Chapter 5. Configuring Red Hat Ansible Automation Platform components on Red Hat Ansible Automation Platform Operator

Procedure

1. Create a postgres_configuration_secret YAML file, following the template below:

   apiVersion: v1
   kind: Secret
   metadata:
     name: external-postgres-configuration
     namespace: <target_namespace> 

   1

   
   stringData:
     host: "<external_ip_or_url_resolvable_by_the_cluster>" 

   2

   
     port: "<external_port>" 

   3

   
     database: "<desired_database_name>"
     username: "<username_to_connect_as>"
     password: "<password_to_connect_with>" 

   4

   
     type: "unmanaged"
   type: Opaque

   1. Namespace to create the secret in. This should be the same namespace you want to deploy to.
   2. The resolvable hostname for your database node.
   3. External port defaults to 5432.
   4. Value for variable password should not contain single or double quotes (', ") or backslashes (\) to avoid any issues during deployment, backup or restoration.

2. Apply external-postgres-configuration-secret.yml to your cluster using the oc create command.

   $ oc create -f external-postgres-configuration-secret.yml

   Note

   The following example is for a platform gateway deployment. To configure an external database for all components, use the aap-configuring-external-db-all-default-components.yml example in the 14.1. Custom resources section.

3. When creating your AnsibleAutomationPlatform custom resource object, specify the secret on your spec, following the example below:

   apiVersion: aap.ansible.com/v1alpha1
   kind: AnsibleAutomationPlatform
   metadata:
     name: example-aap
     Namespace: aap
   spec:
     database:
        database_secret: automation-platform-postgres-configuration

Procedure

1. Edit the /var/lib/pgsql/data/postgres.conf file on the database server:

   # vi /var/lib/pgsql/data/postgres.conf

2. Find and comment out the line:

   #datestyle = 'Redwood, SHOW_TIME'

3. Add the following setting immediately below the newly-commented line:

   datestyle = 'iso, mdy'

4. Save and close the postgres.conf file.

5. Reload the database configuration:

   # systemctl reload postgresql

   Note

   Running this command does not disrupt database operations.

Procedure

1. Log in to Red Hat OpenShift Container Platform.
2. Go to Operators Installed Operators.
3. Select your Ansible Automation Platform Operator deployment.
4. Select All Instances and go to your AnsibleAutomationPlatform instance.
5. Click the ⋮ icon and then select Edit AnsibleAutomationPlatform.

6. In the YAML view paste the following YAML code under the spec: section:

   spec:
     extra_settings:
       - setting: REDIRECT_IS_HTTPS
         value: '"True"'

7. Click Save.

Procedure

1. Log in to Red Hat OpenShift Container Platform.
2. Navigate to Operators Installed Operators.
3. Select your Ansible Automation Platform Operator deployment.
4. Select the Ansible Automation Platform tab.

5. For new instances, click Create AnsibleAutomationPlatform.

   1. For existing instances, you can edit the YAML view by clicking the ⋮ icon and then Edit AnsibleAutomationPlatform.
6. Click Advanced Configuration.
7. Under Ingres annotations, enter any annotations to add to the ingress.
8. Under Ingress TLS secret, click the drop-down list and select a secret from the list.

9. Under YAML view paste in the following code:

   spec:
     extra_settings:
       - setting: CSRF_TRUSTED_ORIGINS
         value:
           - https://my-aap-domain.com

10. After you have configured your platform gateway, click Create at the bottom of the form view (Or Save in the case of editing existing instances).

Procedure

1. Log in to Red Hat OpenShift Container Platform.
2. Go to Operators Installed Operators.
3. Select your Ansible Automation Platform Operator deployment.
4. Select All Instances and go to your Ansible Automation Platform instance.
5. Click the ⋮ icon and then select Edit Ansible Automation Platform.
6. In the YAML view, locate the spec: section

7. Add the database section and the required settings under spec:. The following example configures SSL ciphers and the maximum connections:

   spec:
     database:
       postgres_extra_settings:
         - name: max_connections
           value: '1000'

8. Click Save.

Procedure

1. Log in to the OpenShift web console.
2. Navigate to Installed Operators > Ansible Automation Platform > All Instances.
3. Select your AnsibleAutomationPlatform instance.
4. Click the YAML tab.

5. In the spec: section, add the route_annotations to extend the timeout:

   spec:
     route_annotations: |
       haproxy.router.openshift.io/timeout: 180s

6. Click Save.

Verification

1. Navigate to Networking > Routes in the OpenShift console.
2. Select the route for your Ansible Automation Platform instance.
3. Verify the Annotations section contains the updated timeout value.

Procedure

1. Create a postgres_configuration_secret YAML file, following the template below:

   apiVersion: v1
   kind: Secret
   metadata:
     name: external-postgres-configuration
     namespace: <target_namespace> 

   1

   
   stringData:
     host: "<external_ip_or_url_resolvable_by_the_cluster>" 

   2

   
     port: "<external_port>" 

   3

   
     database: "<desired_database_name>"
     username: "<username_to_connect_as>"
     password: "<password_to_connect_with>" 

   4

   
     sslmode: "prefer" 

   5

   
     type: "unmanaged"
   type: Opaque

   1. Namespace to create the secret in. This should be the same namespace you want to deploy to.
   2. The resolvable hostname for your database node.
   3. External port defaults to 5432.
   4. Value for variable password should not contain single or double quotes (', ") or backslashes (\) to avoid any issues during deployment, backup or restoration.
   5. The variable sslmode is valid for external databases only. The allowed values are: prefer, disable, allow, require, verify-ca, and verify-full.

2. Apply external-postgres-configuration-secret.yml to your cluster using the oc create command.

   $ oc create -f external-postgres-configuration-secret.yml

3. When creating your AnsibleAutomationPlatform custom resource object, specify the secret under the controller section in your spec, following the example below:

   apiVersion: aap.ansible.com/v1alpha1
   kind: AnsibleAutomationPlatform
   metadata:
     name: myaap
   spec:
     controller:
       name: controller-dev  # Optional: specify existing instance or custom name
       postgres_configuration_secret: external-postgres-configuration

   Note

   If you have an existing automation controller instance, specify its name under controller.name to apply these settings to the existing instance. If you omit the name field, the operator will create a new instance with the default name pattern <aap-instance-name>-controller.

   For more examples of Ansible Automation Platform custom resources, see Appendix: Red Hat Ansible Automation Platform custom resources.

Procedure

1. List the existing PVCs in your deployment namespace:

   oc get pvc -n <namespace>

2. Identify the PVC associated with your previous deployment by comparing the old deployment name and the PVC name.

3. Delete the old PVC:

   oc delete pvc -n <namespace> <pvc-name>

Procedure

1. Log into Red Hat OpenShift Container Platform.
2. Navigate to Networking Routes.
3. Under Location, click on the URL for your automation hub instance.

Procedure

1. Create a postgres_configuration_secret YAML file, following the template below:

   apiVersion: v1
   kind: Secret
   metadata:
     name: external-postgres-configuration
     namespace: <target_namespace> 

   1

   
   stringData:
     host: "<external_ip_or_url_resolvable_by_the_cluster>" 

   2

   
     port: "<external_port>" 

   3

   
     database: "<desired_database_name>"
     username: "<username_to_connect_as>"
     password: "<password_to_connect_with>" 

   4

   
     sslmode: "prefer" 

   5

   
     type: "unmanaged"
   type: Opaque

   1. Namespace to create the secret in. This should be the same namespace you want to deploy to.
   2. The resolvable hostname for your database node.
   3. External port defaults to 5432.
   4. Value for variable password should not contain single or double quotes (', ") or backslashes (\) to avoid any issues during deployment, backup or restoration.
   5. The variable sslmode is valid for external databases only. The allowed values are: prefer, disable, allow, require, verify-ca, and verify-full.

2. Apply external-postgres-configuration-secret.yml to your cluster using the oc create command.

   $ oc create -f external-postgres-configuration-secret.yml

3. When creating your AnsibleAutomationPlatform custom resource object, specify the secret under the hub section in your spec, following the example below:

   apiVersion: aap.ansible.com/v1alpha1
   kind: AnsibleAutomationPlatform
   metadata:
     name: myaap
   spec:
     hub:
       name: hub-dev  # Optional: specify existing instance or custom name
       postgres_configuration_secret: external-postgres-configuration
       storage_type: file
       file_storage_storage_class: <your-read-write-many-storage-class>
       file_storage_size: 10Gi

   Note

   If you have an existing automation hub instance, specify its name under hub.name to apply these settings to the existing instance. If you omit the name field, the operator will create a new instance with the default name pattern <aap-instance-name>-hub.

   For more examples of Ansible Automation Platform custom resources, see Appendix: Red Hat Ansible Automation Platform custom resources.

Procedure

1. List the existing PVCs in your deployment namespace:

   oc get pvc -n <namespace>

2. Identify the PVC associated with your previous deployment by comparing the old deployment name and the PVC name.

3. Delete the old PVC:

   oc delete pvc -n <namespace> <pvc-name>

Procedure

1. Log in to Red Hat OpenShift Container Platform.
2. Navigate to Home Search.
3. Select the Resources drop-down list and type "Image".
4. Select Image (config,openshift.io/v1).
5. Click Cluster under the Name heading.
6. Select the YAML tab.

7. Paste in the following under spec value:

   spec:
     registrySources:
       allowedRegistries:
       - quay.io
       - registry.redhat.io
       - image-registry.openshift-image-registry.svc:5000
       - <OCP route for your automation hub>

8. Click Save.

Procedure

1. Create a ConfigMap for signing scripts. The ConfigMap you create contains the scripts used by the signing service for collections and container images.

   Note

   This script is used as part of the signing service and must generate an ascii-armored detached gpg signature for that file using the key specified through the PULP_SIGNING_KEY_FINGERPRINT environment variable.

   The script prints out a JSON structure with the following format.

   {"file": "filename", "signature": "filename.asc"}

   All the file names are relative paths inside the current working directory. The file name must remain the same for the detached signature.

   Example: The following script produces signatures for content:

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: signing-scripts
   data:
     collection_sign.sh: |-
         #!/usr/bin/env bash
   
         FILE_PATH=$1
         SIGNATURE_PATH=$1.asc
   
         ADMIN_ID="$PULP_SIGNING_KEY_FINGERPRINT"
         PASSWORD="password"
   
         # Create a detached signature
         gpg --quiet --batch --pinentry-mode loopback --yes --passphrase \
           $PASSWORD --homedir /var/lib/pulp/.gnupg --detach-sign --default-key $ADMIN_ID \
           --armor --output $SIGNATURE_PATH $FILE_PATH
   
         # Check the exit status
         STATUS=$?
         if [ $STATUS -eq 0 ]; then
           echo {\"file\": \"$FILE_PATH\", \"signature\": \"$SIGNATURE_PATH\"}
         else
           exit $STATUS
         fi
     container_sign.sh: |-
       #!/usr/bin/env bash
   
       # galaxy_container SigningService will pass the next 4 variables to the script.
       MANIFEST_PATH=$1
       FINGERPRINT="$PULP_SIGNING_KEY_FINGERPRINT"
       IMAGE_REFERENCE="$REFERENCE"
       SIGNATURE_PATH="$SIG_PATH"
   
       # Create container signature using skopeo
       skopeo standalone-sign \
         $MANIFEST_PATH \
         $IMAGE_REFERENCE \
         $FINGERPRINT \
         --output $SIGNATURE_PATH
   
       # Optionally pass the passphrase to the key if password protected.
       # --passphrase-file /path/to/key_password.txt
   
       # Check the exit status
       STATUS=$?
       if [ $STATUS -eq 0 ]; then
         echo {\"signature_path\": \"$SIGNATURE_PATH\"}
       else
         exit $STATUS
       fi

2. Create a secret for your GnuPG private key. This secret securely stores the GnuPG private key you use for signing.

   gpg --export --armor <your-gpg-key-id> > signing_service.gpg
   
   oc create secret generic signing-galaxy --from-file=signing_service.gpg

   The secret must have a key named signing_service.gpg.

3. Configure the AnsibleAutomationPlatform CR.

   apiVersion: aap.ansible.com/v1alpha1
   kind: AnsibleAutomationPlatform
   metadata:
     name: aap-hub-signing-sample
   spec:
     hub:
       signing_secret: "signing-galaxy"
       signing_scripts_configmap: "signing-scripts"

Procedure

1. Identify the name you intend to use for your AnsibleAutomationPlatform deployment (for example, myaap).
2. Create a PVC manifest for the PostgreSQL database using the required naming convention: postgres-15-<deployment_name>-0.
3. Ensure the accessModes and resources.requests.storage match your manually provisioned PV.

4. Apply the PVC manifest:

   oc apply -f postgres-pvc.yaml

5. Repeat these steps for other components, such as automation hub, using the correct naming conventions.

6. Leave the storage_class fields empty or omit them from the specification. This forces the Operator to use the pre-created PVCs.

   Note

   Unlike core components, the AnsibleAutomationPlatformBackup and Restore custom resources provide a backup_pvc parameter. You must use this parameter to specify your custom PVC name instead of relying on naming conventions.