Management to initiate the remote repository synchronization to your private automation hub.
5. Optional: If your remote repository is already configured, you can manually synchronize Red Hat Ansible Certified Content Collections to your private automation hub to update the collections content that you made available to local users.

Procedure

1. Log in to console.redhat.com as an organization administrator.
2. Navigate to Automation Hub → Repo Management.
3. Locate the Sync URL and click the Copy to clipboard icon ( ). Paste the Sync URL in a file to use when configuring the rh-certified remote.
4. Click the More actions icon and click Get token.
5. On the Token management page, click Load token.
6. Click Copy to clipboard to copy the API token.
7. Paste the API token into a file and store in a secure location.

Procedure

1. Log in to your private automation hub.
2. Navigate to Repo Management.
3. Click the Remotes tab.
4. In the rh-certified remote repository, click and click Edit.
5. In the modal, paste the Sync URL and Token you acquired from console.redhat.com.

6. Click Save.

   The modal closes and returns you to the Repo Management page. You can now synchronize collections between your organization synclist on console.redhat.com and your private automation hub.

7. Click Sync to synchronize collections.

Procedure

1. Log in to your Ansible automation hub.
2. Navigate to Repo Management.
3. Click the Remotes tab.
4. In the Community remote, click the More Actions icon and click Edit.
5. In the modal, click Browse and locate the requirements.yml file on your local machine.

6. Click Save.

   The modal closes and returns you to the Repo Management page. You can now synchronize collections identified in your requirements.yml file from Ansible Galaxy to your private automation hub.

7. Click Sync to sync collections from Ansible Galaxy and Ansible automation hub.

Procedure

1. Create the /var/lib/pulp directory.

   # mkdir /var/lib/pulp

   Copy to Clipboard Toggle word wrap

2. Mount the shared filesystem (this reference environment uses an NFS share).

   # mount -t nfs4 <nfs_share_ip_address>:/ /var/lib/pulp

   Copy to Clipboard Toggle word wrap

3. Confirm that the shared filesystem is successfully mounted:

   $ df -h

   Copy to Clipboard Toggle word wrap

1. Ensure the following firewalld services (nfs, mountd, rpc-bind) are enabled.

   # firewall-cmd --zone=public --add-service=nfs
   # firewall-cmd --zone=public --add-service=mountd
   # firewall-cmd --zone=public --add-service=rpc-bind

   Copy to Clipboard Toggle word wrap

2. Reload firewalld for changes to take effect.

   # firewall-cmd --reload

   Copy to Clipboard Toggle word wrap

3. Verify the firewalld services are enabled.

   # firewall-cmd --get-services

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a signing script that accepts only a filename.

   Note

   This script acts as the signing service and must generate an ascii-armored detached gpg signature for that file using the key specified through the PULP_SIGNING_KEY_FINGERPRINT environment variable.

   The script then prints out a JSON structure with the following format.

   {"file": "filename", "signature": "filename.asc"}

   Copy to Clipboard Toggle word wrap

   All the file names are relative paths inside the current working directory. The file name must remain the same for the detached signature, as shown.

   The following example shows a script that produces signatures for content:

   #!/usr/bin/env bash
   
   FILE_PATH=$1
   SIGNATURE_PATH="$1.asc"
   
   ADMIN_ID="$PULP_SIGNING_KEY_FINGERPRINT"
   PASSWORD="password"
   
   # Create a detached signature
   gpg --quiet --batch --pinentry-mode loopback --yes --passphrase \
      $PASSWORD --homedir ~/.gnupg/ --detach-sign --default-key $ADMIN_ID \
      --armor --output $SIGNATURE_PATH $FILE_PATH
   
   # Check the exit status
   STATUS=$?
   if [ $STATUS -eq 0 ]; then
      echo {\"file\": \"$FILE_PATH\", \"signature\": \"$SIGNATURE_PATH\"}
   else
      exit $STATUS
   fi

   Copy to Clipboard Toggle word wrap

   After you deploy a private automation hub with signing enabled to your Ansible Automation Platform cluster, new UI additions display when you interact with collections.

2. Review the Ansible Automation Platform installer inventory file for options that begin with automationhub_*.

   [all:vars]
   .
   .
   .
   automationhub_create_default_collection_signing_service = True
   automationhub_auto_sign_collections = True
   automationhub_require_content_approval = True
   automationhub_collection_signing_service_key = /abs/path/to/galaxy_signing_service.gpg
   automationhub_collection_signing_service_script = /abs/path/to/collection_signing.sh

   Copy to Clipboard Toggle word wrap

   The two new keys (automationhub_auto_sign_collections and automationhub_require_content_approval) indicate that the collections must be signed and require approval after they are uploaded to private automation hub.

Procedure

1. Log in to your private automation hub instance in the automation hub UI.
2. In the left navigation, click Collections → Approval. The Approval dashboard is displayed with a list of collections.
3. Click Sign and approve for each collection you want to sign.
4. Verify that the collections you signed and manually approved are displayed in the Collections tab.

Procedure

1. Log in to your private automation hub instance in the automation hub UI.

2. In the navigation pane, select Signature Keys. The Signature Keys dashboard displays a list of multiple keys: collections and container images.

   • To verify collections, download the key prefixed with collections-.
   • To verify container images, download the key prefixed with container-.

3. Choose one of the following methods to download your public key:

   • Select the menu icon and click Download Key to download the public key.
   • Select the public key from the list and click the Copy to clipboard icon.
   • Click the drop-down menu under the Public Key tab and copy the entire public key block.

Procedure

1. To import a public key into a non-default keyring for use with ansible-galaxy, run the following command.

   gpg --import --no-default-keyring --keyring ~/.ansible/pubring.kbx my-public-key.asc

   Copy to Clipboard Toggle word wrap
   Note

   In addition to any signatures provided by the automation hub, signature sources can also be provided in the requirements file and on the command line. Signature sources should be URIs.

2. Use the --signature option to verify the collection name provided on the CLI with an additional signature.

   ansible-galaxy collection install namespace.collection
   --signature https://examplehost.com/detached_signature.asc
   --signature file:///path/to/local/detached_signature.asc --keyring ~/.ansible/pubring.kbx

   Copy to Clipboard Toggle word wrap

   You can use this option multiple times to provide multiple signatures.

3. Confirm that the collections in a requirements file list any additional signature sources following the collection’s signatures key, as in the following example.

   # requirements.yml
   collections:
     - name: ns.coll
       version: 1.0.0
       signatures:
         - https://examplehost.com/detached_signature.asc
         - file:///path/to/local/detached_signature.asc
   
   ansible-galaxy collection verify -r requirements.yml --keyring ~/.ansible/pubring.kbx

   Copy to Clipboard Toggle word wrap

   When you install a collection from automation hub, the signatures provided by the server are saved along with the installed collections to verify the collection’s authenticity.

4. (Optional) If you need to verify the internal consistency of your collection again without querying the Ansible Galaxy server, run the same command you used previously using the --offline option.