Deploying the Red Hat Ansible Automation Platform operator on OpenShift Container Platform

Procedure

1. Navigate to Operators → Installed Operators, then click on the Ansible Automation Platform operator.
2. Locate the Automation controller tab, then click Create instance.

1. Create a postgres_configuration_secret .yaml file, following the template below:

   apiVersion: v1
   kind: Secret
   metadata:
     name: external-postgres-configuration
     namespace: <target_namespace> 

   1

   
   stringData:
     host: "<external_ip_or_url_resolvable_by_the_cluster>" 

   2

   
     port: "<external_port>" 

   3

   
     database: "<desired_database_name>"
     username: "<username_to_connect_as>"
     password: "<password_to_connect_with>" 

   4

   
     sslmode: "prefer" 

   5

   
     type: "unmanaged"
   type: Opaque

   Copy to Clipboard Toggle word wrap

   1

   Namespace to create the secret in. This should be the same namespace you want to deploy to.

   2

   The resolvable hostname for your database node.

   3

   External port defaults to 5432.

   4

   Value for variable password should not contain single or double quotes (', ") or backslashes (\) to avoid any issues during deployment, backup or restoration.

   5

   The variable sslmode is valid for external databases only. The allowed values are: prefer, disable, allow, require, verify-ca, and verify-full.

2. Apply external-postgres-configuration-secret.yml to your cluster using the oc create command.

   $ oc create -f external-postgres-configuration-secret.yml

   Copy to Clipboard Toggle word wrap

3. When creating your AutomationController custom resource object, specify the secret on your spec, following the example below:

   apiVersion: automationcontroller.ansible.com/v1beta1
   kind: AutomationController
   metadata:
     name: controller-dev
   spec:
     postgres_configuration_secret: external-postgres-configuration

   Copy to Clipboard Toggle word wrap

Procedure

1. Edit the /var/lib/pgsql/data/postgres.conf file on the database server:

   # vi /var/lib/pgsql/data/postgres.conf

   Copy to Clipboard Toggle word wrap

2. Find and comment out the line:

   #datestyle = 'Redwood, SHOW_TIME'

   Copy to Clipboard Toggle word wrap

3. Add the following setting immediately below the newly-commented line:

   datestyle = 'iso, mdy'

   Copy to Clipboard Toggle word wrap
4. Save and close the postgres.conf file.

5. Reload the database configuration:

   # systemctl reload postgresql

   Copy to Clipboard Toggle word wrap
   Note

   Running this command does not disrupt database operations.

Procedure

1. List the existing PVCs in your deployment namespace:

   oc get pvc -n <namespace>

   Copy to Clipboard Toggle word wrap
2. Identify the PVC associated with your previous deployment by comparing the old deployment name and the PVC name.

3. Delete the old PVC:

   oc delete pvc -n <namespace> <pvc-name>

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to Operators → Installed Operators.
2. Locate the Automation hub entry, then click Create instance.
3. Click Form view.
4. Enter the name of the new controller.
5. Optional: Add any labels necessary.
6. Click Advanced configuration.

7. From the PostgreSQL container storage requirements drop down menu, select requests:

   1. Enter "100Gi" in the storage field.

8. From the PostgreSQL container resource requirements drop down menu, select requests:

   1. Enter "200" in the cpu field.
   2. Enter "512Mi" in the memory field.

Procedure

1. Navigate to Networking → Routes.
2. Under Location, click on the URL for your automation hub instance.

1. Create a postgres_configuration_secret .yaml file, following the template below:

   apiVersion: v1
   kind: Secret
   metadata:
     name: external-postgres-configuration
     namespace: <target_namespace> 

   1

   
   stringData:
     host: "<external_ip_or_url_resolvable_by_the_cluster>" 

   2

   
     port: "<external_port>" 

   3

   
     database: "<desired_database_name>"
     username: "<username_to_connect_as>"
     password: "<password_to_connect_with>" 

   4

   
     sslmode: "prefer" 

   5

   
     type: "unmanaged"
   type: Opaque

   Copy to Clipboard Toggle word wrap

   1

   Namespace to create the secret in. This should be the same namespace you want to deploy to.

   2

   The resolvable hostname for your database node.

   3

   External port defaults to 5432.

   4

   Value for variable password should not contain single or double quotes (', ") or backslashes (\) to avoid any issues during deployment, backup or restoration.

   5

   The variable sslmode is valid for external databases only. The allowed values are: prefer, disable, allow, require, verify-ca, and verify-full.

2. Apply external-postgres-configuration-secret.yml to your cluster using the oc create command.

   $ oc create -f external-postgres-configuration-secret.yml

   Copy to Clipboard Toggle word wrap

3. When creating your AutomationHub custom resource object, specify the secret on your spec, following the example below:

   apiVersion: automationhub.ansible.com/v1beta1
   kind: AutomationHub
   metadata:
     name: hub-dev
   spec:
     postgres_configuration_secret: external-postgres-configuration

   Copy to Clipboard Toggle word wrap

Procedure

1. List the existing PVCs in your deployment namespace:

   oc get pvc -n <namespace>

   Copy to Clipboard Toggle word wrap
2. Identify the PVC associated with your previous deployment by comparing the old deployment name and the PVC name.

3. Delete the old PVC:

   oc delete pvc -n <namespace> <pvc-name>

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a project for the operator

   oc new-project ansible-automation-platform

   Copy to Clipboard Toggle word wrap
2. Create a file called sub.yaml.

3. Add the following YAML code to the sub.yaml file.

   ---
   apiVersion: v1
   kind: Namespace
   metadata:
     labels:
       openshift.io/cluster-monitoring: "true"
     name: ansible-automation-platform
   ---
   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: ansible-automation-platform-operator
     namespace: ansible-automation-platform
   spec:
     targetNamespaces:
       - ansible-automation-platform
   ---
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: ansible-automation-platform
     namespace: ansible-automation-platform
   spec:
     channel: 'stable-2.4'
     installPlanApproval: Automatic
     name: ansible-automation-platform-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
   ---
   apiVersion: automationcontroller.ansible.com/v1beta1
   kind: AutomationController
   metadata:
     name: example
     namespace: ansible-automation-platform
   spec:
     replicas: 1

   Copy to Clipboard Toggle word wrap

   This file creates a Subscription object called ansible-automation-platform that subscribes the ansible-automation-platform namespace to the ansible-automation-platform-operator operator.

   It then creates an AutomationController object called example in the ansible-automation-platform namespace.

   To change the automation controller name from example, edit the name field in the kind: AutomationController section of sub.yaml and replace <automation_controller_name> with the name you want to use:

   apiVersion: automationcontroller.ansible.com/v1beta1
   kind: AutomationController
   metadata:
     name: <automation_controller_name>
     namespace: ansible-automation-platform

   Copy to Clipboard Toggle word wrap

4. Run the oc apply command to create the objects specified in the sub.yaml file:

   oc apply -f sub.yaml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to Operator → Installed Operators.
2. Select the rh-sso project.
3. Select the Red Hat Single Sign-On Operator.
4. On the Red Hat Single Sign-On Operator details page select Keycloak.
5. Click Create instance.

6. Click YAML view.

   The default Keycloak custom resource is as follows:

   apiVersion: keycloak.org/v1alpha1
   kind: Keycloak
   metadata:
     name: example-keycloak
     labels:
   	app: sso
     namespace: aap
   spec:
     externalAccess:
   	enabled: true
     instances: 1

   Copy to Clipboard Toggle word wrap
7. Click Create.
8. When deployment is complete, you can use this credential to login to the administrative console.
9. You can find the credentials for the administrator in the credential-<custom-resource> (example keycloak) secret in the namespace.

Procedure

1. Navigate to Operator → Installed Operators.
2. Select the Red Hat Single Sign-On Operator project.
3. Select the Keycloak Realm tab and click Create Keycloak Realm.

4. On the Keycloak Realm form, select YAML view. Edit the YAML file as follows:

   kind: KeycloakRealm
   apiVersion: keycloak.org/v1alpha1
   metadata:
     name: ansible-automation-platform-keycloakrealm
     namespace: rh-sso
     labels:
       app: sso
       realm: ansible-automation-platform
   spec:
     realm:
       id: ansible-automation-platform
       realm: ansible-automation-platform
       enabled: true
       displayName: Ansible Automation Platform
     instanceSelector:
       matchLabels:
         app: sso

   Copy to Clipboard Toggle word wrap
   Expand

   Field	Description
   metadata.name	Set a unique value in metadata for the name of the configuration resource (CR).
   metadata.namespace	Set a unique value in metadata for the name of the configuration resource (CR).
   metadata.labels.app	Set labels to a unique value. This is used when creating the client CR.
   metadata.labels.realm	Set labels to a unique value. This is used when creating the client CR.
   spec.realm.id	Set the realm name and id. These must be the same.
   spec.realm.realm	Set the realm name and id. These must be the same.
   spec.realm.displayname	Set the name to display.

   Show more
5. Click Create and wait for the process to complete.

Procedure

1. Navigate to Operator → Installed Operators.
2. Select the Red Hat Single Sign-On Operator project.
3. Select the Keycloak Client tab and click Create Keycloak Client.
4. On the Keycloak Realm form, select YAML view.

5. Replace the default YAML file with the following:

   kind: KeycloakClient
   apiVersion: keycloak.org/v1alpha1
   metadata:
     name: automation-hub-client-secret
     labels:
       app: sso
       realm: ansible-automation-platform
     namespace: rh-sso
   spec:
     realmSelector:
       matchLabels:
         app: sso
         realm: ansible-automation-platform
     client:
       name: Automation Hub
       clientId: automation-hub
       secret: <client-secret>                        

   1

   
       clientAuthenticatorType: client-secret
       description: Client for automation hub
       attributes:
         user.info.response.signature.alg: RS256
         request.object.signature.alg: RS256
       directAccessGrantsEnabled: true
       publicClient: true
       protocol: openid-connect
       standardFlowEnabled: true
       protocolMappers:
         - config:
             access.token.claim: "true"
             claim.name: "family_name"
             id.token.claim: "true"
             jsonType.label: String
             user.attribute: lastName
             userinfo.token.claim: "true"
           consentRequired: false
           name: family name
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
         - config:
             userinfo.token.claim: "true"
             user.attribute: email
             id.token.claim: "true"
             access.token.claim: "true"
             claim.name: email
             jsonType.label: String
           name: email
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
           consentRequired: false
         - config:
             multivalued: "true"
             access.token.claim: "true"
             claim.name: "resource_access.${client_id}.roles"
             jsonType.label: String
           name: client roles
           protocol: openid-connect
           protocolMapper: oidc-usermodel-client-role-mapper
           consentRequired: false
         - config:
             userinfo.token.claim: "true"
             user.attribute: firstName
             id.token.claim: "true"
             access.token.claim: "true"
             claim.name: given_name
             jsonType.label: String
           name: given name
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
           consentRequired: false
         - config:
             id.token.claim: "true"
             access.token.claim: "true"
             userinfo.token.claim: "true"
           name: full name
           protocol: openid-connect
           protocolMapper: oidc-full-name-mapper
           consentRequired: false
         - config:
             userinfo.token.claim: "true"
             user.attribute: username
             id.token.claim: "true"
             access.token.claim: "true"
             claim.name: preferred_username
             jsonType.label: String
           name: <username>
           protocol: openid-connect
           protocolMapper: oidc-usermodel-property-mapper
           consentRequired: false
         - config:
             access.token.claim: "true"
             claim.name: "group"
             full.path: "true"
             id.token.claim: "true"
             userinfo.token.claim: "true"
           consentRequired: false
           name: group
           protocol: openid-connect
           protocolMapper: oidc-group-membership-mapper
         - config:
             multivalued: 'true'
             id.token.claim: 'true'
             access.token.claim: 'true'
             userinfo.token.claim: 'true'
             usermodel.clientRoleMapping.clientId:  'automation-hub'
             claim.name: client_roles
             jsonType.label: String
           name: client_roles
           protocolMapper: oidc-usermodel-client-role-mapper
           protocol: openid-connect
         - config:
             id.token.claim: "true"
             access.token.claim: "true"
             included.client.audience: 'automation-hub'
           protocol: openid-connect
           name: audience mapper
           protocolMapper: oidc-audience-mapper
     roles:
       - name: "hubadmin"
         description: "An administrator role for automation hub"

   Copy to Clipboard Toggle word wrap

   1

   Replace this with a unique value.

6. Click Create and wait for the process to complete.

Procedure

1. Navigate to Operator → Installed Operators.
2. Select the Red Hat Single Sign-On Operator project.
3. Select the Keycloak Realm tab and click Create Keycloak User.
4. On the Keycloak User form, select YAML view.

5. Replace the default YAML file with the following:

   apiVersion: keycloak.org/v1alpha1
   kind: KeycloakUser
   metadata:
     name: hubadmin-user
     labels:
       app: sso
       realm: ansible-automation-platform
     namespace: rh-sso
   spec:
     realmSelector:
       matchLabels:
         app: sso
         realm: ansible-automation-platform
     user:
       username: hub_admin
       firstName: Hub
       lastName: Admin
       email: hub_admin@example.com
       enabled: true
       emailVerified: false
       credentials:
         - type: password
           value: <ch8ngeme>
       clientRoles:
         automation-hub:
           - hubadmin

   Copy to Clipboard Toggle word wrap
6. Click Create and wait for the process to complete.

Procedure

1. Navigate to https://<sso_host>/auth/realms/ansible-automation-platform.
2. Copy the public_key value.
3. In the OpenShift Web UI, navigate to Workloads → Secrets.
4. Select the ansible-automation-platform project.
5. Click Create, and select From YAML.

6. Edit the following YAML to create the secret

   apiVersion: v1
   kind: Secret
   metadata:
     name: automation-hub-sso                       

   1

   
     namespace: ansible-automation-platform
   type: Opaque
   stringData:
     keycloak_host: "keycloak-rh-sso.apps-crc.testing"
     keycloak_port: "443"
     keycloak_protocol: "https"
     keycloak_realm: "ansible-automation-platform"
     keycloak_admin_role: "hubadmin"
     social_auth_keycloak_key: "automation-hub"
     social_auth_keycloak_secret: "client-secret"   

   2

   
     social_auth_keycloak_public_key: >-            

   3

   Copy to Clipboard Toggle word wrap

   1

   This name is used in the next step when creating the automation hub instance.

   2

   If the secret was changed when creating the Keycloak client for automation hub be sure to change this value to match.

   3

   Enter the value of the public_key for your Ansible Automation Platform Operator deployment.

7. Click Create and wait for the process to complete.

Procedure

1. Navigate to Operator → Installed Operators.
2. Select your Ansible Automation Platform Operator deployment.
3. Select the Automation hub tab.
4. Click Create Automation hub.

5. Select YAML view. The YAML should be similar to:

   apiVersion: automationhub.ansible.com/v1beta1
   kind: AutomationHub
   metadata:
     name: private-ah                              

   1

   
     namespace: aap
   spec:
     sso_secret: automation-hub-sso                

   2

   
     pulp_settings:
       verify_ssl: false
     route_tls_termination_mechanism: Edge
     ingress_type: Route
     loadbalancer_port: 80
     file_storage_size: 100Gi
     image_pull_policy: IfNotPresent
     replicas: 1                                   

   3

   
     web_replicas: N
     task_replicas: N
     file_storage_access_mode: ReadWriteMany
     content:
       log_level: INFO
       replicas: 2
     postgres_storage_requirements:
       limits:
         storage: 50Gi
       requests:
         storage: 8Gi
     api:
       log_level: INFO
       replicas: 1
     postgres_resource_requirements:
       limits:
         cpu: 1000m
         memory: 8Gi
       requests:
         cpu: 500m
         memory: 2Gi
     loadbalancer_protocol: http
     resource_manager:
       replicas: 1
     worker:
       replicas: 2

   Copy to Clipboard Toggle word wrap

   1

   Set metadata.name to the name to use for the instance.

   2

   Set spec.sso_secret to the name of the secret created in Creating a Secret to hold the Red Hat Single Sign On connection details.

   3

   Scale replicas up or down for each deployment by using the web_replicas or task_replicas respectively, where N represents the number of replicas you want to create. Alternatively, you can scale all pods across both deployments by using replicas. See Scaling the Web and Task Pods independently for details.

   Note

   This YAML turns off SSL verification (ssl_verify: false). If you are not using self-signed certificates for OpenShift this setting can be removed.

6. Click Create and wait for the process to complete.

Procedure

1. Log in to Red Hat OpenShift Container Platform.
2. Navigate to Home → Search.
3. Select the Resources drop-down list and type "Image".
4. Select Image (config,openshift.io/v1).
5. Click Cluster under the Name heading.
6. Select the YAML tab.

7. Paste in the following under spec value:

   spec:
     registrySources:
       allowedRegistries:
       - quay.io
       - registry.redhat.io
       - image-registry.openshift-image-registry.svc:5000
       - <OCP route for your automation hub>

   Copy to Clipboard Toggle word wrap
8. Click Save.

Procedure

1. Navigate to Networking → Routes.
2. Select the project you used for the install.
3. Copy the location of the private-ah-web-svc service. The name of the service is different if you used a different name when creating the automation hub instance. This is used later to update the Red Hat Single Sign-On client.

Procedure

1. Navigate to Operator → Installed Operators.
2. Select the RH-SSO project.
3. Click Red Hat Single Sign-On Operator.
4. Select Keycloak Client.
5. Click on the automation-hub-client-secret client.
6. Select YAML.

7. Update the Client YAML to add the Valid Redirect URIs and Web Origins settings.

   redirectUris:
     - 'https://private-ah-ansible-automation-platform.apps-crc.testing/*'
   webOrigins:
     - 'https://private-ah-ansible-automation-platform.apps-crc.testing'

   Copy to Clipboard Toggle word wrap
   Expand

   Field	Description
   redirectURIs	This is the location determined in Determine Automation Hub Route. Be sure to add the /* to the end of the redirectUris setting.
   webOrigins	This is the location determined in Determine Automation Hub Route.

   Show more
   Note

   Ensure the indentation is correct when entering these settings.

8. Click Save.

To verify connectivity

1. Navigate to the automation hub route.
2. Enter the hub_admin user credentials and sign in.
3. Red Hat Single Sign-On processes the authentication and redirects back to automation hub.

Prodedure

1. Log in to OpenShift Container Platform.
2. Navigate to Operators → Installed Operators.
3. Select the Subscriptions tab.
4. Under Upgrade status, click Upgrade Available.
5. Click Preview InstallPlan.
6. Click Approve.

1. In the navigation panel, select Access → Users.
2. Select the username you want to create a token for.
3. Click on Tokens, then click Add.
4. You can leave Applications empty. Add a description and select Read or Write for the Scope.

Procedure

1. The following is an example of the YAML for the connection secret. Save the following example to a file, for example, automation-controller-connection-secret.yml.

   apiVersion: v1
   kind: Secret
   metadata:
     name: controller-access
     type: Opaque
   stringData:
     token: <generated-token>
     host: https://my-controller-host.example.com/

   Copy to Clipboard Toggle word wrap
2. Edit the file with your host and token value.
3. Apply it to your cluster by running the kubectl create command:

Procedure

1. Specify the connection secret and job template you want to launch.

   apiVersion: tower.ansible.com/v1alpha1
   kind: AnsibleJob
   metadata:
     generateName: demo-job-1 # generate a unique suffix per 'kubectl create'
   spec:
     connection_secret: controller-access
     job_template_name: Demo Job Template

   Copy to Clipboard Toggle word wrap

2. Configure features such as, inventory, extra variables, and time to live for the job.

   spec:
     connection_secret: controller-access
     job_template_name: Demo Job Template
     inventory: Demo Inventory                    # Inventory prompt on launch needs to be enabled
     runner_image: quay.io/ansible/controller-resource-runner
     runner_version: latest
     job_ttl: 100
     extra_vars:                                  # Extra variables prompt on launch needs to be enabled
        test_var: test
     job_tags: "provision,install,configuration"  # Specify tags to run
     skip_tags: "configuration,restart"           # Skip tasks with a given tag

   Copy to Clipboard Toggle word wrap
   Note

   You must enable prompt on launch for inventories and extra variables if you are configuring those. To enable Prompt on launch, within the automation controller UI: From the Resources → Templates page, select your template and select the Prompt on launch checkbox next to Inventory and Variables sections.

3. Launch a workflow job template with an AnsibleJob object by specifying the workflow_template_name instead of job_template_name:

   apiVersion: tower.ansible.com/v1alpha1
   kind: AnsibleJob
   metadata:
     generateName: demo-job-1 # generate a unique suffix per 'kubectl create'
   spec:
     connection_secret: controller-access
     workflow_template_name: Demo Workflow Template

   Copy to Clipboard Toggle word wrap