Chapter 5. Configuring Red Hat Ansible Automation Platform components on Red Hat Ansible Automation Platform Operator

Procedure

1. Create a postgres_configuration_secret YAML file, following the template below:

   apiVersion: v1
   kind: Secret
   metadata:
     name: external-postgres-configuration
     namespace: <target_namespace> 

   1

   
   stringData:
     host: "<external_ip_or_url_resolvable_by_the_cluster>" 

   2

   
     port: "<external_port>" 

   3

   
     database: "<desired_database_name>"
     username: "<username_to_connect_as>"
     password: "<password_to_connect_with>" 

   4

   
     type: "unmanaged"
   type: Opaque

   Copy to Clipboard Toggle word wrap
   1. Namespace to create the secret in. This should be the same namespace you want to deploy to.
   2. The resolvable hostname for your database node.
   3. External port defaults to 5432.
   4. Value for variable password should not contain single or double quotes (', ") or backslashes (\) to avoid any issues during deployment, backup or restoration.

2. Apply external-postgres-configuration-secret.yml to your cluster using the oc create command.

   $ oc create -f external-postgres-configuration-secret.yml

   Copy to Clipboard Toggle word wrap
   Note

   The following example is for a platform gateway deployment. To configure an external database for all components, use the aap-configuring-external-db-all-default-components.yml example in the 14.1. Custom resources section.

3. When creating your AnsibleAutomationPlatform custom resource object, specify the secret on your spec, following the example below:

   apiVersion: aap.ansible.com/v1alpha1
   kind: AnsibleAutomationPlatform
   metadata:
     name: example-aap
     Namespace: aap
   spec:
     database:
        database_secret: automation-platform-postgres-configuration

   Copy to Clipboard Toggle word wrap

Procedure

1. Edit the /var/lib/pgsql/data/postgres.conf file on the database server:

   # vi /var/lib/pgsql/data/postgres.conf

   Copy to Clipboard Toggle word wrap

2. Find and comment out the line:

   #datestyle = 'Redwood, SHOW_TIME'

   Copy to Clipboard Toggle word wrap

3. Add the following setting immediately below the newly-commented line:

   datestyle = 'iso, mdy'

   Copy to Clipboard Toggle word wrap
4. Save and close the postgres.conf file.

5. Reload the database configuration:

   # systemctl reload postgresql

   Copy to Clipboard Toggle word wrap
   Note

   Running this command does not disrupt database operations.

Procedure

1. Log in to Red Hat OpenShift Container Platform.
2. Go to Operators Installed Operators.
3. Select your Ansible Automation Platform Operator deployment.
4. Select All Instances and go to your AnsibleAutomationPlatform instance.
5. Click the ⋮ icon and then select Edit AnsibleAutomationPlatform.

6. In the YAML view paste the following YAML code under the spec: section:

   spec:
     extra_settings:
       - setting: REDIRECT_IS_HTTPS
         value: '"True"'

   Copy to Clipboard Toggle word wrap
7. Click Save.

Procedure

1. Log in to Red Hat OpenShift Container Platform.
2. Navigate to Operators Installed Operators.
3. Select your Ansible Automation Platform Operator deployment.
4. Select the Ansible Automation Platform tab.

5. For new instances, click Create AnsibleAutomationPlatform.

   1. For existing instances, you can edit the YAML view by clicking the ⋮ icon and then Edit AnsibleAutomationPlatform.
6. Click Advanced Configuration.
7. Under Ingres annotations, enter any annotations to add to the ingress.
8. Under Ingress TLS secret, click the drop-down list and select a secret from the list.

9. Under YAML view paste in the following code:

   spec:
     extra_settings:
       - setting: CSRF_TRUSTED_ORIGINS
         value:
           - https://my-aap-domain.com

   Copy to Clipboard Toggle word wrap
10. After you have configured your platform gateway, click Create at the bottom of the form view (Or Save in the case of editing existing instances).

Procedure

1. Log in to Red Hat OpenShift Container Platform.
2. Go to Operators Installed Operators.
3. Select your Ansible Automation Platform Operator deployment.
4. Select All Instances and go to your Ansible Automation Platform instance.
5. Click the ⋮ icon and then select Edit Ansible Automation Platform.
6. In the YAML view, locate the spec: section

7. Add the database section and the required settings under spec:. The following example configures SSL ciphers and the maximum connections:

   spec:
     database:
       postgres_extra_settings:
         - name: max_connections
           value: '1000'

   Copy to Clipboard Toggle word wrap
8. Click Save.

Procedure

1. Create a postgres_configuration_secret YAML file, following the template below:

   apiVersion: v1
   kind: Secret
   metadata:
     name: external-postgres-configuration
     namespace: <target_namespace> 

   1

   
   stringData:
     host: "<external_ip_or_url_resolvable_by_the_cluster>" 

   2

   
     port: "<external_port>" 

   3

   
     database: "<desired_database_name>"
     username: "<username_to_connect_as>"
     password: "<password_to_connect_with>" 

   4

   
     sslmode: "prefer" 

   5

   
     type: "unmanaged"
   type: Opaque

   Copy to Clipboard Toggle word wrap
   1. Namespace to create the secret in. This should be the same namespace you want to deploy to.
   2. The resolvable hostname for your database node.
   3. External port defaults to 5432.
   4. Value for variable password should not contain single or double quotes (', ") or backslashes (\) to avoid any issues during deployment, backup or restoration.
   5. The variable sslmode is valid for external databases only. The allowed values are: prefer, disable, allow, require, verify-ca, and verify-full.

2. Apply external-postgres-configuration-secret.yml to your cluster using the oc create command.

   $ oc create -f external-postgres-configuration-secret.yml

   Copy to Clipboard Toggle word wrap

3. When creating your AutomationController custom resource object, specify the secret on your spec, following the example below:

   apiVersion: automationcontroller.ansible.com/v1beta1
   kind: AutomationController
   metadata:
     name: controller-dev
   spec:
     postgres_configuration_secret: external-postgres-configuration

   Copy to Clipboard Toggle word wrap

Procedure

1. List the existing PVCs in your deployment namespace:

   oc get pvc -n <namespace>

   Copy to Clipboard Toggle word wrap
2. Identify the PVC associated with your previous deployment by comparing the old deployment name and the PVC name.

3. Delete the old PVC:

   oc delete pvc -n <namespace> <pvc-name>

   Copy to Clipboard Toggle word wrap

Procedure

1. Log into Red Hat OpenShift Container Platform.
2. Navigate to Networking Routes.
3. Under Location, click on the URL for your automation hub instance.

Procedure

1. Create a postgres_configuration_secret YAML file, following the template below:

   apiVersion: v1
   kind: Secret
   metadata:
     name: external-postgres-configuration
     namespace: <target_namespace> 

   1

   
   stringData:
     host: "<external_ip_or_url_resolvable_by_the_cluster>" 

   2

   
     port: "<external_port>" 

   3

   
     database: "<desired_database_name>"
     username: "<username_to_connect_as>"
     password: "<password_to_connect_with>" 

   4

   
     sslmode: "prefer" 

   5

   
     type: "unmanaged"
   type: Opaque

   Copy to Clipboard Toggle word wrap
   1. Namespace to create the secret in. This should be the same namespace you want to deploy to.
   2. The resolvable hostname for your database node.
   3. External port defaults to 5432.
   4. Value for variable password should not contain single or double quotes (', ") or backslashes (\) to avoid any issues during deployment, backup or restoration.
   5. The variable sslmode is valid for external databases only. The allowed values are: prefer, disable, allow, require, verify-ca, and verify-full.

2. Apply external-postgres-configuration-secret.yml to your cluster using the oc create command.

   $ oc create -f external-postgres-configuration-secret.yml

   Copy to Clipboard Toggle word wrap

3. When creating your AutomationHub custom resource object, specify the secret on your spec, following the example below:

   apiVersion: automationhub.ansible.com/v1beta1
   kind: AutomationHub
   metadata:
     name: hub-dev
   spec:
     postgres_configuration_secret: external-postgres-configuration

   Copy to Clipboard Toggle word wrap

Procedure

1. List the existing PVCs in your deployment namespace:

   oc get pvc -n <namespace>

   Copy to Clipboard Toggle word wrap
2. Identify the PVC associated with your previous deployment by comparing the old deployment name and the PVC name.

3. Delete the old PVC:

   oc delete pvc -n <namespace> <pvc-name>

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to Red Hat OpenShift Container Platform.
2. Navigate to Home Search.
3. Select the Resources drop-down list and type "Image".
4. Select Image (config,openshift.io/v1).
5. Click Cluster under the Name heading.
6. Select the YAML tab.

7. Paste in the following under spec value:

   spec:
     registrySources:
       allowedRegistries:
       - quay.io
       - registry.redhat.io
       - image-registry.openshift-image-registry.svc:5000
       - <OCP route for your automation hub>

   Copy to Clipboard Toggle word wrap
8. Click Save.

Procedure

1. Create a ConfigMap for signing scripts. The ConfigMap you create contains the scripts used by the signing service for collections and container images.

   Note

   This script is used as part of the signing service and must generate an ascii-armored detached gpg signature for that file using the key specified through the PULP_SIGNING_KEY_FINGERPRINT environment variable.

   The script prints out a JSON structure with the following format.

   {"file": "filename", "signature": "filename.asc"}

   Copy to Clipboard Toggle word wrap

   All the file names are relative paths inside the current working directory. The file name must remain the same for the detached signature.

   Example: The following script produces signatures for content:

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: signing-scripts
   data:
     collection_sign.sh: |-
         #!/usr/bin/env bash
   
         FILE_PATH=$1
         SIGNATURE_PATH=$1.asc
   
         ADMIN_ID="$PULP_SIGNING_KEY_FINGERPRINT"
         PASSWORD="password"
   
         # Create a detached signature
         gpg --quiet --batch --pinentry-mode loopback --yes --passphrase \
           $PASSWORD --homedir /var/lib/pulp/.gnupg --detach-sign --default-key $ADMIN_ID \
           --armor --output $SIGNATURE_PATH $FILE_PATH
   
         # Check the exit status
         STATUS=$?
         if [ $STATUS -eq 0 ]; then
           echo {\"file\": \"$FILE_PATH\", \"signature\": \"$SIGNATURE_PATH\"}
         else
           exit $STATUS
         fi
     container_sign.sh: |-
       #!/usr/bin/env bash
   
       # galaxy_container SigningService will pass the next 4 variables to the script.
       MANIFEST_PATH=$1
       FINGERPRINT="$PULP_SIGNING_KEY_FINGERPRINT"
       IMAGE_REFERENCE="$REFERENCE"
       SIGNATURE_PATH="$SIG_PATH"
   
       # Create container signature using skopeo
       skopeo standalone-sign \
         $MANIFEST_PATH \
         $IMAGE_REFERENCE \
         $FINGERPRINT \
         --output $SIGNATURE_PATH
   
       # Optionally pass the passphrase to the key if password protected.
       # --passphrase-file /path/to/key_password.txt
   
       # Check the exit status
       STATUS=$?
       if [ $STATUS -eq 0 ]; then
         echo {\"signature_path\": \"$SIGNATURE_PATH\"}
       else
         exit $STATUS
       fi

   Copy to Clipboard Toggle word wrap

2. Create a secret for your GnuPG private key. This secret securely stores the GnuPG private key you use for signing.

   gpg --export --armor <your-gpg-key-id> > signing_service.gpg
   
   oc create secret generic signing-galaxy --from-file=signing_service.gpg

   Copy to Clipboard Toggle word wrap

   The secret must have a key named signing_service.gpg.

3. Configure the AnsibleAutomationPlatform CR.

   apiVersion: aap.ansible.com/v1alpha1
   kind: AnsibleAutomationPlatform
   metadata:
     name: aap-hub-signing-sample
   spec:
     hub:
       signing_secret: "signing-galaxy"
       signing_scripts_configmap: "signing-scripts"

   Copy to Clipboard Toggle word wrap