Operating Ansible Automation Platform

Procedure

1. From the navigation panel, select Settings → Automation Execution → System.

2. In the Proxy IP Allowed List field, enter IP addresses that are permitted to connect to your automation controller, using the syntax in the following example:

   Example Proxy IP Allowed List entry

   [
     "example1.proxy.com:8080",
     "example2.proxy.com:8080"
   ]

   Copy to Clipboard Toggle word wrap

   Important
   • Proxy IP Allowed List requires proxies in the list are properly sanitizing header input and correctly setting an X-Forwarded-For value equal to the real source IP of the client. Automation controller can rely on the IP addresses and hostnames in Proxy IP Allowed List to provide non-spoofed values for X-Forwarded-For.

   • Do not configure HTTP_X_FORWARDED_FOR as an item in Remote Host Headers unless all of the following conditions are satisfied:

     • You are using a proxied environment with ssl termination;
     • The proxy provides sanitization or validation of the X-Forwarded-For header to prevent client spoofing;
     • /etc/tower/conf.d/remote_host_headers.py defines PROXY_IP_ALLOWED_LIST that contains only the originating IP addresses of trusted proxies or load balancers.
3. Click Save to save the settings.

Procedure

1. Perform the following steps on the automation controller nodes. If ansible-builder has not been installed yet, install it first.

   # subscription-manager repos --enable ansible-automation-platform-2.5-for-rhel-8-x86_64-rpms
   # dnf install ansible-builder

   Copy to Clipboard Toggle word wrap

2. Build a custom execution environment.

   1. First, create a work directory:

      # su - awx
      $ mkdir -p builder/newee
      $ cd builder/newee

      Copy to Clipboard Toggle word wrap

3. Create an execution-environment.yml file with the following content:

   version: 1
   
   build_arg_defaults:
     EE_BASE_IMAGE: 'registry.redhat.io/ansible-automation-platform-24/ee-supported-rhel8:latest'
   
   additional_build_steps:
     prepend:
       - RUN microdnf install -y nc

   Copy to Clipboard Toggle word wrap

4. Log in to registry.redhat.io.

   $ podman login registry.redhat.io

   Copy to Clipboard Toggle word wrap

5. Run ansible-builder to start the building process.

   $ cd /var/lib/awx/builder/newee/
   $ ansible-builder build -t my-env -v 3

   Copy to Clipboard Toggle word wrap
6. Add the custom execution environment you created.
7. On the navigation panel, select Automation Execution → Infrastructure → Execution Environments.
8. Click Create execution environment.
9. In the Image field add localhost/my-env:latest.
10. Click Create execution environment.

11. Re-run the Ansible Automation Platform installation program with the following steps to replace the execution environment from the default to the customized environment which will be used as a Project syncs.

    Note

    Backup Ansible Automation Platform before running the installation program.

    # ./setup.sh -b

    Copy to Clipboard Toggle word wrap

12. Create an automationcontroller file under the group_vars directory in the same location as the setup.sh file. The file contents are as follows:

    control_plane_execution_environment: localhost/my-env

    Copy to Clipboard Toggle word wrap

13. Run setup.sh

    # ./setup.sh

    Copy to Clipboard Toggle word wrap

14. Create ssh_config under the directory. For example:

    Host github.com
    Hostname ssh.github.com
    ProxyCommand nc --proxy-type http --proxy proxy.example.com:port %h %p
    User git

    Copy to Clipboard Toggle word wrap
15. Add the ssh_config file’s directory path in PATH to expose the isolated jobs so that the container execution environment can read ssh_config file.
16. In the navigation panel, select Settings → Automation Execution → Job.
17. Click Edit.

18. If the ssh_config file has been created as /var/lib/awx/.ssh/ssh_config, add this to Paths to expose to isolated jobs

    Note

    Ensure ssh_config is owned by the AWX user. (#chown awx:awx /var/lib/awx/.ssh/ssh_config)

    [
    "/var/lib/awx/.ssh:/etc/ssh:O"
    ]

    Copy to Clipboard Toggle word wrap

Procedure

1. Log in to your automation controller.
2. From the navigation panel, select Settings → Automation Execution → System.
3. Select Gather data for Automation Analytics to enable automation controller to gather data on automation and send it to Automation Analytics.

Procedure

1. To prepare the certificates and keys, choose one of the following methods:

   • To provide custom certificates - For each service that requires updated TLS certificates, copy the new certificates and keys to a path relative to the Ansible Automation Platform installer. Then update the inventory file variables with the absolute paths to the new files.

     # Platform gateway
     gateway_tls_cert=<path_to_tls_certificate>
     gateway_tls_key=<path_to_tls_key>
     gateway_pg_tls_cert=<path_to_tls_certificate>
     gateway_pg_tls_key=<path_to_tls_key>
     gateway_redis_tls_cert=<path_to_tls_certificate>
     gateway_redis_tls_key=<path_to_tls_key>
     
     # Automation controller
     controller_tls_cert=<path_to_tls_certificate>
     controller_tls_key=<path_to_tls_key>
     controller_pg_tls_cert=<path_to_tls_certificate>
     controller_pg_tls_key=<path_to_tls_key>
     
     # Automation hub
     hub_tls_cert=<path_to_tls_certificate>
     hub_tls_key=<path_to_tls_key>
     hub_pg_tls_cert=<path_to_tls_certificate>
     hub_pg_tls_key=<path_to_tls_key>
     
     # Event-Driven Ansible
     eda_tls_cert=<path_to_tls_certificate>
     eda_tls_key=<path_to_tls_key>
     eda_pg_tls_cert=<path_to_tls_certificate>
     eda_pg_tls_key=<path_to_tls_key>
     eda_redis_tls_cert=<path_to_tls_certificate>
     eda_redis_tls_key=<path_to_tls_key>
     
     # PostgreSQL
     postgresql_tls_cert=<path_to_tls_certificate>
     postgresql_tls_key=<path_to_tls_key>
     
     # Receptor
     receptor_tls_cert=<path_to_tls_certificate>
     receptor_tls_key=<path_to_tls_key>

     Copy to Clipboard Toggle word wrap

   • To generate new certificates - If you want the installation program to generate a new certificate for a service, delete or move the existing certificates and keys.

     Expand

     Table 6.1. Certificate and key file paths per service

     Service	Certificate file path	Key file path
     Automation controller	~/aap/controller/etc/tower.cert	~/aap/controller/etc/tower.key
     Event-Driven Ansible	~/aap/eda/etc/eda.cert	~/aap/eda/etc/eda.key
     Platform gateway	~/aap/gateway/etc/gateway.cert	~/aap/gateway/etc/gateway.key
     Automation hub	~/aap/hub/etc/pulp.cert	~/aap/hub/etc/pulp.key
     PostgreSQL	~/aap/postgresql/server.crt	~/aap/postgresql/server.key
     Receptor	~/aap/receptor/etc/receptor.crt	~/aap/receptor/etc/receptor.key
     Redis	~/aap/redis/server.crt	~/aap/redis/server.key

     Show more

2. After preparing your certificates, run the install playbook from your installation directory:

   ansible-playbook -i <inventory_file_name> ansible.containerized_installer.install

   Copy to Clipboard Toggle word wrap

Procedure

1. Copy the signed SSL certificate and key to a secure location.

2. Create a TLS secret within OpenShift:

   oc create secret tls ${CONTROLLER_INSTANCE}-certs-$(date +%F) --cert=/path/to/ssl.crt --key=/path/to/ssl.key

   Copy to Clipboard Toggle word wrap

3. Modify the automation controller custom resource to add route_tls_secret and the name of the new secret to the spec section.

   oc edit automationcontroller/${CONTROLLER_INSTANCE}

   Copy to Clipboard Toggle word wrap

   ...
   spec:
     route_tls_secret: automation-controller-certs-2023-04-06
   ...

   Copy to Clipboard Toggle word wrap

1. Wait a few minutes for the changes to be applied.

2. Verify that new SSL certificate and key have been installed:

   true | openssl s_client -showcerts -connect ${CONTROLLER_FQDN}:443

   Copy to Clipboard Toggle word wrap

Procedure

1. Copy the signed SSL certificate and key to a secure location.

2. Create a TLS secret within OpenShift:

   oc create secret tls ${AUTOMATION_HUB_INSTANCE}-certs-$(date +%F) --cert=/path/to/ssl.crt --key=/path/to/ssl.key

   Copy to Clipboard Toggle word wrap

3. Modify the automation hub custom resource to add route_tls_secret and the name of the new secret to the spec section.

   oc edit automationhub/${AUTOMATION_HUB_INSTANCE}

   Copy to Clipboard Toggle word wrap

   ...
   spec:
     route_tls_secret: automation-hub-certs-2023-04-06
   ...

   Copy to Clipboard Toggle word wrap

1. Wait a few minutes for the changes to be applied.

2. Verify that new SSL certificate and key have been installed:

   true | openssl s_client -showcerts -connect ${CONTROLLER_FQDN}:443

   Copy to Clipboard Toggle word wrap

Procedure

1. Add aap_service_regen_cert=true to the inventory file in the [all:vars] section:

   [all:vars]
   aap_service_regen_cert=true

   Copy to Clipboard Toggle word wrap
2. Run the installer.

Procedure

1. Copy the new SSL/TLS certificates and keys to a path relative to the Ansible Automation Platform installer.

2. Add the absolute paths of the SSL/TLS certificates and keys to the inventory file. Refer to Inventory file variables for guidance on setting these variables.

   • Event-Driven Ansible controller: automationedacontroller_ssl_cert, automationedacontroller_ssl_key, custom_ca_cert
   • Platform gateway: automationgateway_ssl_cert, automationgateway_ssl_key, custom_ca_cert
   • Automation hub: automationhub_ssl_cert, automationhub_ssl_key, custom_ca_cert

   • Automation controller: web_server_ssl_cert, web_server_ssl_key, custom_ca_cert

     Note

     The custom_ca_cert must be the root certificate authority that signed the intermediate certificate authority. This file is installed in /etc/pki/ca-trust/source/anchors.

3. Run the installation program.

Procedure

1. Backup the current SSL/TLS certificate:

   cp <CERT_PATH> <CERT_PATH>-$(date +%F)

   Copy to Clipboard Toggle word wrap

2. Backup the current key files:

   cp <KEY_PATH> <KEY_PATH>-$(date +%F)

   Copy to Clipboard Toggle word wrap
3. Copy the new SSL/TLS certificate to the certificate path.
4. Copy the new key to the key path.

5. Restore the SELinux context:

   restorecon -v <CERT_PATH> <KEY_PATH>

   Copy to Clipboard Toggle word wrap

6. Set appropriate permissions for the certificate and key files:

   chown <OWNER>:<GROUP> <CERT_PATH> <KEY_PATH>
   chmod 0600 <CERT_PATH> <KEY_PATH>

   Copy to Clipboard Toggle word wrap

7. Test the NGINX configuration:

   nginx -t

   Copy to Clipboard Toggle word wrap

8. Reload NGINX:

   systemctl reload nginx.service

   Copy to Clipboard Toggle word wrap

9. Verify that new SSL/TLS certificate and key have been installed:

   true | openssl s_client -showcerts -connect <COMPONENT_FQDN>:443

   Copy to Clipboard Toggle word wrap
   Expand

   Table 6.2. SSL/TLS certificate and key file paths per service

   Service	Certificate file path	Key file path	Owner:Group
   Automation controller	/etc/tower/tower.cert	/etc/tower/tower.key	root:awx
   Automation hub	/etc/pulp/certs/pulp_webserver.crt	/etc/pulp/certs/pulp_webserver.key	root:pulp
   Event-Driven Ansible controller	/etc/ansible-automation-platform/eda/server.cert	/etc/ansible-automation-platform/eda/server.key	root:eda
   Platform gateway	/etc/ansible-automation-platform/gateway/gateway.cert	/etc/ansible-automation-platform/gateway/gateway.key	root:gateway

   Show more