Chapter 3. Setting up Red Hat Ansible Lightspeed for your organization

Procedure

1. Log in to the Ansible Lightspeed portal as an organization administrator.
2. Click Log in Log in with Red Hat.

3. Enter your Red Hat account username and password. The Ansible Lightspeed Service uses Red Hat Single Sign-On (RH-SSO) for authentication.

   As part of the authentication process, the Ansible Lightspeed Service checks whether your organization has an active Ansible Automation Platform subscription. On successful authentication, the login screen is displayed along with your username and your assigned user role.

4. From the login screen, click Admin Portal.

   You are redirected to the Red Hat Ansible Lightspeed with IBM watsonx Code Assistant administrator portal where you can connect Red Hat Ansible Lightspeed to your IBM watsonx Code Assistant instance.

Procedure

1. Log in to the Ansible Lightspeed portal as an organization administrator.
2. From the login screen, click Admin Portal.

3. Specify the API key of your IBM watsonx Code Assistant instance:

   1. Under IBM Cloud API Key, click Add API key. A screen to enter the API Key is displayed.
   2. Enter the API Key.
   3. Optional: Click Test to validate the API key.
   4. Click Save.

4. Specify the model ID of the model that you want to use:

   1. Click Model Settings.
   2. Under Model ID, click Add Model ID. A screen to enter the Model Id is displayed.
   3. Enter the Model ID that you obtained in the previous procedure as the default model for your organization.
   4. Optional: Click Test model ID to validate the model ID.

   5. Click Save.

      When the API key and model ID is successfully validated, Red Hat Ansible Lightspeed is connected to your IBM watsonx Code Assistant instance.

Procedure

1. Log in to the Red Hat OpenShift Container Platform as an administrator.

2. Create a namespace:

   1. Go to Administration Namespaces.
   2. Click Create Namespace.
   3. Enter a unique name for the namespace.
   4. Click Create.

3. Install the operator:

   1. Go to Operators OperatorHub.
   2. Select the namespace where you want to install the Red Hat Ansible Automation Platform operator.
   3. Search for the Ansible Automation Platform operator.
   4. From the search results, select the Ansible Automation Platform (provided by Red Hat) tile.
   5. Select an Update Channel. You can select either stable-2.x or stable-2.x-cluster-scoped as the channel.
   6. Select the destination namespace if you selected “stable-2.x” as the update channel.
   7. Select Install. It takes a few minutes for the operator to be installed.
4. Click View Operator to see the details of your newly installed Red Hat Ansible Automation Platform operator.

Procedure

1. Log in to the automation controller as an administrator.
2. Under Administration, click Applications Add.

3. Enter the following information:

   1. Name: Specify a unique name for your application.
   2. Organization: Select a preferred organization.
   3. Authorization grant type: Select Authorization code.

   4. Redirect URIs: Enter a temporary URL for now, for example, https://temp/.

      The exact Red Hat Ansible Lightspeed application URL is generated after the on-premise deployment is completed. After the deployment is completed, you must change the Redirect URI to point to the generated Red Hat Ansible Lightspeed application URL. For more information, see Updating the Redirect URIs.

   5. From the Client type list, select Confidential.

4. Click Save.

   A pop-up window is displayed along with the generated application client ID and client secret.

5. Copy and save both the generated client ID and client secret for future use.

   Important

   This is the only time the pop-up window is displayed. Therefore, ensure that you copy both the client ID and client secret, as you need these tokens to create connections secrets for Red Hat Ansible Automation Platform and IBM watsonx Code Assistant both.

   The following image is an example of the generated client ID and client secret:

   

Procedure

1. Go to Red Hat OpenShift Container Platform.
2. Select Operators Installed Operators.
3. From the Projects list, select the namespace where you want to install the Red Hat Ansible Lightspeed instance and where you created the connection secrets.
4. Locate and select the Ansible Automation Platform (provided by Red Hat) operator that you installed earlier.
5. Select All instances Create new.
6. From the Create new list, select the Ansible Lightspeed modal.
7. Ensure that you have selected Form view as the configuration mode.

8. Provide the following information:

   1. Name: Enter a unique name for your Red Hat Ansible Lightspeed instance.
   2. Secret where the authentication information can be found: Select the authentication secret that you created to connect to the Red Hat Ansible Automation Platform.
   3. Secret where the model configuration can be found: Select the model secret that you created to connect to IBM watsonx Code Assistant.
9. Optional: If you created a bundle secret to trust a custom Certificate Authority, select the bundle_cacert_secret from Advanced Bundle CA Certificate Secret list.

10. Click Create.

    The Red Hat Ansible Lightspeed instance takes a few minutes to deploy to your namespace. After the installation status is displayed as Successful, the Ansible Lightspeed portal URL is available under Networking Routes in Red Hat OpenShift Container Platform.

Procedure

1. Get the URL of the Ansible Lightspeed instance:

   1. Go to Red Hat OpenShift Container Platform.
   2. Select Networking Routes.
   3. Locate the Red Hat Ansible Lightspeed instance that you created.
   4. Copy the Location URL of the Red Hat Ansible Lightspeed instance.

2. Update the login redirect URI:

   1. In the automation controller, go to Administration Applications.
   2. Select the Lightspeed Oauth application that you created.

   3. In the Redirect URIs field of the Oauth application, enter the URL in the following format:

      https://<lightspeed_route>/complete/aap/

      An example of the URL is https://lightspeed-on-prem-web-service.com/complete/aap/.

      Important

      The Redirect URL must include the following information:

      • The prefix https://
      • The <lightspeed_route> URL, which is the URL of the Red Hat Ansible Lightspeed instance that you copied earlier
      • The suffix /complete/aap/ that includes a backslash sign (/) at the end
   4. Click Save.

3. Update the logout redirect URI based on your setup:

   Procedure when both the Red Hat Ansible Lightspeed instance and automation controller are installed using Ansible Automation Platform operator:

   1. Log in to the cluster on which the Ansible Automation Platform instance is running.
   2. Identify the AutomationController custom resource.
   3. Select [YAML view].

   4. Add the following entry to the YAML file:

      Copy to Clipboard Toggle word wrap

      ```yaml
        spec:
        ...
        extra_settings:
          - setting: LOGOUT_ALLOWED_HOSTS
            value: "'<lightspeed_route-HostName>'"
        ```

      Important

      Ensure the following while specifying the value: parameter:

      • Specify the hostname without the network protocol, such as https://.

        For example, the correct hostname would be my-aiconnect-instance.somewhere.com, and not https://my-aiconnect-instance.somewhere.com.

      • Use the single and double quotes exactly as specified in the codeblock.

        If you change the single quotes to double quotes and vice versa, you will encounter errors when logging out.

      • Use a comma to specify multiple instances of Red Hat Ansible Lightspeed deployment.

        If you are running multiple instances of Red Hat Ansible Lightspeed application with a single Red Hat Ansible Automation Platform deployment, add a comma (,) and then add the other hostname values. For example, you can add multiple hostnames, such as "'my-lightspeed-instance1.somewhere.com','my-lightspeed-instance2.somewhere.com'"

   5. Apply the revised YAML. This task restarts the automation controller pods.

1. Log in to the virtual machine with the Ansible Automation Platform controller.

2. In the /etc/tower/conf.d/custom.py file, add the following parameter:
   LOGOUT_ALLOWED_HOSTS = "<lightspeed_route-HostName>"

   Important
   • If the /etc/tower/conf.d/custom.py file does not exist, create it.

   • Specify the hostname without the network protocol, such as https://.

     For example, the correct hostname would be my-aiconnect-instance.somewhere.com, and not https://my-aiconnect-instance.somewhere.com.

   • Use the single and double quotes in pairs; do not mix single quotes with double quotes.
3. Restart the automation controller by executing the following command:
   $ automation-controller-service restart

1. Log in to the virtual machine with the platform gateway.

2. Add the following parameter in either the gateway/settings.py file or in the ansible-automation-platform/gateway/settings.py file:
   LOGOUT_ALLOWED_HOSTS = "<lightspeed_route-HostName>"

   Important

   • Specify the hostname without the network protocol, such as https://.

     For example, the correct hostname would be my-aiconnect-instance.somewhere.com, and not https://my-aiconnect-instance.somewhere.com.

   • Use double quotes exactly as specified in the codeblock.

Procedure

1. Open the VS Code application.
2. From the Activity bar, click the Extensions icon.
3. From the Installed Extensions list, select Ansible.
4. From the Ansible extension page, click the Settings icon ( ) and select Extension Settings.

5. Select Ansible Lightspeed settings and specify the following information:

   • In the URL for Ansible Lightspeed field, enter the Route URL of the Red Hat Ansible Lightspeed on-premise deployment. Ansible users must have Ansible Automation Platform controller credentials.

   • Optional: If you want to use a custom model instead of the default model, in the Model ID Override field, enter the custom model ID. Your settings are automatically saved in VS Code.

     After configuring Ansible VS Code extension to connect to Red Hat Ansible Lightspeed on-premise deployment, you must log in to Ansible Lightspeed through the Ansible VS Code extension.

     Note

     If your organization recently subscribed to the Red Hat Ansible Automation Platform, it might take a few hours for Red Hat Ansible Lightspeed to detect the new subscription. In VS Code, use the Refresh button in the Ansible extension from the Activity bar to check again.

Procedure

1. Go to the Red Hat OpenShift Container Platform.
2. Select Operators Installed Operators.
3. From the Projects list, select the namespace where you installed the Red Hat Ansible Lightspeed instance.
4. Locate and select the Ansible Automation Platform (provided by Red Hat) operator that you installed earlier.
5. Select the Ansible Lightspeed tab.
6. Find and select the instance you want to update.
7. Click Actions Edit AnsibleLightspeed. The editor switches to a text or YAML view.

8. Scroll the text to find the spec: section.

   )

9. Find the entry for the secret you have changed and saved under a new name.
10. Change the name of the secrets to the new secrets.

11. Click Save.

    The new AnsibleLightspeed Pods are created. After the new pods are running successfully, the old AnsibleLightspeed Pods are terminated.

Procedure

1. Create a system auditor user:

   1. Create a user with a system auditor role in the Red Hat Ansible Automation Platform. For the procedure, see the Creating a user section of Getting started with Ansible Automation Platform.
   2. Verify that you can log in to the Ansible Lightspeed portal for on-premise deployment (https://<lightspeed_route>/) as the newly-created system auditor user, and then log out.

2. Create a token for the system auditor user:

   1. Log in to the Ansible Lightspeed portal for on-premise deployment (https://<lightspeed_route>/admin) as an administrator by using the following credentials:

      • Username: admin
      • Password: The secret that is named as <lightspeed-custom-resource-name>-admin-password in the Red Hat OpenShift Container Platform cluster namespace where Red Hat Ansible Lightspeed is deployed.
   2. On the Django administration window, select Users from the Users area. A list of users is displayed.
   3. Verify that the user with the system auditor role is listed in the Users list.
   4. From the Django Oauth toolkit area, select Access tokens Add.

   5. Provide the following information and click Save:

      • User: Use the magnifying glass icon to search and select the user with the system auditor role.
      • Token: Specify a token for the user. Copy this token for later use.
      • Id token: Select the token ID.
      • Application: Select Ansible Lightspeed for VS Code.
      • Expires: Select the date and time when you want the token to expire.

      • Scope: Specify the scope as read write.

        An access token is created for the user with a system auditor role.

   6. Log out from the Ansible Lightspeed portal for on-premise deployment.
3. Monitor your Red Hat Ansible Lightspeed on-premise deployment, by using the authorization token of the user with the system auditor role, to access the metrics endpoint https://<lightspeed_route>/metrics.

Procedure

1. Select the platform user for whom you want to grant REST API access.

   You can select an existing user or create a platform user in the Red Hat Ansible Automation Platform. For the procedure, see the Creating a user section of Getting started with Ansible Automation Platform.

2. Verify that you can log in to the Ansible Lightspeed portal for on-premise deployment (https://<lightspeed_route>/) as the platform user you selected or created, and then log out.

3. Create a token for the platform user:

   1. Log in to the Ansible Lightspeed portal for on-premise deployment (https://<lightspeed_route>/admin) as an administrator by using the following credentials:

      • Username: admin
      • Password: The secret that is named as <lightspeed-custom-resource-name>-admin-password in the Red Hat OpenShift Container Platform cluster namespace where Red Hat Ansible Lightspeed is deployed.
   2. On the Django administration window, select Users from the Users area. A list of users is displayed.
   3. Verify that the platform user is listed in the Users list.
   4. From the Django Oauth toolkit area, select Access tokens Add.

   5. Provide the following information and click Save:

      • User: Use the magnifying glass icon to search and select the newly-created or existing user for whom you want to grant API access.
      • Token: Specify a token for the user. Copy this token for later use.
      • Id token: Select the token ID.
      • Application: Select Ansible Lightspeed for VS Code.
      • Expires: Select the date and time when you want the token to expire.

      • Scope: Specify the scope as read write.

        An access token is created for the user.

   6. Log out from the Ansible Lightspeed portal for on-premise deployment.

4. Make a direct call to the Ansible Lightspeed REST API by specifying the newly-created token in the authorization header:

   Copy to Clipboard Toggle word wrap

   curl -H "Authorization: Bearer <token>"
   https://<lightspeed_route>/api/v1/me/