Planning your installation

Platform gateway is the service that handles authentication and authorization for the Ansible Automation Platform. It provides a single entry into the Ansible Automation Platform and serves the platform user interface so you can authenticate and access all of the Ansible Automation Platform services from a single location.

The platform gateway includes an activity stream that captures changes to gateway resources, such as the creation or modification of organizations, users, and service clusters, among others. For each change, the activity stream collects information about the time of the change, the user that initiated the change, the action performed, and the actual changes made to the object, when possible. The information gathered varies depending on the type of change.

You can access the details captured by the activity stream from the API:

/api/gateway/v1/activitystream/

For more information about the services available in the Ansible Automation Platform, refer to Key functionality and concepts in Getting started with Ansible Automation Platform.

Automation controller is an enterprise framework enabling users to define, operate, scale, and delegate Ansible automation across their enterprise.

Ansible automation hub is a repository for certified content of Ansible Content Collections. It is the centralized repository for Red Hat and its partners to publish content, and for customers to discover certified, supported Ansible Content Collections. Red Hat Ansible Certified Content provides users with content that has been tested and is supported by Red Hat.

Private automation hub provides disconnected and on-premise solutions for synchronizing automation content. You can synchronize collections and execution environment images from Red Hat cloud automation hub or other container registries, allowing you to store and serve your own custom automation. Private automation hub can also integrate into your enterprise directory and CI/CD pipelines.

A high availability (HA) configuration increases reliability and scalablility for automation hub deployments.

HA deployments of automation hub have multiple nodes that concurrently run the same service with a load balancer distributing workload (an "active-active" configuration). This configuration eliminates single points of failure to minimize service downtime and enable you to easily add or remove nodes to meet workload demands.

The Event-Driven Ansible controller is the interface for event-driven automation and introduces automated resolution of IT requests. Event-Driven Ansible controller helps you connect to sources of events and act on those events by using rulebooks. This technology improves IT speed and agility, and enables consistency and resilience.

With Event-Driven Ansible, you can:

Automation mesh is an overlay network intended to ease the distribution of work across a large and dispersed collection of workers through nodes that establish peer-to-peer connections with each other using existing networks.

Automation mesh provides:

Automation execution environments are container images on which all automation in Red Hat Ansible Automation Platform is run. They provide a solution that includes the Ansible execution engine and hundreds of modules that help users automate all aspects of IT environments and processes. Automation execution environments automate commonly used operating systems, infrastructure platforms, network devices, and clouds.

Ansible Galaxy is a hub for finding, reusing, and sharing Ansible content. Community-provided Galaxy content, in the form of prepackaged roles, can help start automation projects. Roles for provisioning infrastructure, deploying applications, and completing other tasks can be dropped into Ansible Playbooks and be applied immediately to customer environments.

Automation content navigator is a textual user interface (TUI) that becomes the primary command line interface into the automation platform. It covers use cases from content building, running automation locally in an execution environment, running automation in Ansible Automation Platform, and providing the foundation for future integrated development environments (IDEs).

PostgreSQL is the required database for Ansible Automation Platform, storing all automation data including job templates, inventory, credentials, and execution history. Understanding PostgreSQL configuration and management helps ensure optimal performance and data integrity for your automation environment.

Redis is an open source, in-memory, NoSQL key/value store used primarily as an application cache and lightweight message broker, which stores event queues, session data, and tokens to deliver improved performance, reliability, and data security.

platform gateway and Event-Driven Ansible use Centralized Redis. Automation controller and automation hub have their own instances of Redis.

This cache and queue system stores data in memory, rather than on a disk or solid-state drive (SSD), which helps deliver speed, reliability, and performance. Secure communication with the cache and queue system through Transport Layer Security (TLS) encryption and authentication protects your data.

Redis provides fast, in-memory caching and session management for Ansible Automation Platform components, improving performance and enabling scaling.

Ansible Automation Platform offers a centralized Redis instance in both standalone and clustered topologies.

With clustered Redis, data is automatically partitioned over multiple nodes to provide performance stability and nodes are assigned as replicas to provide reliability. Clustered Redis, shared between the platform gateway and Event-Driven Ansible, is provided by default when installing Ansible Automation Platform in containerized and operator-based deployments.

A cluster has three primary nodes and each primary node has a replica node.

If a primary instance becomes unavailable due to failures, the other primary nodes will initiate a failover state to promote a replica node to a primary node.

The benefits of deploying clustered Redis over standalone Redis include the following:

For more information about scalability with Redis, see Scale with Redis Cluster in the Redis product documentation.

For more information about deploying Ansible Automation Platform with clustered Redis, see the RPM installation, Containerized installation, and Installing on OpenShift Container Platform guides.

Disclaimer: Links contained in this information to external website(s) are provided for convenience only. Red Hat has not reviewed the links and is not responsible for the content or its availability. The inclusion of any link to an external website does not imply endorsement by Red Hat of the website or their entities, products or services. You agree that Red Hat is not responsible or liable for any loss or expenses that may result due to your use of (or reliance on) the external site or content.

Standalone Redis offers a straightforward deployment option for Ansible Automation Platform environments where high availability is not critical.

Standalone Redis consists of a simple architecture that is easy to deploy and configure.

Ansible Automation Platform offers many installation and deployment options based on your infrastructure and organizational needs. Each installation type reference includes supported infrastructure types and links to tested topologies.

Review system requirements to ensure your environment supports RPM installation of Ansible Automation Platform. RPM-based installations of Ansible Automation Platform were deprecated in 2.5 and will be removed in version 2.7.

For system requirements for the RPM installation method of Ansible Automation Platform, see the System requirements section of RPM installation.

For system requirements for performing a containerized installation of Ansible Automation Platform, see the System requirements section of Containerized installation.

For system requirements for installing Ansible Automation Platform on OpenShift Container Platform, see the Tested system configurations section of Tested deployment models.

The following architectural diagram is an example of a fully deployed Ansible Automation Platform with all possible components.

Ansible Automation Platform Client initiated network ports and protocols

Ansible Automation Platform Internally initiated network ports and protocols

The following table indicates the destination port and the direction of network traffic:

Network ports and protocols

The following tables provide information about configuring firewalls for Red Hat Ansible Automation Platform components.

Red Hat Insights for Red Hat Ansible Automation Platform

Automation Hub

Execution Environments (EE)

Choose the Red Hat Ansible Automation Platform installer if your Red Hat Enterprise Linux environment is connected to the internet. Installing with internet access retrieves the latest required repositories, packages, and dependencies. Choose one of the following ways to set up your Ansible Automation Platform installer.

Tarball installation

$ scp -i private_key.pem aap-bundled-installer.tar.gz user@server_ip:

$ curl -0 <download_url>

$ tar xvzf aap-bundled-installer.tar.gz

RPM installation

When you use the RPM installer, the files are placed under the /opt/ansible-automation-platform/installer directory.

The Red Hat Ansible Automation Platform Bundle installer enables you to install Ansible Automation Platform without internet access.

Follow these configuration guidelines to properly set up databases, automation hub, automation controller, Event-Driven Ansible controller, and platform gateway hosts for reliable Ansible Automation Platform installations.

Databases

Automation hub

Private automation hub

Automation controller

Event-Driven Ansible controller

Platform gateway

Clustered installations

You can deprovision nodes and instance groups using the Ansible Automation Platform installer. Running the installer will remove all configuration files and logs attached to the nodes in the group.

To deprovision nodes, append node_state=deprovision to the node or group within the inventory file.

For example:

To remove a single node from a deployment:

[automationcontroller]
host1.example.com
host2.example.com
host4.example.com   node_state=deprovision

or

To remove an entire instance group from a deployment:

[instance_group_restrictedzone]
host4.example.com
host5.example.com

[instance_group_restrictedzone:vars]
node_state=deprovision

Inventory variables control the installation program’s behavior and configure Ansible Automation Platform components during deployment. Understand how to apply variables globally or to specific hosts to customize your installation.

The second part of the example inventory file, following [all:vars], is a list of variables used by the installation program. Using all means the variables apply to all hosts.

To apply variables to a particular host, use [hostname:vars]. For example, [automationhub:vars].

When declaring variables in Ansible inventory files by using ini format, be aware of the following rules regarding variable types and values.

The values of string variables are declared in quotes. For example:

pg_database='awx'
pg_username='awx'
pg_password='<password>'

When declared in a :vars section, ini values are interpreted as strings. For example, var=FALSE creates a string equal to FALSE. Unlike host lines, :vars sections accept only a single entry per line, so everything after the = must be the value for the entry. Host lines accept multiple key=value parameters per line. Therefore they need a way to indicate that a space is part of a value rather than a separator. Values that contain whitespace can be quoted (single or double). For more information, see Python shlex parsing rules.

If a variable value set in an ini inventory must be a certain type (for example, a string or a boolean value), always specify the type with a filter in your task. Do not rely on types set in ini inventories when consuming variables.

If a parameter value in the Ansible inventory file contains special characters, such as #, { or }, you must double-escape the value (that is enclose the value in both single and double quotation marks).

For example, to use mypasswordwith#hashsigns as a value for the variable pg_password, declare it as pg_password='"mypasswordwith#hashsigns"' in the Ansible host inventory file.

Disclaimer: Links contained in this information to external website(s) are provided for convenience only. Red Hat has not reviewed the links and is not responsible for the content or its availability. The inclusion of any link to an external website does not imply endorsement by Red Hat of the website or their entities, products or services. You agree that Red Hat is not responsible or liable for any loss or expenses that may result due to your use of (or reliance on) the external site or content.

You can encrypt sensitive or secret variables with Ansible Vault. However, encrypting the variable names and the variable values makes it hard to find the source of the values. To circumvent this, you can encrypt the variables individually by using ansible-vault encrypt_string, or encrypt a file containing the variables.

You can further configure your Red Hat Ansible Automation Platform installation by including additional variables in the inventory file. These configurations add optional features for managing your Red Hat Ansible Automation Platform. Add these variables by editing the inventory file using a text editor.

A table of predefined values for inventory file variables can be found in Inventory file variables in the Red Hat Ansible Automation Platform Installation Guide.