Chapter 4. Disconnected installation

Procedure

1. Navigate to the FQDN of the Automation controller. Log in with the username admin and the password you specified as admin_password in your inventory file.
2. Click Browse and select the manifest.zip you created earlier.
3. Click Next.
4. Uncheck User analytics and Automation analytics. These rely on an internet connection and must be turned off.
5. Click Next.
6. Read the End User License Agreement and click Submit if you agree.

Procedure

1. Log in to automation hub Hybrid Cloud Console.
2. From the navigation panel, select Collections Namespaces.
3. Click View collections next to the namespace you will be importing the collection into.
4. Click Upload collection.
5. Click the folder icon and select the tarball of the collection.
6. Click Upload.

Procedure

1. Copy the collection tarballs to the private automation hub.
2. Log in to the private automation hub server via SSH.

3. Add the self-signed root CA cert to the trust store on automation hub.

   # cp /etc/pulp/certs/root.crt \
       /etc/pki/ca-trust/source/anchors/automationhub-root.crt
   # update-ca-trust

4. Update the /etc/ansible/ansible.cfg file with your automation hub configuration. Use either a token or a username and password for authentication.

   [galaxy]
   server_list = private_hub
   
   [galaxy_server.private_hub]
   url=https://<hub_fqdn>/api/galaxy/
   token=<token_from_private_hub>

5. Import the collection using the ansible-galaxy command.

Procedure

1. Install the Ansible Builder RPM from the Ansible Automation Platform repository.

   1. Subscribe the RHEL system to a Satellite on the disconnected network.
   2. Attach the Ansible Automation Platform subscription and enable the AAP repository. The repository name will either be ansible-automation-platform-2.4-for-rhel-8-x86_64-rpms or ansible-automation-platform-2.4-for-rhel-9-x86_64-rpms depending on the version of RHEL used on the underlying system.
   3. Install the Ansible Builder RPM. The version of the Ansible Builder RPM must be 3.0.0 or later in order for the examples below to work properly.

2. Install the Ansible Builder RPM from the Ansible Automation Platform setup bundle. Use this method if a Satellite server is not available on your disconnected network.

   1. Unarchive the Ansible Automation Platform setup bundle.
   2. Install the Ansible Builder RPM and its dependencies from the included content.

1. Create a directory for the build artifacts used when creating your custom execution environment. Any new files created with the steps below will be created under this directory.

   $ mkdir $HOME/custom-ee $HOME/custom-ee/files
   $ cd $HOME/custom-ee/

2. Create an execution-environment.yml file that defines the requirements for your custom execution environment.

   Note

   Version 3 of the execution environment definition format is required, so ensure the execution-environment.yml file contains version: 3 explicitly before continuing.

   1. Override the base image to point to the minimal execution environment available in your private automation hub.
   2. Define the additional build files needed to point to any disconnected content sources that will be used in the build process. Your custom execution-environment.yml file should look similar to the following example:

   $ cat execution-environment.yml
   ---
   version: 3
   
   images:
     base_image:
       name: private-hub.example.com/ee-minimal-rhel8:latest
   
   dependencies:
     python: requirements.txt
     galaxy: requirements.yml
   
   additional_build_files:
     - src: files/ansible.cfg
       dest: configs
     - src: files/pip.conf
       dest: configs
     - src: files/hub-ca.crt
       dest: configs
     # uncomment if custom RPM repositories are required
     #- src: files/custom.repo
     #  dest: configs
   
   additional_build_steps:
     prepend_base:
       # copy a custom pip.conf to override the location of the PyPI content
       - ADD _build/configs/pip.conf /etc/pip.conf
       # remove the default UBI repository definition
       - RUN rm -f /etc/yum.repos.d/ubi.repo
       # copy the hub CA certificate and update the trust store
       - ADD _build/configs/hub-ca.crt /etc/pki/ca-trust/source/anchors
       - RUN update-ca-trust
       # if needed, uncomment to add a custom RPM repository configuration
       #- ADD _build/configs/custom.repo /etc/yum.repos.d/custom.repo
   
     prepend_galaxy:
       - ADD _build/configs/ansible.cfg ~/.ansible.cfg
   
   ...

3. Create an ansible.cfg file under the files/ subdirectory that points to your private automation hub.

   $ cat files/ansible.cfg
   [galaxy]
   server_list = private_hub
   
   [galaxy_server.private_hub]
   url = https://private-hub.example.com/api/galaxy/

4. Create a pip.conf file under the files/ subdirectory which points to the internal PyPI mirror (a web server or something like Nexus):

   $ cat files/pip.conf
   [global]
   index-url = https://<pypi_mirror_fqdn>/
   trusted-host = <pypi_mirror_fqdn>

5. Optional: If a bindep.txt file is being used to add RPMs the custom execution environment, create a custom.repo file under the files/ subdirectory that points to your disconnected Satellite or other location hosting the RPM repositories. If this step is necessary, uncomment the steps in the example execution-environment.yml file that correspond with the custom.repo file.

   The following example is for the UBI repos. Other local repos can be added to this file as well. The URL path may need to change depending on where the mirror content is located on the web server.

   $ cat files/custom.repo
   [ubi-8-baseos]
   name = Red Hat Universal Base Image 8 (RPMs) - BaseOS
   baseurl = http://<ubi_mirror_fqdn>/repos/ubi-8-baseos
   enabled = 1
   gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
   gpgcheck = 1
   
   [ubi-8-appstream]
   name = Red Hat Universal Base Image 8 (RPMs) - AppStream
   baseurl = http://<ubi_mirror_fqdn>/repos/ubi-8-appstream
   enabled = 1
   gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
   gpgcheck = 1

6. Add the CA certificate used to sign the private automation hub web server certificate. If the private automation hub uses self-signed certificates provided by the installer:

   1. Copy the file /etc/pulp/certs/pulp_webserver.crt from your private automation hub and name it hub-ca.crt.
   2. Add the hub-ca.crt file to the files/ subdirectory.

7. If the private automation hub uses user-provided certificates signed by a certificate authority:

   1. Make a copy of that CA certificate and name it hub-ca.crt.
   2. Add the hub-ca.crt file to the files/ subdirectory.

8. Once the preceeding steps have been completed, create your python requirements.txt and Ansible collection requirements.yml files, with the content needed for your custom execution environment image.

   Note

   Any required collections must already be uploaded into your private automation hub.

   The following files should exist under the custom-ee/ directory, with bindep.txt and files/custom.repo being optional:

1. Log in to your private hub.
2. Choose "Collections" from the left-hand menu.
3. Choose the"API token" under the "Collections" section of the menu.

4. Once you have the token, set the following environment variable so that Ansible Builder can access the token:

   $ export ANSIBLE_GALAXY_SERVER_PRIVATE_HUB_TOKEN=<your_token>

5. Create the custom execution environment by using the command:

   $ cd $HOME/custom-ee
   $ ansible-builder build -f execution-environment.yml -t private-hub.example.com/custom-ee:latest -v 3

   Note

   If the build fails with an error that the private hub certificate is signed by an unknown authority, you can pull the required image into the local image cache by running the command:

   $ podman pull private-hub.example.com/ee-minimal-rhel8:latest --tls-verify=false

   Alternately, you can add the private hub CA certificate to the podman certificate store:

   $ sudo mkdir /etc/containers/certs.d/private-hub.example.com
   $ sudo cp $HOME/custom-ee/files/hub-ca.crt /etc/containers/certs.d/private-hub.example.com