Managing automation content

Procedure

1. Log in to console.redhat.com as an organization administrator.
2. Navigate to Automation Hub → Connect to Hub.
3. Under Offline token, click Load token.
4. Click Copy to clipboard to copy the API token.
5. Paste the API token into a file and store in a secure location.

Procedure

1. Log in to your Ansible Automation Platform.
2. From the navigation panel, select Automation Content → Remotes.
3. In the rh-certified remote repository, click Edit remote.
4. In the URL field, paste the Sync URL.
5. In the Token field, paste the token you acquired from console.redhat.com.

6. Click Save remote.

   You can now synchronize collections between your organization synclist on console.redhat.com and your private automation hub.

7. From the navigation panel, select Automation Content → Repositories. Next to rh-certified click the More Actions icon ⋮ and select Sync repository.

8. On the modal that appears, you can toggle the following options:

   • Mirror: Select if you want your repository content to mirror the remote repository’s content.
   • Optimize: Select if you want to sync only when no changes are reported by the remote server.
9. Click Sync to complete the sync.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content → Remotes.
3. In the Details tab in the Community remote, click Edit remote.
4. In the YAML requirements field, paste the contents of your requirements.yml file.

5. Click Save remote.

   You can now synchronize collections identified in your requirements.yml file from Ansible Galaxy to your private automation hub.

6. From the navigation panel, select Automation Content → Repositories. Next to the community repository, click the More Actions icon ⋮ and select Sync repository to sync collections between Ansible Galaxy and Ansible automation hub.

7. On the modal that appears, you can toggle the following options:

   • Mirror: Select if you want your repository content to mirror the remote repository’s content.
   • Optimize: Select if you want to sync only when no changes are reported by the remote server.
8. Click Sync to complete the sync.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content → Remotes.
3. In either the rh-certified or Community remote, click the More Actions icon ⋮ and select Edit remote.
4. Expand the Show advanced options drop-down menu.
5. Enter your proxy URL, proxy username, and proxy password in the appropriate fields.
6. Click Save remote.

Procedure

1. Create your requirements file.

   In YAML format, collection information in your requirements file should look like this:

   collections:
    name: namespace.collection_name
    version: 1.0.0

2. After you have created your requirements file listing information for each collection that you want to install, navigate to the directory where the file is located and run the following command:

Procedure

1. Log in to console.redhat.com.
2. Navigate to Automation Hub → Collections.

3. Set the Sync toggle switch on each collection to exclude or include it on your synclist.

   Note

   You will only see the Sync toggle switch if you have administrator permissions.

4. To initiate the remote repository synchronization, navigate to your Ansible Automation Platform and select Automation Content → Repositories.
5. In the row containing the repository you want to sync, click the More Actions icon ⋮ and select Sync repository to initiate the remote repository synchronization to your private automation hub.
6. Optional: If your remote repository is already configured, update the collections content that you made available to local users by manually synchronizing Red Hat Ansible Certified Content Collections to your private automation hub.

Procedure

1. Create a signing script that accepts only a filename.

   Note

   This script acts as the signing service and must generate an ascii-armored detached gpg signature for that file using the key specified through the PULP_SIGNING_KEY_FINGERPRINT environment variable.

   The script prints out a JSON structure with the following format.

   {"file": "filename", "signature": "filename.asc"}

   All the file names are relative paths inside the current working directory. The file name must remain the same for the detached signature.

   Example:

   The following script produces signatures for content:

   #!/usr/bin/env bash
   
   FILE_PATH=$1
   SIGNATURE_PATH="$1.asc"
   
   ADMIN_ID="$PULP_SIGNING_KEY_FINGERPRINT"
   PASSWORD="password"
   
   # Create a detached signature
   gpg --quiet --batch --pinentry-mode loopback --yes --passphrase \
      $PASSWORD --homedir ~/.gnupg/ --detach-sign --default-key $ADMIN_ID \
      --armor --output $SIGNATURE_PATH $FILE_PATH
   
   # Check the exit status
   STATUS=$?
   if [ $STATUS -eq 0 ]; then
      echo {\"file\": \"$FILE_PATH\", \"signature\": \"$SIGNATURE_PATH\"}
   else
      exit $STATUS
   fi

   After you deploy a private automation hub with signing enabled to your Ansible Automation Platform cluster, new UI additions are displayed in collections.

2. Review the Ansible Automation Platform installer inventory file for options that begin with automationhub_*.

   [all:vars]
   .
   .
   .
   automationhub_create_default_collection_signing_service = True
   automationhub_auto_sign_collections = True
   automationhub_require_content_approval = True
   automationhub_collection_signing_service_key = /abs/path/to/galaxy_signing_service.gpg
   automationhub_collection_signing_service_script = /abs/path/to/collection_signing.sh

   The two new keys (automationhub_auto_sign_collections and automationhub_require_content_approval) indicate that the collections must be signed and approved after they are uploaded to private automation hub.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content → Collection Approvals. The Approval dashboard opens and displays a list of collections.
3. Click the thumbs up icon next to the collection you want to approve. On the modal that appears, check the box confirming that you want to approve the collection, and click Approve and sign collections.

Procedure

1. Log in to Ansible Automation Platform.

2. From the navigation panel, select Automation Content → Signature Keys. The Signature Keys dashboard displays a list of multiple keys: collections and container images.

   • To verify collections, download the key prefixed with collections-.
   • To verify container images, download the key prefixed with container-.

3. Choose one of the following methods to download your public key:

   • Click the Download Key icon to download the public key.
   • Click the Copy to clipboard next to the public key you want to copy.

Procedure

1. To import a public key into a non-default keyring for use with ansible-galaxy, run the following command.

   gpg --import --no-default-keyring --keyring ~/.ansible/pubring.kbx my-public-key.asc

   Note

   In addition to any signatures provided by automation hub, signature sources can also be provided in the requirements file and on the command line. Signature sources should be URIs.

2. To verify the collection name provided on the CLI with an additional signature, run the following command:

   ansible-galaxy collection install namespace.collection
   --signature https://examplehost.com/detached_signature.asc
   --signature file:///path/to/local/detached_signature.asc --keyring ~/.ansible/pubring.kbx

   You can use this option multiple times to provide multiple signatures.

3. Confirm that the collections in a requirements file list any additional signature sources following the collection’s signatures key, as in the following example.

   # requirements.yml
   collections:
     - name: ns.coll
       version: 1.0.0
       signatures:
         - https://examplehost.com/detached_signature.asc
         - file:///path/to/local/detached_signature.asc
   
   ansible-galaxy collection verify -r requirements.yml --keyring ~/.ansible/pubring.kbx

   When you install a collection from automation hub, the signatures provided by the server are saved along with the installed collections to verify the collection’s authenticity.

4. (Optional) If you need to verify the internal consistency of your collection again without querying the Ansible Galaxy server, run the same command you used previously using the --offline option.

Procedure

1. Log in to your Ansible Automation Platform.
2. From the navigation panel, select Access Management → Teams and click Create team.
3. Enter Content Engineering as a Name for the team.
4. Select an Organization for the team.
5. Click Create team. You have created the new team and the team Details page opens.
6. Select the Roles tab and then select the Automation Content tab.
7. Click Add roles.
8. Select Namespace from the Resource type list and click Next.
9. Select the namespaces that will receive the new roles and click Next.
10. Select the roles to apply to the selected namespaces and click Next.
11. Review your selections and click Finish.

12. Click Close to complete the process.

    The new team is created with the permissions that you assigned. You can then add users to the team.

13. Click the Users tab on the Teams page.
14. Click Add users.
15. Select users and click Add users.

Procedure

1. Log in to your Ansible Automation Platform.
2. From the navigation panel, select Automation Content → Namespaces.
3. Click Create namespace and enter a Name for your namespace.
4. Optional: enter a description, company, logo URL, resources, or useful links in the appropriate fields.
5. Click Create namespace.
6. Select the Team Access tab and click Add roles to assign roles to your namespace.
7. Select the team to which you want to grant a role, then click Next.
8. Select the roles you want to apply to the selected team, and then click Next.
9. Review your selections and click Finish.
10. Click Close to complete the process.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content → Namespaces.
3. Select the namespace you want to edit.
4. Click the Edit namespace.
5. Enter the relevant information in the fields.
6. Optional: enter markdown information in the Resources field.
7. Click Save namespace.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content → Namespaces and select a namespace.
3. Select the Collections tab.
4. Click Upload collection.
5. Click Browse next to the Collection file field.
6. Select the collection to upload.

7. Select one of the following options:

   • Staging repos
   • Repositories without pipeline
8. Click Upload collection.

Procedure

1. Log in to your Ansible Automation Platform.
2. From the navigation panel, select Automation Content → Namespaces.
3. Select a namespace.
4. Click the More Actions icon ⋮ and select Imports.
5. Use the search field or locate an imported collection from the list.
6. Click the imported collection.
7. Review collection import details to determine the status of the collection in your namespace.

Procedure

1. Log in to your Ansible Automation Platform.
2. From the navigation panel, select Automation Content → Namespaces.
3. Click the namespace to be deleted.

4. Click the More Actions icon ⋮, then click Delete namespace.

   Note

   If the Delete namespace button is disabled, the namespace contains a collection with dependencies. Review the collections in this namespace, and delete any dependencies.

Procedure

1. From the navigation panel, select Automation Content → Collection Approvals.

   Collections requiring approval have the status Needs review.

2. Find the collection you want to review in the list. You can also filter collections by Namespace, Repository, and Status using the search bar.
3. Click the thumbs up icon to approve and sign the collection. Confirm your choice in the modal that appears.

Procedure

1. From the navigation panel, select Automation Content → Collection Approvals.
2. Find the collection you want to review in the list. You can also filter collections by Namespace, Repository, and Status using the search bar.
3. Click the thumbs down icon to approve and sign the collection. Confirm your choice in the modal that appears.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content → Repositories.
3. Click Create repository.
4. Enter a Name for your repository.
5. In the Description field, describe the purpose of the repository.

6. To retain previous versions of your repository each time you make a change, enter a figure in the field labeled Retained number of versions. The number of retained versions can range anywhere between 0 and unlimited. To save all versions, leave this set to null.

   Note

   If you have a problem with a change to your custom repository, you can revert to a different repository version that you have retained.

7. In the Pipeline field, select a pipeline for the repository. This option defines who can publish a collection into the repository.

   Staging

   Anyone is allowed to publish automation content into the repository.

   Approved

   Collections added to this repository are required to go through the approval process by way of the staging repository. When auto approve is enabled, any collection uploaded to a staging repository is automatically promoted to all of the approved repositories.

   None

   Any user with permissions on the repository can publish to the repository directly, and the repository is not part of the approval pipeline.

8. Optional: To hide the repository from search results, select Hide from search.
9. Optional: To make the repository private, select Make private. This hides the repository from anyone who does not have permissions to view the repository.
10. To sync the content from a remote repository into this repository, in the Remote field select the remote that contains the collections you want included in your custom repository. For more information, see Repository sync.
11. Click Create repository.

Procedure

1. Log in to private automation hub.
2. From the navigation panel, select Automation Content → Repositories.
3. Click into your repository in the list and select the Team Access tab.
4. Click Add roles.
5. Select the team to which you want to grant a role, then click Next.
6. Select the roles you want to apply to the selected team, and then click Next.
7. Review your selections and click Finish.
8. Click Close to complete the process.

Procedure

1. From the navigation panel, select Automation Content → Repositories.
2. Click into your repository in the list.
3. Select the Collection versions tab.
4. Click Add Collections and select the collections that you want to add to your repository.
5. Click Select.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content → Repositories.
3. Click into your repository in the list and then select the Versions tab.
4. Locate the version you want to revert to and click the More Actions icon ⋮, and select Revert to this version.
5. Check the box confirming your selection, and then click Revert to repository version.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content → Repositories.

3. Locate your repository in the list and click More Actions icon ⋮, then select Sync repository.

   All collections in the configured remote are downloaded to your custom repository. To check the status of the collection sync, select Automation Content → Task Management from the navigation panel.

   Note

   To limit repository synchronization to specific collections within a remote, you can identify specific collections to be pulled by using a requirements.yml file. See Create a remote for more information.

Procedure

1. If you need to access your manifest for your container images log in to Red Hat Console.
2. Click the three-dot menu for the manifest you need for your execution environments, and click Export manifest.

3. Log in to Podman by using your registry.redhat.io credentials:

   $ podman login registry.redhat.io

4. Enter your username and password.

5. Pull an execution environment:

   $ podman pull registry.redhat.io/<ee_name>:<tag>

1. List the images in local storage:

   $ podman images

2. Check the execution environment name, and verify that the tag is correct.

Verification

1. List the images in local storage:

   $ podman images

2. Verify that the execution environment you recently tagged with your automation hub information is contained in the list.

Procedure

1. Log in to Podman using your automation hub location and credentials:

   $ podman login -u=<username> -p=<password> <automation_hub_url>

   Warning

   Let Podman prompt you for your password when you log in. Entering your password at the same time as your username can expose your password to the shell history.

2. Push your execution environment to your automation hub remote registry:

   $ podman push <automation_hub_url>/<ee_name>

Verification

1. Log in to your Ansible Automation Platform.
2. Navigate to Automation Content → Execution Environments.
3. Locate the container in the container repository list.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content → Execution Environments.
3. Select your execution environment.
4. On the Detail tab, click Add.
5. In the Raw Markdown text field, enter your README text in Markdown.
6. Click Save when you are finished.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content → Execution Environments.
3. Select your automation execution environments.
4. From the Team Access tab, click Add roles.
5. Select the team or teams to which you want to grant access and click Next.
6. Select the roles that you want to add to this execution environment and click Next.
7. Click Finish.

Procedure

1. From the navigation panel, select Automation Content → Execution Environments.
2. Select your automation execution environments.
3. Click the Images tab.
4. Click the More Actions icon ⋮, and click Manage tags.
5. Add a new tag in the text field and click Add.
6. Optional: Remove current tags by clicking x on any of the tags for that image.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Execution → Infrastructure → Credentials.
3. Click Create credential to create a new credential.
4. Enter an authorization Name, Description, and Organization.
5. In the Credential Type drop-down, select Container Registry.
6. Enter the Authentication URL. This is the remote registry address.
7. Enter the Username and Password or Token required to log in to the remote registry.
8. Optional: To enable SSL verification, select Verify SSL.
9. Click Create credential.

Procedure

1. If you are pulling automation execution environmentss from a password or token-protected registry, create a credential before pulling the automation execution environments.
2. From the navigation panel, select Automation Content → Execution Environments.
3. Select your automation execution environments.
4. In the Pull this image entry, click Copy to clipboard.
5. Paste and run the command in your terminal.

Procedure

1. From the navigation panel, select Automation Content → Execution Environments.
2. Add https://registry.redhat.io to the registry.

3. Add any required credentials to authenticate.

   Note

   Some remote registries are aggressive with rate limiting. Set a rate limit under Advanced Options.

4. From the navigation panel, select Automation Content → Execution Environments.
5. Click Create execution environment in the page header.

6. Select the registry you want to pull from. The Name field displays the name of the automation execution environments displayed on your local registry.

   Note

   The Upstream name field is the name of the image on the remote server. For example, if the upstream name is set to "alpine" and the Name field is "local/alpine", the alpine image is downloaded from the remote and renamed to "local/alpine".

7. Set a list of tags to include or exclude. Syncing automation execution environmentss with a large number of tags is time consuming and uses a lot of disk space.

Procedure

1. From a terminal, create a signing script, and pass the script path as an installer parameter.

   Example:

   #!/usr/bin/env bash
   
   # pulp_container SigningService will pass the next 4 variables to the script.
   MANIFEST_PATH=$1
   FINGERPRINT="$PULP_SIGNING_KEY_FINGERPRINT"
   IMAGE_REFERENCE="$REFERENCE"
   SIGNATURE_PATH="$SIG_PATH"
   
   # Create container signature using skopeo
   skopeo standalone-sign \
     $MANIFEST_PATH \
     $IMAGE_REFERENCE \
     $FINGERPRINT \
     --output $SIGNATURE_PATH
   
   # Optionally pass the passphrase to the key if password protected.
   # --passphrase-file /path/to/key_password.txt
   
   # Check the exit status
   STATUS=$?
   if [ $STATUS -eq 0 ]; then
     echo {\"signature_path\": \"$SIGNATURE_PATH\"}
   else
     exit $STATUS
   fi

2. Review the Ansible Automation Platform installer inventory file for options for container signing that begin with automationhub_*.

   [all:vars]
   .
   .
   .
   
   automationhub_create_default_container_signing_service = True
   automationhub_container_signing_service_key = /absolute/path/to/key/to/sign
   automationhub_container_signing_service_script = /absolute/path/to/script/that/signs

3. Once installation is complete, log in to Ansible Automation Platform and navigate to Automation Content → Signature Keys.
4. Ensure that you have a key titled container-default, or container-anyname.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content → Remote Registries.

3. Click Create remote registry.

   • In the Name field, enter the name of the registry where the container resides.
   • In the URL field, enter the URL of the registry where the container resides.
   • In the Username field, enter the username if necessary.
   • In the Password field, enter the password if necessary.
   • Click Create remote registry.

Procedure

1. From the navigation panel, select Automation Content → Execution Environments.
2. Click Create execution environment.
3. Enter the name of the execution environment.
4. Enter the upstream name.
5. Under Registry, select the name of the registry from the drop-down menu.
6. Enter tags in the Add tag(s) to include field. If the field is blank, all the tags are passed. You must specify which repository-specific tags to pass.
7. Optional: Enter tags to exclude in Add tag(s) to exclude.
8. Click Create automation execution environments.
9. Synchronize the image.

Procedure

1. From a terminal, log in to Podman, or any container client currently in use:

   > podman pull <container-name>

2. After the automation execution environments is pulled, add tags (for example: latest, rc, beta, or version numbers, such as 1.0; 2.3, and so on):

   > podman tag <container-name> <server-address>/<container-name>:<tag name>

3. Sign the automation execution environments after changes have been made, and push it back up to the automation hub registry:

   > podman push <server-address>/<container-name>:<tag name> --tls-verify=false --sign-by <reference to the gpg key on your local>

   If the automation execution environments is not signed, it can only be pushed with any current signature embedded. Alternatively, you can use the following script to push the automation execution environments without signing it:

   > podman push <server-address>/<container-name>:<tag name> --tls-verify=false

4. Once the automation execution environments has been pushed, navigate to Automation Content → Execution Environments.
5. To display the new execution environment, click the Refresh icon.
6. Click the name of the image to view your pushed image.

1. Click the automation execution environments name to navigate to the details page.

2. Click the More Actions icon ⋮. Three options are available:

   • Sign execution environment
   • Use in Controller
   • Delete execution environment
3. Click Sign execution environment from the drop-down menu.

Procedure

1. From the navigation panel, select Automation Content → Signature Keys.
2. Click the Download key icon next to the signature that you are using. A new window should open to indicate you have downloaded the key.

Procedure

1. Open your terminal and use the following command:

   >  sudo <name of editor> /etc/containers/policy.json

   The file that is displayed is similar to this:

   {
     "default": [{"type": "reject"}],
     "transports": {
     	"docker": {
       	"quay.io": [{"type": "insecureAcceptAnything"}],
       	"docker.io": [{"type": "insecureAcceptAnything"}],
       	"<server-address>": [
         	{
             	    "type": "signedBy",
             	    "keyType": "GPGKeys",
             	    "keyPath": "/tmp/containersig.txt"
         	}]
     	}
     }
   }

   This file shows that neither quay.io, or docker.io will perform the verification, because the type is insecureAcceptAnything which overrides the default type of reject. However, <server-address> will perform the verification, because the parameter type is set to "signedBy".

   Note

   The only keyType currently supported is GPG keys.

2. Under the <server-address> entry, modify the keyPath <1> to include the name of your key file.

   {
       	"default": [{"type": "reject"}],
       	"transports": {
           	"docker": {
             	  "quay.io": [{"type": "insecureAcceptAnything"}],
             	  "docker.io": [{"type": "insecureAcceptAnything"}],
             	  "<server-address>": [{
                   	"type": "signedBy",
                   	"keyType": "GPGKeys",
                   	"keyPath": "/tmp/<key file name>",
                   	"signedIdentity": {
                     	  "type": "matchExact"
                       }
               	  }]
               }
       	}
   }

3. Save and close the file.