Chapter 4. Disconnected installation

Procedure

1. Attach the BaseOS and AppStream required repositories:

   # subscription-manager repos \
       --enable rhel-8-for-x86_64-baseos-rpms \
       --enable rhel-8-for-x86_64-appstream-rpms

2. Perform the reposync:

   # dnf install yum-utils
   # reposync -m --download-metadata --gpgcheck \
       -p /path/to/download

   1. Make certain that you use reposync with --download-metadata and without --newest-only. See [RHEL 8] Reposync.
   2. If not using --newest-only the repos downloaded will be ~90GB.
   3. If using --newest-only the repos downloaded will be ~14GB.

3. If you plan to use Red Hat Single Sign-On (RHSSO) you must also sync these repositories.

   1. jb-eap-7.3-for-rhel-8-x86_64-rpms
   2. rh-sso-7.4-for-rhel-8-x86_64-rpms
4. After the reposync is completed your repositories are ready to use with a web server.
5. Move the repositories to your disconnected network.

1. Install prerequisites:

   $ sudo dnf install httpd

2. Configure httpd to serve the repo directory:

   /etc/httpd/conf.d/repository.conf
   
   DocumentRoot '/path/to/repos'
   
   <LocationMatch "^/+$">
       Options -Indexes
       ErrorDocument 403 /.noindex.html
   </LocationMatch>
   
   <Directory '/path/to/repos'>
       Options All Indexes FollowSymLinks
       AllowOverride None
       Require all granted
   </Directory>

3. Ensure that the directory is readable by an apache user:

   $ sudo chown -R apache /path/to/repos

4. Configure SELinux:

   $ sudo semanage fcontext -a -t httpd_sys_content_t "/path/to/repos(/.*)?"
   $ sudo restorecon -ir /path/to/repos

5. Enable httpd:

   $ sudo systemctl enable --now httpd.service

6. Open firewall:

   $ sudo firewall-cmd --zone=public --add-service=http –add-service=https
   --permanent
   $ sudo firewall-cmd --reload

7. On automation controller and automation hub, add a repo file at /etc/yum.repos.d/local.repo, add the optional repos if needed:

   [Local-BaseOS]
   name=Local BaseOS
   baseurl=http://<webserver_fqdn>/rhel-8-for-x86_64-baseos-rpms
   enabled=1
   gpgcheck=1
   gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
   
   [Local-AppStream]
   name=Local AppStream
   baseurl=http://<webserver_fqdn>/rhel-8-for-x86_64-appstream-rpms
   enabled=1
   gpgcheck=1
   gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

Procedure

1. Mount DVD or ISO

   1. DVD

      # mkdir /media/rheldvd && mount /dev/sr0 /media/rheldvd

   2. ISO

      # mkdir /media/rheldvd && mount -o loop rhrhel-8.6-x86_64-dvd.iso /media/rheldvd

2. Create yum repo file at /etc/yum.repos.d/dvd.repo

   [dvd-BaseOS]
   name=DVD for RHEL - BaseOS
   baseurl=file:///media/rheldvd/BaseOS
   enabled=1
   gpgcheck=1
   gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
   
   [dvd-AppStream]
   name=DVD for RHEL - AppStream
   baseurl=file:///media/rheldvd/AppStream
   enabled=1
   gpgcheck=1
   gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

3. Import the gpg key

   # rpm --import /media/rheldvd/RPM-GPG-KEY-redhat-release

Procedure

1. Login to access.redhat.com.
2. Navigate to Subscriptions Subscriptions.
3. Click Subscription Allocations.
4. Click Create New subscription allocation.
5. Name the new subscription allocation.
6. Select Satellite 6.14 Satellite 6.14 as the type.
7. Click Create. The Details tab will open for your subscription allocation.
8. Click Subscriptions tab.
9. Click Add Subscription.
10. Find your Ansible Automation Platform subscription, in the Entitlements box add the number of entitlements you want to assign to your environment. A single entitlement is needed for each node that is managed by Ansible Automation Platform: server, network device, etc.
11. Click Submit.
12. Click Export Manifest.
13. This downloads a file manifest_<allocation name>_<date>.zip that be imported with automation controller after installation.

Procedure

1. Login to private automation hub web console.
2. Navigate to Collections Namespaces.
3. Click Create.
4. Provide the namespace name.
5. Click Create.

Procedure

1. Log in to private automation hub web console.
2. Go to Collections Approval.
3. Click Approve for the collection you wish to approve.
4. The collection is now available for use in your private automation hub.

1. Import any dependency for the collection using these same steps.

Procedure

1. On a RHEL system, install the ansible-builder RPM. This can be done in one of several ways:

   1. Subscribe the RHEL box to a Satellite on the disconnected network.
   2. Attach the Ansible Automation Platform subscription and enable the Ansible Automation Platform repository.

   3. Install the ansible-builder RPM.

      Note

      This is preferred if a Satellite exists because the execution environment images can use RHEL content from the Satellite if the underlying build host is registered.

2. Unarchive the Ansible Automation Platform setup bundle.

3. Install the ansible-builder RPM and its dependencies from the included content:

   $ tar -xzvf ansible-automation-platform-setup-bundle-2.3-1.2.tar.gz
   $ cd ansible-automation-platform-setup-bundle-2.3-1.2/bundle/el8/repos/
   $ sudo yum install ansible-builder-1.2.0-1.el9ap.noarch.rpm
   python38-requirements-parser-0.2.0-4.el9ap.noarch.rpm

4. Create a directory for your custom EE build artifacts.

   $ mkdir custom-ee
   $ cd custom-ee/

5. Create an execution-environment.yml file that defines the requirements for your custom EE following the documentation at https://ansible-builder.readthedocs.io/en/stable/definition/. Override the EE_BASE_IMAGE and EE_BUILDER_IMAGE variables to point to the EEs available in your private automation hub.

   $ cat execution-environment.yml
   ---
   version: 1
   build_arg_defaults:
     EE_BASE_IMAGE: '<hub_fqdn>/ee-supported-rhel8:latest'
     EE_BUILDER_IMAGE: '<hub_fqdn>/ansible-builder-rhel8:latest'
   
   dependencies:
     python: requirements.txt
     galaxy: requirements.yml

6. Create an ansible.cfg file that points to your private automation hub and contains credentials that allow uploading, such as an admin user token.

   $ cat ansible.cfg
   [galaxy]
   server_list = private_hub
   
   [galaxy_server.private_hub]
   url=https://<hub_fqdn>/api/galaxy/
   token=<admin_token>

7. Create a ubi.repo file that points to your disconnected UBI repo mirror (this could be your Satellite if the UBI content is hosted there).

   This is an example output where reposync was used to mirror the UBI repos.

   $ cat ubi.repo
   [ubi-8-baseos]
   name = Red Hat Universal Base Image 8 (RPMs) - BaseOS
   baseurl = http://<ubi_mirror_fqdn>/repos/ubi-8-baseos
   enabled = 1
   gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
   gpgcheck = 1
   
   [ubi-8-appstream]
   name = Red Hat Universal Base Image 8 (RPMs) - AppStream
   baseurl = http://<ubi_mirror_fqdn>/repos/ubi-8-appstream
   enabled = 1
   gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
   gpgcheck = 1

8. Add the CA certificate used to sign the private automation hub web server certificate.

   1. For self-signed certificates (the installer default), make a copy of the file /etc/pulp/certs/root.crt from your private automation hub and name it hub-root.crt.
   2. If an internal certificate authority was used to request and sign the private automation hub web server certificate, make a copy of that CA certificate called hub-root.crt.
9. Create your python requirements.txt and ansible collection requirements.yml with the content needed for your custom EE image. Note that any collections you require should already be uploaded into your private automation hub.

10. Use ansible-builder to create the context directory used to build the EE image.

    $ ansible-builder create
    Complete! The build context can be found at: /home/cloud-user/custom-ee/context
    $ ls -1F
    ansible.cfg
    context/
    execution-environment.yml
    hub-root.crt
    pip.conf
    requirements.txt
    requirements.yml
    ubi.repo

11. Copy the files used to override the internet-facing defaults into the context directory.

    $ cp ansible.cfg hub-root.crt pip.conf ubi.repo context/

12. Edit the file context/Containerfile and add the following modifications.

    1. In the first EE_BASE_IMAGE build section, add the ansible.cfg and hub-root.crt files and run the update-ca-trust command.
    2. In the EE_BUILDER_IMAGE build section, add the ubi.repo and pip.conf files.

    3. In the final EE_BASE_IMAGE build section, add the ubi.repo and pip.conf files.

       $ cat context/Containerfile
       ARG EE_BASE_IMAGE=<hub_fqdn>/ee-supported-rhel8:latest
       ARG EE_BUILDER_IMAGE=<hub_fqdn>/ansible-builder-rhel8:latest
       
       FROM $EE_BASE_IMAGE as galaxy
       ARG ANSIBLE_GALAXY_CLI_COLLECTION_OPTS=
       USER root
       
       ADD _build /build
       WORKDIR /build
       
       # this section added
       ADD ansible.cfg /etc/ansible/ansible.cfg
       ADD hub-root.crt /etc/pki/ca-trust/source/anchors/hub-root.crt
       RUN update-ca-trust
       # end additions
       RUN ansible-galaxy role install -r requirements.yml \
           --roles-path /usr/share/ansible/roles
       RUN ansible-galaxy collection install \
           $ANSIBLE_GALAXY_CLI_COLLECTION_OPTS -r requirements.yml \
           --collections-path /usr/share/ansible/collections
       
       FROM $EE_BUILDER_IMAGE as builder
       
       COPY --from=galaxy /usr/share/ansible /usr/share/ansible
       
       ADD _build/requirements.txt requirements.txt
       RUN ansible-builder introspect --sanitize \
           --user-pip=requirements.txt \
           --write-bindep=/tmp/src/bindep.txt \
           --write-pip=/tmp/src/requirements.txt
       # this section added
       ADD ubi.repo /etc/yum.repos.d/ubi.repo
       ADD pip.conf /etc/pip.conf
       # end additions
       RUN assemble
       
       FROM $EE_BASE_IMAGE
       USER root
       
       COPY --from=galaxy /usr/share/ansible /usr/share/ansible
       # this section added
       ADD ubi.repo /etc/yum.repos.d/ubi.repo
       ADD pip.conf /etc/pip.conf
       # end additions
       
       COPY --from=builder /output/ /output/
       RUN /output/install-from-bindep && rm -rf /output/wheels

13. Create the EE image in the local podman cache using the podman command.

    $ podman build -f context/Containerfile \
        -t <hub_fqdn>/custom-ee:latest

14. Once the custom EE image builds successfully, push it to the private automation hub.

    $ podman push <hub_fqdn>/custom-ee:latest