Chapter 1. Red Hat Certified, validated, and Ansible Galaxy content in automation hub

Procedure

1. Log in to your Ansible Automation Platform.
2. From the navigation panel, select Automation Content Remotes.
3. In the rh-certified remote repository, click Edit remote.
4. In the URL field, paste the Sync URL.
5. In the Token field, paste the token you acquired from console.redhat.com.

6. Click Save remote.

   You can now synchronize collections between your organization synclist on console.redhat.com and your private automation hub.

7. From the navigation panel, select Automation Content Repositories. Next to rh-certified click the More Actions icon ⋮ and select Sync repository.

8. On the modal that appears, you can toggle the following options:

   • Mirror: Select if you want your repository content to mirror the remote repository’s content.
   • Optimize: Select if you want to sync only when no changes are reported by the remote server.
9. Click Sync to complete the sync.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content Remotes.
3. In the Details tab in the Community remote, click Edit remote.
4. In the YAML requirements field, paste the contents of your requirements.yml file.

5. Click Save remote.

   You can now synchronize collections identified in your requirements.yml file from Ansible Galaxy to your private automation hub.

6. From the navigation panel, select Automation Content Repositories. Next to the community repository, click the More Actions icon ⋮ and select Sync repository to sync collections between Ansible Galaxy and Ansible automation hub.

7. On the modal that appears, you can toggle the following options:

   • Mirror: Select if you want your repository content to mirror the remote repository’s content.
   • Optimize: Select if you want to sync only when no changes are reported by the remote server.
8. Click Sync to complete the sync.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content Remotes.
3. In either the rh-certified or Community remote, click the More Actions icon ⋮ and select Edit remote.
4. Expand the Show advanced options drop-down menu.
5. Enter your proxy URL, proxy username, and proxy password in the appropriate fields.
6. Click Save remote.

Procedure

1. Create your requirements file.

   In YAML format, collection information in your requirements file should look like this:

   collections:
    name: namespace.collection_name
    version: 1.0.0

2. After you have created your requirements file listing information for each collection that you want to install, navigate to the directory where the file is located and run the following command:

Procedure

1. Log in to console.redhat.com.
2. Navigate to Automation Hub Collections.

3. Set the Sync toggle switch on each collection to exclude or include it on your synclist.

   Note

   You will only see the Sync toggle switch if you have administrator permissions.

4. To initiate the remote repository synchronization, navigate to your Ansible Automation Platform and select Automation Content Repositories.
5. In the row containing the repository you want to sync, click the More Actions icon ⋮ and select Sync repository to initiate the remote repository synchronization to your private automation hub.
6. Optional: If your remote repository is already configured, update the collections content that you made available to local users by manually synchronizing Red Hat Ansible Certified Content Collections to your private automation hub.

Procedure

1. Create a signing script that accepts only a filename.

   Note

   This script acts as the signing service and must generate an ascii-armored detached gpg signature for that file using the key specified through the PULP_SIGNING_KEY_FINGERPRINT environment variable.

   The script prints out a JSON structure with the following format.

   {"file": "filename", "signature": "filename.asc"}

   All the file names are relative paths inside the current working directory. The file name must remain the same for the detached signature.

   Example:

   The following script produces signatures for content:

   #!/usr/bin/env bash
   
   FILE_PATH=$1
   SIGNATURE_PATH="$1.asc"
   
   ADMIN_ID="$PULP_SIGNING_KEY_FINGERPRINT"
   PASSWORD="password"
   
   # Create a detached signature
   gpg --quiet --batch --pinentry-mode loopback --yes --passphrase \
      $PASSWORD --homedir ~/.gnupg/ --detach-sign --default-key $ADMIN_ID \
      --armor --output $SIGNATURE_PATH $FILE_PATH
   
   # Check the exit status
   STATUS=$?
   if [ $STATUS -eq 0 ]; then
      echo {\"file\": \"$FILE_PATH\", \"signature\": \"$SIGNATURE_PATH\"}
   else
      exit $STATUS
   fi

   After you deploy a private automation hub with signing enabled to your Ansible Automation Platform cluster, new UI additions are displayed in collections.

2. Review the Ansible Automation Platform installer inventory file for options that begin with automationhub_*.

   [all:vars]
   .
   .
   .
   automationhub_create_default_collection_signing_service = True
   automationhub_auto_sign_collections = True
   automationhub_require_content_approval = True
   automationhub_collection_signing_service_key = /abs/path/to/galaxy_signing_service.gpg
   automationhub_collection_signing_service_script = /abs/path/to/collection_signing.sh

   The two new keys (automationhub_auto_sign_collections and automationhub_require_content_approval) indicate that the collections must be signed and approved after they are uploaded to private automation hub.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content Collection Approvals. The Approval dashboard opens and displays a list of collections.
3. Click the thumbs up icon next to the collection you want to approve. On the modal that appears, check the box confirming that you want to approve the collection, and click Approve and sign collections.

Procedure

1. Log in to Ansible Automation Platform.

2. From the navigation panel, select Automation Content Signature Keys. The Signature Keys dashboard displays a list of multiple keys: collections and container images.

   • To verify collections, download the key prefixed with collections-.
   • To verify container images, download the key prefixed with container-.

3. Choose one of the following methods to download your public key:

   • Click the Download Key icon to download the public key.
   • Click the Copy to clipboard next to the public key you want to copy.

Procedure

1. To import a public key into a non-default keyring for use with ansible-galaxy, run the following command.

   gpg --import --no-default-keyring --keyring ~/.ansible/pubring.kbx my-public-key.asc

   Note

   In addition to any signatures provided by automation hub, signature sources can also be provided in the requirements file and on the command line. Signature sources should be URIs.

2. To verify the collection name provided on the CLI with an additional signature, run the following command:

   ansible-galaxy collection install namespace.collection
   --signature https://examplehost.com/detached_signature.asc
   --signature file:///path/to/local/detached_signature.asc --keyring ~/.ansible/pubring.kbx

   You can use this option multiple times to provide multiple signatures.

3. Confirm that the collections in a requirements file list any additional signature sources following the collection’s signatures key, as in the following example.

   # requirements.yml
   collections:
     - name: ns.coll
       version: 1.0.0
       signatures:
         - https://examplehost.com/detached_signature.asc
         - file:///path/to/local/detached_signature.asc
   
   ansible-galaxy collection verify -r requirements.yml --keyring ~/.ansible/pubring.kbx

   When you install a collection from automation hub, the signatures provided by the server are saved along with the installed collections to verify the collection’s authenticity.

4. (Optional) If you need to verify the internal consistency of your collection again without querying the Ansible Galaxy server, run the same command you used previously using the --offline option.