Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 2. Setting up automation mesh

Configure the Ansible Automation Platform installer to set up automation mesh for your Ansible environment. Perform additional tasks to customize your installation, such as importing a Certificate Authority (CA) certificate.

2.1. automation mesh Installation
Copy link

For a VM-based install of Ansible Automation Platform you use the installation program to set up automation mesh or to upgrade to automation mesh. To provide Ansible Automation Platform with details about the nodes, groups, and peer relationships in your mesh network, you define them in an the inventory file in the installer bundle. For managed cloud, OpenShift, or operator environments, see Automation mesh for managed cloud or operator environments.

You can use the Red Hat Ansible Automation Platform installer inventory file to specify your installation scenario.

Procedure

  1. Navigate to the installer:

    1. [RPM installed package] 

      $ cd /opt/ansible-automation-platform/installer/

    2. [bundled installer] 

      $ cd ansible-automation-platform-setup-bundle-<latest-version>

    3. [online installer] 

      $ cd ansible-automation-platform-setup-<latest-version>
  2. Open the inventory file with a text editor.
  3. Edit inventory file parameters to specify your installation scenario. For further information, see Editing the Red Hat Ansible Automation Platform installer inventory file

After you update the inventory file with required parameters, run the installer setup script.

Procedure

  • Run the setup.sh script 

    $ sudo ./setup.sh
Note

If you are running the setup as a non-root user with sudo privileges, you can use the following command: 

$ ANSIBLE_BECOME_METHOD='sudo'
ANSIBLE_BECOME=True ./setup.sh

Installation of Red Hat Ansible Automation Platform will begin.

Additional resources

See Understanding privilege escalation for additional setup.sh script examples.

If you want to add additional nodes to your automation mesh after the initial setup, edit the inventory file to add the new node, then rerun the setup.sh script.

A Certificate Authority (CA) verifies and signs individual node certificates in an automation mesh environment. You can provide your own CA by specifying the path to the certificate and the private RSA key file in the inventory file of your Red Hat Ansible Automation Platform installer.

Note

The Ansible Automation Platform installation program generates a CA if you do not provide one.

Procedure

  1. Open the inventory file for editing.
  2. Add the mesh_ca_keyfile variable and specify the full path to the private RSA key (.key).
  3. Add the mesh_ca_certfile variable and specify the full path to the CA certificate file (.crt).
  4. Save the changes to the inventory file.

Example

[all:vars]
mesh_ca_keyfile=/tmp/<mesh_CA>.key
mesh_ca_certfile=/tmp/<mesh_CA>.crt

With the CA files added to the inventory file, run the installation program to apply the CA. This process copies the CA to the to /etc/receptor/tls/ca/ directory on each control and execution node on your mesh network.

Learn how to replace the default automation mesh installer-provided certificates with custom,organization-specific certificates.

Note

In the following procedure, replace <FQDN/IP Address> and <IP Address> with the Fully Qualified Domain Name (FQDN) or IP address of the node.

Procedure

  1. Stop the receptor service on all automation controller and execution nodes.

    # systemctl stop receptor

  2. Generate a new Certificate Authority (CA) for your mesh network.

  3. Replace "common ca" in the command below with the required common name. 

    # receptor --cert-init commonname="common ca" bits=4096 outcert=/etc/receptor/tls/ca/mesh-CA.crt outkey=/etc/receptor/tls/ca/mesh-CA.key

  4. Generate a self-signed certificate request for each Controller and Execution Node. 

    # receptor --cert-makereq commonname=<FQDN/IP Address> bits=4096 nodeid=<FQDN/IP Address> outreq=/etc/receptor/tls/<FQDN/IP Address>.csr outkey=/etc/receptor/tls/<FQDN/IP Address>.key ipaddress=<IP Address> ipaddress=<IP Address>

  5. Sign the newly created certificates with your CA. Make sure you adjust the notafter= date to meet your organizational requirements. The example shown uses a date far in the future. 

    # receptor --cert-signreq verify=yes cacert=/etc/receptor/tls/ca/mesh-CA.crt cakey=/etc/receptor/tls/ca/mesh-CA.key req=/etc/receptor/tls/<FQDN/IP Address>.csr outcert=/etc/receptor/tls/<FQDN/IP Address>.crt notafter="2034-07-29T20:48:02Z"
  6. Transfer the newly created and signed certificates to their nodes in the /etc/receptor/tls/ directory.
  7. The mesh-CA.crt file must be placed in /etc/receptor/tls/ca.

  8. Ensure that the permissions and ownership of the certificate files are set correctly.

    • All files should be owned by receptor

    • All certificate files should have 0640 permissions.

      # chown -R receptor: /etc/receptor; chmod 0640 /etc/receptor/tls/<FQDN/IP Address>.crt

  9. Start the receptor service on all Controller and Execution nodes.

    # systemctl start receptor

  10. Verify the node status in the Ansible Automation Platform UI:
  11. In the navigation panel, select Automation Execution Infrastructure Instance Groups
  12. Select the default instance group, then go to the Instances tab.
  13. Ensure that the status of all nodes is marked as Ready.

  14. If any node is marked as Unavailable:

    1. Select the Unavailable node.
    2. Click Run Health Check.
    3. Refresh the page, and the node should now display as Ready.

2.4.2. Correcting multiple signed certificates
Copy link

If /etc/receptor/tls/ca/mesh-CA.crt (for RPM-based installs) or $HOME/aap/receptor/etc/mesh-CA.crt (for containerized installs) contains more than 10 certificates, an error occurs.

Take the following steps on all automation controller and execution nodes within the Ansible Automation Platform environment.

For an RPM-based install

Procedure

  1. Make a backup of the mesh-CA.crt file

    cp -p /etc/receptor/tls/ca/mesh-CA.crt /etc/receptor/tls/ca/mesh-CA.crt-$(date +%F)

  2. Delete everything past the first certificate within the mesh-CA.crt file, that is, keep only the first certificate that is present at the top of the file.

  3. Restart receptor

    systemctl restart receptor

For a Containerized install

  1. Make a backup of the mesh-CA.crt file

    cp -p $HOME/aap/receptor/etc/mesh-CA.crt $HOME/aap/receptor/etc/mesh-CA.crt-$(date +%F)

  2. Delete everything past the first certificate within the mesh-CA.crt file, that is, keep only the first certificate that is present at the top of the file.

  3. Restart receptor

    systemctl --user restart receptor

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top