Installing on OpenShift Container Platform

Procedure

1. Log in to Red Hat OpenShift Container Platform.
2. Navigate to Operators → OperatorHub.
3. Search for Ansible Automation Platform and click Install.

4. Select an Update Channel:

   • stable-2.x: installs a namespace-scoped operator, which limits deployments of automation hub and automation controller instances to the namespace the operator is installed in, this is suitable for most cases. The stable-2.x channel does not require administrator privileges and utilizes fewer resources because it only monitors a single namespace.
   • stable-2.x-cluster-scoped: installs the Ansible Automation Platform Operator in a single namespace that manages Ansible Automation Platform custom resources and deployments in all namespaces. The Ansible Automation Platform Operator requires administrator privileges for all namespaces in the cluster.
5. Select Installation Mode, Installed Namespace, and Approval Strategy.
6. Click Install.

Procedure

1. Create a project for the operator.

   oc new-project ansible-automation-platform

   Copy to Clipboard Toggle word wrap
2. Create a file called sub.yaml.

3. Add the following YAML code to the sub.yaml file.

   ---
   apiVersion: v1
   kind: Namespace
   metadata:
     labels:
       openshift.io/cluster-monitoring: "true"
     name: ansible-automation-platform
   ---
   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: ansible-automation-platform-operator
     namespace: ansible-automation-platform
   spec:
     targetNamespaces:
       - ansible-automation-platform
   ---
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: ansible-automation-platform
     namespace: ansible-automation-platform
   spec:
     channel: 'stable-2.5'
     installPlanApproval: Automatic
     name: ansible-automation-platform-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
   ---

   Copy to Clipboard Toggle word wrap

   This file creates a Subscription object called ansible-automation-platform that subscribes the ansible-automation-platform namespace to the ansible-automation-platform-operator operator.

4. Run the oc apply command to create the objects specified in the sub.yaml file:

   oc apply -f sub.yaml

   Copy to Clipboard Toggle word wrap

5. Verify the CSV PHASE reports "Succeeded" before proceeding using the oc get csv -n ansible-automation-platform command:

   oc get csv -n ansible-automation-platform
   
   NAME                               DISPLAY                       VERSION              REPLACES                           PHASE
   aap-operator.v2.5.0-0.1728520175   Ansible Automation Platform   2.5.0+0.1728520175   aap-operator.v2.5.0-0.1727875185   Succeeded

   Copy to Clipboard Toggle word wrap

6. Create an AnsibleAutomationPlatform object called example in the ansible-automation-platform namespace.

   To change the Ansible Automation Platform and its components from example, edit the name field in the metadata: section and replace example with the name you want to use:

   oc apply -f - <<EOF
   apiVersion: aap.ansible.com/v1alpha1
   kind: AnsibleAutomationPlatform
   metadata:
     name: example
     namespace: ansible-automation-platform
   spec:
     # Platform
     image_pull_policy: IfNotPresent
     # Components
     controller:
       disabled: false
     eda:
       disabled: false
     hub:
       disabled: false
       ## Modify to contain your RWM storage class name
       storage_type: file
       file_storage_storage_class: <your-read-write-many-storage-class>
       file_storage_size: 10Gi
   
       ## uncomment if using S3 storage for Content pod
       # storage_type: S3
       # object_storage_s3_secret: example-galaxy-object-storage
   
       ## uncomment if using Azure storage for Content pod
       # storage_type: azure
       # object_storage_azure_secret: azure-secret-name
     lightspeed:
       disabled: true
   EOF

   Copy to Clipboard Toggle word wrap

Procedure

1. Use these values in the following command to fetch the password for the platform gateway instance.

   oc get secret/<your instance name>-<admin_user>-password -o yaml

   Copy to Clipboard Toggle word wrap

2. The default value for admin_user is admin. Modify the command if you changed the admin username in the AnsibleAutomationPlatform object.

   The following example retrieves the password for a platform gateway object called example:

   oc get secret/example-admin-password -o yaml

   Copy to Clipboard Toggle word wrap

   The base64 encoded password for the platform gateway instance is listed in the metadata field in the output:

   $ oc get secret/example-admin-password -o yaml
   
   apiVersion: v1
   data:
     password: ODzLODzLODzLODzLODzLODzLODzLODzLODzLODzLODzL
   kind: Secret
   metadata:
     labels:
       app.kubernetes.io/component: aap
       app.kubernetes.io/name: example
       app.kubernetes.io/operator-version: ""
       app.kubernetes.io/part-of: example
     name: example-admin-password
     namespace: ansible-automation-platform

   Copy to Clipboard Toggle word wrap

Procedure

1. From the Subscription Allocations page, click New Subscription Allocation.
2. Enter a name for the allocation so that you can find it later.
3. Select Type: Satellite 6.16 as the management application.
4. Click Create.

Procedure

1. From the Subscription Allocations page, click on the name of the Subscription Allocation to which you would like to add a subscription.
2. Click the Subscriptions tab.
3. Click Add Subscriptions.
4. Enter the number of Ansible Automation Platform Entitlements you plan to add.
5. Click Submit.

Procedure

1. From the Subscription Allocations page, click on the name of the Subscription Allocation to which you would like to generate a manifest.
2. Click the Subscriptions tab.

3. Click Export Manifest to download the manifest file.

   This downloads a file manifest<allocation name>_<date>.zip_ to your default downloads folder.

Procedure

1. Log in to Red Hat Ansible Automation Platform.
2. Select Service Account / Red Hat Satellite.
3. Enter your Client ID / Satellite username and Client secret / Satellite password.

4. Select your subscription from the Subscription list.

   Note

   You can also use your Satellite username and password if your cluster nodes are registered to Satellite through Subscription Manager.

5. Review the End User License Agreement and select I agree to the End User License Agreement.
6. Click Finish.

Procedure

1. Log in to Red Hat Ansible Automation Platform.
2. If you are not immediately prompted for a manifest file, go to Settings → Subscription.
3. Select Subscription manifest.
4. Click Browse and select the manifest file.
5. Review the End User License Agreement and select I agree to the End User License Agreement.

6. Click Finish.

   Note

   If the BROWSE button is disabled on the Subscription Settings page, clear the USERNAME and PASSWORD fields.

Procedure

1. Create a postgres_configuration_secret YAML file, following the template below:

   apiVersion: v1
   kind: Secret
   metadata:
     name: external-postgres-configuration
     namespace: <target_namespace> 

   1

   
   stringData:
     host: "<external_ip_or_url_resolvable_by_the_cluster>" 

   2

   
     port: "<external_port>" 

   3

   
     database: "<desired_database_name>"
     username: "<username_to_connect_as>"
     password: "<password_to_connect_with>" 

   4

   
     type: "unmanaged"
   type: Opaque

   Copy to Clipboard Toggle word wrap
   1. Namespace to create the secret in. This should be the same namespace you want to deploy to.
   2. The resolvable hostname for your database node.
   3. External port defaults to 5432.
   4. Value for variable password should not contain single or double quotes (', ") or backslashes (\) to avoid any issues during deployment, backup or restoration.

2. Apply external-postgres-configuration-secret.yml to your cluster using the oc create command.

   $ oc create -f external-postgres-configuration-secret.yml

   Copy to Clipboard Toggle word wrap
   Note

   The following example is for a platform gateway deployment. To configure an external database for all components, use the aap-configuring-external-db-all-default-components.yml example in the 14.1. Custom resources section.

3. When creating your AnsibleAutomationPlatform custom resource object, specify the secret on your spec, following the example below:

   apiVersion: aap.ansible.com/v1alpha1
   kind: AnsibleAutomationPlatform
   metadata:
     name: example-aap
     Namespace: aap
   spec:
     database:
        database_secret: automation-platform-postgres-configuration

   Copy to Clipboard Toggle word wrap

Procedure

1. Edit the /var/lib/pgsql/data/postgres.conf file on the database server:

   # vi /var/lib/pgsql/data/postgres.conf

   Copy to Clipboard Toggle word wrap

2. Find and comment out the line:

   #datestyle = 'Redwood, SHOW_TIME'

   Copy to Clipboard Toggle word wrap

3. Add the following setting immediately below the newly-commented line:

   datestyle = 'iso, mdy'

   Copy to Clipboard Toggle word wrap
4. Save and close the postgres.conf file.

5. Reload the database configuration:

   # systemctl reload postgresql

   Copy to Clipboard Toggle word wrap
   Note

   Running this command does not disrupt database operations.

Procedure

1. Log in to Red Hat OpenShift Container Platform.
2. Go to Operators → Installed Operators.
3. Select your Ansible Automation Platform Operator deployment.
4. Select All Instances and go to your AnsibleAutomationPlatform instance.
5. Click the ⋮ icon and then select Edit AnsibleAutomationPlatform.

6. In the YAML view paste the following YAML code under the spec: section:

   spec:
     extra_settings:
       - setting: REDIRECT_IS_HTTPS
         value: '"True"'

   Copy to Clipboard Toggle word wrap
7. Click Save.

Procedure

1. Log in to Red Hat OpenShift Container Platform.
2. Navigate to Operators → Installed Operators.
3. Select your Ansible Automation Platform Operator deployment.
4. Select the Ansible Automation Platform tab.

5. For new instances, click Create AnsibleAutomationPlatform.

   1. For existing instances, you can edit the YAML view by clicking the ⋮ icon and then Edit AnsibleAutomationPlatform.
6. Click Advanced Configuration.
7. Under Ingres annotations, enter any annotations to add to the ingress.
8. Under Ingress TLS secret, click the drop-down list and select a secret from the list.

9. Under YAML view paste in the following code:

   spec:
     extra_settings:
       - setting: CSRF_TRUSTED_ORIGINS
         value:
           - https://my-aap-domain.com

   Copy to Clipboard Toggle word wrap
10. After you have configured your platform gateway, click Create at the bottom of the form view (Or Save in the case of editing existing instances).

Procedure

1. Create a postgres_configuration_secret YAML file, following the template below:

   apiVersion: v1
   kind: Secret
   metadata:
     name: external-postgres-configuration
     namespace: <target_namespace> 

   1

   
   stringData:
     host: "<external_ip_or_url_resolvable_by_the_cluster>" 

   2

   
     port: "<external_port>" 

   3

   
     database: "<desired_database_name>"
     username: "<username_to_connect_as>"
     password: "<password_to_connect_with>" 

   4

   
     sslmode: "prefer" 

   5

   
     type: "unmanaged"
   type: Opaque

   Copy to Clipboard Toggle word wrap
   1. Namespace to create the secret in. This should be the same namespace you want to deploy to.
   2. The resolvable hostname for your database node.
   3. External port defaults to 5432.
   4. Value for variable password should not contain single or double quotes (', ") or backslashes (\) to avoid any issues during deployment, backup or restoration.
   5. The variable sslmode is valid for external databases only. The allowed values are: prefer, disable, allow, require, verify-ca, and verify-full.

2. Apply external-postgres-configuration-secret.yml to your cluster using the oc create command.

   $ oc create -f external-postgres-configuration-secret.yml

   Copy to Clipboard Toggle word wrap

3. When creating your AutomationController custom resource object, specify the secret on your spec, following the example below:

   apiVersion: automationcontroller.ansible.com/v1beta1
   kind: AutomationController
   metadata:
     name: controller-dev
   spec:
     postgres_configuration_secret: external-postgres-configuration

   Copy to Clipboard Toggle word wrap

Procedure

1. List the existing PVCs in your deployment namespace:

   oc get pvc -n <namespace>

   Copy to Clipboard Toggle word wrap
2. Identify the PVC associated with your previous deployment by comparing the old deployment name and the PVC name.

3. Delete the old PVC:

   oc delete pvc -n <namespace> <pvc-name>

   Copy to Clipboard Toggle word wrap

Procedure

1. Log into Red Hat OpenShift Container Platform.
2. Navigate to Networking → Routes.
3. Under Location, click on the URL for your automation hub instance.

Procedure

1. Create a postgres_configuration_secret YAML file, following the template below:

   apiVersion: v1
   kind: Secret
   metadata:
     name: external-postgres-configuration
     namespace: <target_namespace> 

   1

   
   stringData:
     host: "<external_ip_or_url_resolvable_by_the_cluster>" 

   2

   
     port: "<external_port>" 

   3

   
     database: "<desired_database_name>"
     username: "<username_to_connect_as>"
     password: "<password_to_connect_with>" 

   4

   
     sslmode: "prefer" 

   5

   
     type: "unmanaged"
   type: Opaque

   Copy to Clipboard Toggle word wrap
   1. Namespace to create the secret in. This should be the same namespace you want to deploy to.
   2. The resolvable hostname for your database node.
   3. External port defaults to 5432.
   4. Value for variable password should not contain single or double quotes (', ") or backslashes (\) to avoid any issues during deployment, backup or restoration.
   5. The variable sslmode is valid for external databases only. The allowed values are: prefer, disable, allow, require, verify-ca, and verify-full.

2. Apply external-postgres-configuration-secret.yml to your cluster using the oc create command.

   $ oc create -f external-postgres-configuration-secret.yml

   Copy to Clipboard Toggle word wrap

3. When creating your AutomationHub custom resource object, specify the secret on your spec, following the example below:

   apiVersion: automationhub.ansible.com/v1beta1
   kind: AutomationHub
   metadata:
     name: hub-dev
   spec:
     postgres_configuration_secret: external-postgres-configuration

   Copy to Clipboard Toggle word wrap

Procedure

1. List the existing PVCs in your deployment namespace:

   oc get pvc -n <namespace>

   Copy to Clipboard Toggle word wrap
2. Identify the PVC associated with your previous deployment by comparing the old deployment name and the PVC name.

3. Delete the old PVC:

   oc delete pvc -n <namespace> <pvc-name>

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to Red Hat OpenShift Container Platform.
2. Navigate to Home → Search.
3. Select the Resources drop-down list and type "Image".
4. Select Image (config,openshift.io/v1).
5. Click Cluster under the Name heading.
6. Select the YAML tab.

7. Paste in the following under spec value:

   spec:
     registrySources:
       allowedRegistries:
       - quay.io
       - registry.redhat.io
       - image-registry.openshift-image-registry.svc:5000
       - <OCP route for your automation hub>

   Copy to Clipboard Toggle word wrap
8. Click Save.

Procedure

1. Create a ConfigMap for signing scripts. The ConfigMap you create contains the scripts used by the signing service for collections and container images.

   Note

   This script is used as part of the signing service and must generate an ascii-armored detached gpg signature for that file using the key specified through the PULP_SIGNING_KEY_FINGERPRINT environment variable.

   The script prints out a JSON structure with the following format.

   {"file": "filename", "signature": "filename.asc"}

   Copy to Clipboard Toggle word wrap

   All the file names are relative paths inside the current working directory. The file name must remain the same for the detached signature.

   Example: The following script produces signatures for content:

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: signing-scripts
   data:
     collection_sign.sh: |-
         #!/usr/bin/env bash
   
         FILE_PATH=$1
         SIGNATURE_PATH=$1.asc
   
         ADMIN_ID="$PULP_SIGNING_KEY_FINGERPRINT"
         PASSWORD="password"
   
         # Create a detached signature
         gpg --quiet --batch --pinentry-mode loopback --yes --passphrase \
           $PASSWORD --homedir /var/lib/pulp/.gnupg --detach-sign --default-key $ADMIN_ID \
           --armor --output $SIGNATURE_PATH $FILE_PATH
   
         # Check the exit status
         STATUS=$?
         if [ $STATUS -eq 0 ]; then
           echo {\"file\": \"$FILE_PATH\", \"signature\": \"$SIGNATURE_PATH\"}
         else
           exit $STATUS
         fi
     container_sign.sh: |-
       #!/usr/bin/env bash
   
       # galaxy_container SigningService will pass the next 4 variables to the script.
       MANIFEST_PATH=$1
       FINGERPRINT="$PULP_SIGNING_KEY_FINGERPRINT"
       IMAGE_REFERENCE="$REFERENCE"
       SIGNATURE_PATH="$SIG_PATH"
   
       # Create container signature using skopeo
       skopeo standalone-sign \
         $MANIFEST_PATH \
         $IMAGE_REFERENCE \
         $FINGERPRINT \
         --output $SIGNATURE_PATH
   
       # Optionally pass the passphrase to the key if password protected.
       # --passphrase-file /path/to/key_password.txt
   
       # Check the exit status
       STATUS=$?
       if [ $STATUS -eq 0 ]; then
         echo {\"signature_path\": \"$SIGNATURE_PATH\"}
       else
         exit $STATUS
       fi

   Copy to Clipboard Toggle word wrap

2. Create a secret for your GnuPG private key. This secret securely stores the GnuPG private key you use for signing.

   gpg --export --armor <your-gpg-key-id> > signing_service.gpg
   
   oc create secret generic signing-galaxy --from-file=signing_service.gpg

   Copy to Clipboard Toggle word wrap

   The secret must have a key named signing_service.gpg.

3. Configure the AnsibleAutomationPlatform CR.

   apiVersion: aap.ansible.com/v1alpha1
   kind: AnsibleAutomationPlatform
   metadata:
     name: aap-hub-signing-sample
   spec:
     hub:
       signing_secret: "signing-galaxy"
       signing_scripts_configmap: "signing-scripts"

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to Red Hat OpenShift Container Platform as an administrator.
2. Navigate to Workloads → Secrets.
3. From the Projects list, select the namespace that you created when you installed the Ansible Automation Platform operator.
4. Click Create → Key/value secret.
5. In the Secret name field, enter a unique name for the secret. For example, chatbot-configuration-secret.

6. Add the following keys and their associated values individually:

   Expand

   Key	Value
   Settings for all LLM setups
   chatbot_model	Enter the LLM model name that is configured on your LLM setup.
   chatbot_url	Enter the inference API base URL on your LLM setup. For example, https://your_inference_api/v1.
   chatbot_token	Enter the API token or the API key. This token is sent along with the authorization header when an inference API is called.
   chatbot_llm_provider_type	Optional Enter the provider type of your LLM setup by using one of the following values: Red Hat Enterprise Linux AI: rhelai_vllm Red Hat OpenShift AI: rhoai_vllm (Default value) IBM watsonx.ai: watsonx OpenAI: openai Microsoft Azure OpenAI: azure_openai
   chatbot_context_window_size	Optional Enter a value to configure the context window length for your LLM setup. Default= 128000
   chatbot_temperature_override	Optional A lower temperature generates predictable results, while a higher temperature allows more diverse or creative responses. Enter one of the following values: 0: Least creativity and randomness in the responses. 1: Maximum creativity and randomness in the responses. null: Override or disable the default temperature setting. Note A few OpenAI o-series models (o1, o3-mini, and o4-mini models) do not support the temperature settings. Therefore, you must set the value to null to use these OpenAI models.
   Additional setting for IBM watsonx.ai only
   chatbot_llm_provider_project_id	Enter the project ID of your IBM watsonx setup.
   Additional settings for Microsoft Azure OpenAI only
   chatbot_azure_deployment_name	Enter the deployment name of your Microsoft Azure OpenAI setup.
   chatbot_azure_api_version	Optional Enter the API version of your Microsoft Azure OpenAI setup.

   Show more
7. Click Create. The chatbot authorization secret is successfully created.

Procedure

1. Log in to Red Hat OpenShift Container Platform as an administrator.
2. Navigate to Operators → Installed Operators.
3. From the list of installed operators, select the Ansible Automation Platform operator.
4. Locate and select the Ansible Automation Platform custom resource, and then click the required app.
5. Select the YAML tab.

6. Scroll the text to find the spec: section, and add the following details under the spec: section:

   spec:
     lightspeed:
       disabled: false
       chatbot_config_secret_name: <name of your chatbot configuration secret>

   Copy to Clipboard Toggle word wrap
7. Click Save. The Ansible Lightspeed intelligent assistant service takes a few minutes to set up.

Verification

1. Verify that the chat interface service is running successfully:

   1. Navigate to Workloads → Pods.

   2. Filter with the term api and ensure that the following APIs are displayed in Running status:

      • myaap-lightspeed-api-<version number>
      • myaap-lightspeed-chatbot-api-<version number>

2. Verify that the chat interface is displayed on the Ansible Automation Platform:

   1. Access the Ansible Automation Platform:

      1. Navigate to Operators → Installed Operators.
      2. From the list of installed operators, click Ansible Automation Platform.
      3. Locate and select the Ansible Automation Platform custom resource, and then click the app that you created.

      4. From the Details tab, record the information available in the following fields:

         • URL: This is the URL of your Ansible Automation Platform instance.
         • Gateway Admin User: This is the username to log into your Ansible Automation Platform instance.
         • Gateway Admin password: This is the password to log into your Ansible Automation Platform instance.
      5. Log in to the Ansible Automation Platform using the URL, username, and password that you recorded earlier.

   2. Access the Ansible Lightspeed intelligent assistant:

      1. Click the Ansible Lightspeed intelligent assistant icon that is displayed at the top right corner of the taskbar.

      2. Verify that the chat interface is displayed, as shown in the following image:

         .

1. Log in to the Ansible Automation Platform.

2. Click the Ansible Lightspeed intelligent assistant icon that is displayed at the top right corner of the taskbar.

   The Ansible Lightspeed intelligent assistant window opens with a welcome message, as shown in the following image:

   

1. A new update becomes available in the marketplace, through the redhat-operator CatalogSource.

2. The system automatically creates a new InstallPlan for your Ansible Automation Platform subscription.

   • If set to Manual, the InstallPlan needs manual approval in the OpenShift UI.

   • If set to Automatic, it upgrades as soon as the new version is available.

     Note

     Set a manual install strategy on your Ansible Automation Platform Operator subscription during installation or upgrade. You will be prompted to approve upgrades when available in your chosen update channel. Stable channels, like stable-2.5, are available for each X.Y release.

3. A new subscription, CSV, and operator containers are created alongside the old ones. The old resources are cleaned up after a successful install.

Procedure

1. From the navigation panel of the platform gateway, select Access Management → Users.
2. Select the check box for the user that you want to modify.
3. Click the Pencil icon and select Edit user.
4. The Edit user page is displayed where you can see the service level administrator privileges assigned by the User type checkboxes. See Editing a user for more information on these user types.

1. Legacy user login and account linking
2. Migration to LDAP without account linking

Procedure

1. Specify the connection secret and job template you want to launch.

   apiVersion: tower.ansible.com/v1alpha1
   kind: AnsibleJob
   metadata:
     generateName: demo-job-1 # generate a unique suffix per 'kubectl create'
   spec:
     connection_secret: controller-access
     job_template_name: Demo Job Template

   Copy to Clipboard Toggle word wrap

2. Configure features such as, inventory, extra variables, and time to live for the job.

   spec:
     connection_secret: controller-access
     job_template_name: Demo Job Template
     inventory: Demo Inventory                    # Inventory prompt on launch needs to be enabled
     runner_image: quay.io/ansible/controller-resource-runner
     runner_version: latest
     job_ttl: 100
     extra_vars:                                  # Extra variables prompt on launch needs to be enabled
        test_var: test
     job_tags: "provision,install,configuration"  # Specify tags to run
     skip_tags: "configuration,restart"           # Skip tasks with a given tag

   Copy to Clipboard Toggle word wrap
   Note

   You must enable prompt on launch for inventories and extra variables if you are configuring those. To enable Prompt on launch, within the automation controller UI: From the Resources → Templates page, select your template and select the Prompt on launch checkbox next to Inventory and Variables sections.

3. Launch a workflow job template with an AnsibleJob object by specifying the workflow_template_name instead of job_template_name:

   apiVersion: tower.ansible.com/v1alpha1
   kind: AnsibleJob
   metadata:
     generateName: demo-job-1 # generate a unique suffix per 'kubectl create'
   spec:
     connection_secret: controller-access
     workflow_template_name: Demo Workflow Template

   Copy to Clipboard Toggle word wrap