Chapter 19. Managing capacity with Instances
Scaling your automation mesh is available on OpenShift deployments of Red Hat Ansible Automation Platform and is possible through adding or removing nodes from your cluster dynamically, using the Instances resource of the UI, without running the installation script.
Instances serve as nodes in your mesh topology. Automation mesh enables you to extend the footprint of your automation. The location where you launch a job can be different from the location where the ansible-playbook runs.
To manage instances from the UI, you must have System Administrator or System Auditor permissions.
In general, the more processor cores (CPU) and memory (RAM) a node has, the more jobs that can be scheduled to run on that node at once.
For more information, see Automation controller capacity determination and job impact.
19.1. Prerequisites
The automation mesh is dependent on hop and execution nodes running on Red Hat Enterprise Linux (RHEL). Your Red Hat Ansible Automation Platform subscription grants you ten Red Hat Enterprise Linux licenses that can be used for running components of Ansible Automation Platform.
For more information about Red Hat Enterprise Linux subscriptions, see Registering the system and managing subscriptions in the Red Hat Enterprise Linux documentation.
The following steps prepare the RHEL instances for deployment of the automation mesh.
- You require a Red Hat Enterprise Linux operating system. Each node in the mesh requires a static IP address, or a resolvable DNS hostname that Ansible Automation Platform can access.
- Ensure that you have the minimum requirements for the RHEL virtual machine before proceeding. For more information, see the System requirements.
Deploy the RHEL instances within the remote networks where communication is required. For information about creating virtual machines, see Creating Virtual Machines in the Red Hat Enterprise Linux documentation. Remember to scale the capacity of your virtual machines sufficiently so that your proposed tasks can run on them.
- RHEL ISOs can be obtained from access.redhat.com.
- RHEL cloud images can be built using Image Builder from console.redhat.com.
19.2. Pulling the secret
If you are using the default execution environment (provided with automation controller) to run on remote execution nodes, you must add a pull secret in the automation controller that contains the credential for pulling the execution environment image.
To do this, create a pull secret on the automation controller namespace and configure the ee_pull_credentials_secret
parameter in the Operator as follows:
Procedure
Create a secret:
oc create secret generic ee-pull-secret \ --from-literal=username=<username> \ --from-literal=password=<password> \ --from-literal=url=registry.redhat.io oc edit automationcontrollers <instance name>
Add
ee_pull_credentials_secret ee-pull-secret
to the specification:spec.ee_pull_credentials_secret=ee-pull-secret
To manage instances from the automation controller UI, you must have System administrator permissions.
19.3. Setting up Virtual Machines for use in an automation mesh
Procedure
SSH into each of the RHEL instances and perform the following steps. Depending on your network access and controls, SSH proxies or other access models might be required.
Use the following command:
ssh [username]@[host_ip_address]
For example, for an Ansible Automation Platform instance running on Amazon Web Services.
ssh ec2-user@10.0.0.6
- Create or copy an SSH key that can be used to connect from the hop node to the execution node in later steps. This can be a temporary key used just for the automation mesh configuration, or a long-lived key. The SSH user and key are used in later steps.
Enable your RHEL subscription with
baseos
andappstream
repositories. Ansible Automation Platform RPM repositories are only available through subscription-manager, not the Red Hat Update Infrastructure (RHUI). If you attempt to use any other Linux footprint, including RHEL with RHUI, this causes errors.sudo subscription-manager register --auto-attach
If Simple Content Access is enabled for your account, use:
sudo subscription-manager register
For more information about Simple Content Access, see Getting started with simple content access.
Enable Ansible Automation Platform subscriptions and the proper Red Hat Ansible Automation Platform channel:
For RHEL 8
# subscription-manager repos --enable ansible-automation-platform-2.5-for-rhel-8-x86_64-rpms
For RHEL 9
# subscription-manager repos --enable ansible-automation-platform-2.5-for-rhel-9-x86_64-rpms
For ARM
# subscription-manager repos --enable ansible-automation-platform-2.5-for-rhel-aarch64-rpms
Ensure the packages are up to date:
sudo dnf upgrade -y
Install the ansible-core packages on the machine where the downloaded bundle is to run:
sudo dnf install -y ansible-core
NoteAnsible core is required on the machine that runs the automation mesh configuration bundle playbooks. This document assumes that happens on the execution node. However, this step can be omitted if you run the playbook from a different machine. You cannot run directly from the control node, this is not currently supported, but future support expects that the control node has direct connectivity to the execution node.
19.4. Managing instances
To expand job capacity, create a standalone execution node that can be added to run alongside a deployment of automation controller. These execution nodes are not part of the automation controller Kubernetes cluster.
The control nodes run in the cluster connect and submit work to the execution nodes through Receptor.
These execution nodes are registered in automation controller as type execution
instances, meaning they are only used to run jobs, not dispatch work or handle web requests as control nodes do.
Hop nodes can be added to sit between the control plane of automation controller and standalone execution nodes. These hop nodes are not part of the Kubernetes cluster and are registered in automation controller as an instance of type hop
, meaning they only handle inbound and outbound traffic for otherwise unreachable nodes in different or more strict networks.
The following procedure demonstrates how to set the node type for the hosts.
Procedure
-
From the navigation panel, select
. On the Instances list page, click . The Add Instance window opens.
An instance requires the following attributes:
Host name: (required) Enter a fully qualified domain name (public DNS) or IP address for your instance. This field is equivalent to
hostname
for installer-based deployments.NoteIf the instance uses private DNS that cannot be resolved from the control cluster, DNS lookup routing fails, and the generated SSL certificates is invalid. Use the IP address instead.
- Optional: Description: Enter a description for the instance.
- Instance state: This field is auto-populated, indicating that it is being installed, and cannot be modified.
-
Listener port: This port is used for the receptor to listen on for incoming connections. You can set the port to one that is appropriate for your configuration. This field is equivalent to
listener_port
in the API. The default value is 27199, though you can set your own port value. Instance type: Only
execution
andhop
nodes can be created. Operator based deployments do not support Control or Hybrid nodes.Options:
- Enable instance: Check this box to make it available for jobs to run on an execution node.
- Check the Managed by policy box to enable policy to dictate how the instance is assigned.
Peers from control nodes:
If you are configuring a hop node:
- If the hop node needs to have requests pushed directly from automation controller, then check the Peers from Control box.
- If the hop node is peered to another hop node, then make sure Peers from Control is not checked.
If you are configuring an execution node:
- If the execution node needs to have requests pushed directly from automation controller, then check the Peers from Control box.
- If the execution node is peered to a hop node, then make sure that Peers from Control is not checked.
- Click .
To view a graphical representation of your updated topology, see Topology view.
NoteExecute the following steps from any computer that has SSH access to the newly created instance.
Click the icon next to Download Bundle to download the tar file that includes this new instance and the files necessary to install the created node into the automation mesh.
The install bundle contains TLS certificates and keys, a certificate authority, and a proper Receptor configuration file.
receptor-ca.crt work-public-key.pem receptor.key install_receptor.yml inventory.yml group_vars/all.yml requirements.yml
-
Extract the downloaded
tar.gz
Install Bundle from the location where you downloaded it. To ensure that these files are in the correct location on the remote machine, the install bundle includes theinstall_receptor.yml
playbook. Before running the
ansible-playbook
command, edit the following fields in theinventory.yml
file:all: hosts: remote-execution: ansible_host: localhost # change to the mesh node host name ansible_user: <username> # user provided ansible_ssh_private_key_file: ~/.ssh/<id_rsa>
-
Ensure
ansible_host
is set to the IP address or DNS of the node. -
Set
ansible_user
to the username running the installation. -
Set
ansible_ssh_private_key_file
to contain the filename of the private key used to connect to the instance. -
The content of the
inventory.yml
file serves as a template and contains variables for roles that are applied during the installation and configuration of a receptor node in a mesh topology. You can modify some of the other fields, or replace the file in its entirety for advanced scenarios. For more information, see Role Variables.
-
Ensure
For a node that uses a private DNS, add the following line to
inventory.yml
:ansible_ssh_common_args: <your ssh ProxyCommand setting>
This instructs the
install-receptor.yml
playbook to use the proxy command to connect through the local DNS node to the private node.- When the attributes are configured, click Details page of the created instance opens. . The
- Save the file to continue.
The system that is going to run the install bundle to setup the remote node and run
ansible-playbook
requires theansible.receptor
collection to be installed:ansible-galaxy collection install ansible.receptor
or
ansible-galaxy install -r requirements.yml
-
Installing the receptor collection dependency from the
requirements.yml
file consistently retrieves the receptor version specified there. Additionally, it retrieves any other collection dependencies that might be needed in the future. - Install the receptor collection on all nodes where your playbook will run, otherwise an error occurs.
-
Installing the receptor collection dependency from the
If
receptor_listener_port
is defined, the machine also requires an available open port on which to establish inbound TCP connections, for example, 27199. Run the following command to open port 27199 for receptor communication (Make sure you have port 27199 open in your firewall):sudo firewall-cmd --permanent --zone=public --add-port=27199/tcp
NoteIt might be the case that some servers do not listen on receptor port (the default is 27199)
Suppose you have a Control plane with nodes A, B, C, D
The RPM installer creates a strongly connected peering between the control plane nodes with a least privileged approach and opens the tcp listener only on those nodes where it is required. All the receptor connections are bidirectional, so once the connection is created, the receptor can communicate in both directions.
The following is an example peering set up for three controller nodes:
Controller node A -→ Controller node B
Controller node A -→ Controller node C
Controller node B -→ Controller node C
You can force the listener by setting
receptor_listener=True
However, a connection Controller B -→ A is likely to be rejected as that connection already exists.
This means that nothing connects to Controller A as Controller A is creating the connections to the other nodes, and the following command does not return anything on Controller A:
[root@controller1 ~]# ss -ntlp | grep 27199 [root@controller1 ~]#
Run the following playbook on the machine where you want to update your automation mesh:
ansible-playbook -i inventory.yml install_receptor.yml
OpenSSL is required for this playbook. You can install it by running the following command:
openssl -v
If it returns then a version OpenSSL is installed. Otherwise you need to install OpenSSL with:
sudo dnf install -y openssl
After this playbook runs, your automation mesh is configured.
To remove an instance from the mesh, see Removing instances.
19.5. Removing Instances
From the Instances page, you can add, remove or run health checks on your nodes.
You must follow the procedures for installing RHEL packages for any additional nodes you create. If you peer this additional node to an existing hop node, you must also install the Install Bundle on each node.
Use the check boxes next to an instance to select it to remove it, or run a health check against it.
- If a node is removed using the UI, then the node is "removed" and does not show a status. If you delete the VM of the node before it is removed in the UI, it will show an error.
- You only need to reinstall the Install Bundle if the topology changes the communication pattern, that is, hop nodes change or you add nodes.
When a button is disabled, you do not have permission for that particular action. Contact your Administrator to grant you the required level of access.
If you are able to remove an instance, you receive a prompt for confirmation.
You can still remove an instance even if it is active and jobs are running on it. Automation controller waits for jobs running on this node to complete before removing it.