Chapter 3. Installing Red Hat Ansible Automation Platform Ansible Automation Platform is a modular platform and you can deploy automation controller with other automation platform components, such as automation hub. For more information about the components provided with Ansible Automation Platform, see Red Hat Ansible Automation Platform components in the Red Hat Ansible Automation Platform Planning Guide. There are a number of supported installation scenarios for Red Hat Ansible Automation Platform. To install Red Hat Ansible Automation Platform, you must edit the inventory file parameters to specify your installation scenario using one of the following examples: Standalone automation controller with internal database Single automation controller with external (installer managed) database Single automation controller with external (customer provided) database Ansible Automation Platform with an external (installer managed) database Ansible Automation Platform with an external (customer provided) database Standalone automation hub with internal database Single automation hub with external (installer managed) database Single automation hub with external (customer provided) database LDAP configuration on private automation hub 3.1. Editing the Red Hat Ansible Automation Platform installer inventory file You can use the Red Hat Ansible Automation Platform installer inventory file to specify your installation scenario. Procedure Navigate to the installer: [RPM installed package] USD cd /opt/ansible-automation-platform/installer/ [bundled installer] USD cd ansible-automation-platform-setup-bundle-<latest-version> [online installer] USD cd ansible-automation-platform-setup-<latest-version> Open the inventory file with a text editor. Edit inventory file parameters to specify your installation scenario. Use one of the supported Installation scenario examples to update your inventory file. Additional resources For a comprehensive list of pre-defined variables used in Ansible installation inventory files, see Inventory file variables . 3.1.1. Inventory file examples based on installation scenarios Red Hat supports several installation scenarios for Ansible Automation Platform. Review the following examples and select those suitable for your preferred installation scenario. Important For Red Hat Ansible Automation Platform or automation hub: Add an automation hub host in the [automationhub] group. For internal databases: [database] cannot be used to point to another host in the Ansible Automation Platform cluster. The database host set to be installed needs to be a unique host. Do not install automation controller and automation hub on the same node for versions of Ansible Automation Platform in a production or customer environment. This can cause contention issues and heavy resource use. Provide a reachable IP address or fully qualified domain name (FQDN) for the [automationhub] and [automationcontroller] hosts to ensure users can sync and install content from automation hub from a different node. The FQDN must not contain either the - or the _ symbols, as it will not be processed correctly. Do not use localhost . Do not use special characters for pg_password . It can cause the setup to fail. Enter your Red Hat Registry Service Account credentials in registry_username and registry_password to link to the Red Hat container registry. The inventory file variables registry_username and registry_password are only required if a non-bundle installer is used. 3.1.1.1. Standalone automation controller with internal database Use this example to populate the inventory file to install Red Hat Ansible Automation Platform. This installation inventory file includes a single automation controller node with an internal database. [automationcontroller] controller.acme.org [all:vars] admin_password='<password>' pg_host='' pg_port='5432' pg_database='awx' pg_username='awx' pg_password='<password>' pg_sslmode='prefer' # set to 'verify-full' for client-side enforced SSL registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' # SSL-related variables # If set, this will install a custom CA certificate to the system trust store. # custom_ca_cert=/path/to/ca.crt # Certificate and key to install in nginx for the web UI and API # web_server_ssl_cert=/path/to/tower.cert # web_server_ssl_key=/path/to/tower.key # Server-side SSL settings for PostgreSQL (when we are installing it). # postgres_use_ssl=False # postgres_ssl_cert=/path/to/pgsql.crt # postgres_ssl_key=/path/to/pgsql.key 3.1.1.2. Single automation controller with external (installer managed) database Use this example to populate the inventory file to install Red Hat Ansible Automation Platform. This installation inventory file includes a single automation controller node with an external database on a separate node. [automationcontroller] controller.acme.org [database] data.acme.org [all:vars] admin_password='<password>' pg_host='data.acme.org' pg_port='5432' pg_database='awx' pg_username='awx' pg_password='<password>' pg_sslmode='prefer' # set to 'verify-full' for client-side enforced SSL registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' # SSL-related variables # If set, this will install a custom CA certificate to the system trust store. # custom_ca_cert=/path/to/ca.crt # Certificate and key to install in nginx for the web UI and API # web_server_ssl_cert=/path/to/tower.cert # web_server_ssl_key=/path/to/tower.key # Server-side SSL settings for PostgreSQL (when we are installing it). # postgres_use_ssl=False # postgres_ssl_cert=/path/to/pgsql.crt # postgres_ssl_key=/path/to/pgsql.key 3.1.1.3. Single automation controller with external (customer provided) database Use this example to populate the inventory file to install Red Hat Ansible Automation Platform. This installation inventory file includes a single automation controller node with an external database on a separate node that is not managed by the platform installer. Important This example does not have a host under the database group. This indicates to the installer that the database already exists, and is being managed elsewhere. [automationcontroller] controller.acme.org [database] [all:vars] admin_password='<password>' pg_host='data.acme.org' pg_port='5432' pg_database='awx' pg_username='awx' pg_password='<password>' pg_sslmode='prefer' # set to 'verify-full' for client-side enforced SSL registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' # SSL-related variables # If set, this will install a custom CA certificate to the system trust store. # custom_ca_cert=/path/to/ca.crt # Certificate and key to install in nginx for the web UI and API # web_server_ssl_cert=/path/to/tower.cert # web_server_ssl_key=/path/to/tower.key # Server-side SSL settings for PostgreSQL (when we are installing it). # postgres_use_ssl=False # postgres_ssl_cert=/path/to/pgsql.crt # postgres_ssl_key=/path/to/pgsql.key 3.1.1.4. Ansible Automation Platform with an external (installer managed) database Use this example to populate the inventory file to install Ansible Automation Platform. This installation inventory file includes two automation controller nodes, two execution nodes, and automation hub with an external managed database. # Automation Controller Nodes # There are two valid node_types that can be assigned for this group. # A node_type=control implies that the node will only be able to run # project and inventory updates, but not regular jobs. # A node_type=hybrid will have the ability to run everything. # If you do not define the node_type, it defaults to hybrid. # # control.example node_type=control # hybrid.example node_type=hybrid # hybrid2.example <- this will default to hybrid [automationcontroller] controller1.acme.org node_type=control controller2.acme.org node_type=control # Execution Nodes # There are two valid node_types that can be assigned for this group. # A node_type=hop implies that the node will forward jobs to an execution node. # A node_type=execution implies that the node will be able to run jobs. # If you do not define the node_type, it defaults to execution. # # hop.example node_type=hop # execution.example node_type=execution # execution2.example <- this will default to execution [execution_nodes] execution1.acme.org node_type=execution execution2.acme.org node_type=execution [automationhub] automationhub.acme.org [database] data.acme.org [all:vars] admin_password='<password>' pg_host='data.acme.org' pg_port='5432' pg_database='awx' pg_username='awx' pg_password='<password>' pg_sslmode='prefer' # set to 'verify-full' for client-side enforced SSL registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' # Receptor Configuration # receptor_listener_port=27199 # Automation Hub Configuration # automationhub_admin_password='<password>' automationhub_pg_host='data.acme.org' automationhub_pg_port='5432' automationhub_pg_database='automationhub' automationhub_pg_username='automationhub' automationhub_pg_password='<password>' automationhub_pg_sslmode='prefer' # The default install will deploy a TLS enabled Automation Hub. # If for some reason this is not the behavior wanted one can # disable TLS enabled deployment. # # automationhub_disable_https = False # The default install will generate self-signed certificates for the Automation # Hub service. If you are providing valid certificate via automationhub_ssl_cert # and automationhub_ssl_key, one should toggle that value to True. # # automationhub_ssl_validate_certs = False # SSL-related variables # If set, this will install a custom CA certificate to the system trust store. # custom_ca_cert=/path/to/ca.crt # Certificate and key to install in nginx for the web UI and API # web_server_ssl_cert=/path/to/tower.cert # web_server_ssl_key=/path/to/tower.key # Certificate and key to install in Automation Hub node # automationhub_ssl_cert=/path/to/automationhub.cert # automationhub_ssl_key=/path/to/automationhub.key # Server-side SSL settings for PostgreSQL (when we are installing it). # postgres_use_ssl=False # postgres_ssl_cert=/path/to/pgsql.crt # postgres_ssl_key=/path/to/pgsql.key 3.1.1.5. Ansible Automation Platform with an external (customer provided) database Use this example to populate the inventory file to install Red Hat Ansible Automation Platform. This installation inventory file includes one of each node type; control, hybrid, hop, and execution, and automation hub with an external managed database that is not managed by the platform installer. Important This example does not have a host under the database group. This indicates to the installer that the database already exists, and is being managed elsewhere. # Automation Controller Nodes # There are two valid node_types that can be assigned for this group. # A node_type=control implies that the node will only be able to run # project and inventory updates, but not regular jobs. # A node_type=hybrid will have the ability to run everything. # If you do not define the node_type, it defaults to hybrid. # # control.example node_type=control # hybrid.example node_type=hybrid # hybrid2.example <- this will default to hybrid [automationcontroller] hybrid1.acme.org node_type=hybrid controller1.acme.org node_type=control # Execution Nodes # There are two valid node_types that can be assigned for this group. # A node_type=hop implies that the node will forward jobs to an execution node. # A node_type=execution implies that the node will be able to run jobs. # If you do not define the node_type, it defaults to execution. # # hop.example node_type=hop # execution.example node_type=execution # execution2.example <- this will default to execution [execution_nodes] hop1.acme.org node_type=hop execution1.acme.org node_type=execution [automationhub] automationhub.acme.org [database] [all:vars] admin_password='<password>' pg_host='data.acme.org' pg_port='5432' pg_database='awx' pg_username='awx' pg_password='<password>' pg_sslmode='prefer' # set to 'verify-full' for client-side enforced SSL registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' # Receptor Configuration # receptor_listener_port=27199 # Automation Hub Configuration # automationhub_admin_password='<password>' automationhub_pg_host='data.acme.org' automationhub_pg_port='5432' automationhub_pg_database='automationhub' automationhub_pg_username='automationhub' automationhub_pg_password='<password>' automationhub_pg_sslmode='prefer' # The default install will deploy a TLS enabled Automation Hub. # If for some reason this is not the behavior wanted one can # disable TLS enabled deployment. # # automationhub_disable_https = False # The default install will generate self-signed certificates for the Automation # Hub service. If you are providing valid certificate via automationhub_ssl_cert # and automationhub_ssl_key, one should toggle that value to True. # # automationhub_ssl_validate_certs = False # SSL-related variables # If set, this will install a custom CA certificate to the system trust store. # custom_ca_cert=/path/to/ca.crt # Certificate and key to install in nginx for the web UI and API # web_server_ssl_cert=/path/to/tower.cert # web_server_ssl_key=/path/to/tower.key # Certificate and key to install in Automation Hub node # automationhub_ssl_cert=/path/to/automationhub.cert # automationhub_ssl_key=/path/to/automationhub.key # Server-side SSL settings for PostgreSQL (when we are installing it). # postgres_use_ssl=False # postgres_ssl_cert=/path/to/pgsql.crt # postgres_ssl_key=/path/to/pgsql.key 3.1.1.6. Standalone automation hub with internal database Use this example to populate the inventory file to deploy a standalone instance of automation hub with an internal database. [automationcontroller] [automationhub] automationhub.acme.org ansible_connection=local [all:vars] registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' automationhub_admin_password= <PASSWORD> automationhub_pg_host='' automationhub_pg_port='5432' automationhub_pg_database='automationhub' automationhub_pg_username='automationhub' automationhub_pg_password=<PASSWORD> automationhub_pg_sslmode='prefer' # The default install will deploy a TLS enabled Automation Hub. # If for some reason this is not the behavior wanted one can # disable TLS enabled deployment. # # automationhub_disable_https = False # The default install will generate self-signed certificates for the Automation # Hub service. If you are providing valid certificate via automationhub_ssl_cert # and automationhub_ssl_key, one should toggle that value to True. # # automationhub_ssl_validate_certs = False # SSL-related variables # If set, this will install a custom CA certificate to the system trust store. # custom_ca_cert=/path/to/ca.crt # Certificate and key to install in Automation Hub node # automationhub_ssl_cert=/path/to/automationhub.cert # automationhub_ssl_key=/path/to/automationhub.key 3.1.1.7. Single automation hub with external (installer managed) database Use this example to populate the inventory file to deploy a single instance of automation hub with an external (installer managed) database. [automationcontroller] [automationhub] automationhub.acme.org [database] data.acme.org [all:vars] registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' automationhub_admin_password= <PASSWORD> automationhub_pg_host='data.acme.org' automationhub_pg_port='5432' automationhub_pg_database='automationhub' automationhub_pg_username='automationhub' automationhub_pg_password=<PASSWORD> automationhub_pg_sslmode='prefer' # The default install will deploy a TLS enabled Automation Hub. # If for some reason this is not the behavior wanted one can # disable TLS enabled deployment. # # automationhub_disable_https = False # The default install will generate self-signed certificates for the Automation # Hub service. If you are providing valid certificate via automationhub_ssl_cert # and automationhub_ssl_key, one should toggle that value to True. # # automationhub_ssl_validate_certs = False # SSL-related variables # If set, this will install a custom CA certificate to the system trust store. # custom_ca_cert=/path/to/ca.crt # Certificate and key to install in Automation Hub node # automationhub_ssl_cert=/path/to/automationhub.cert # automationhub_ssl_key=/path/to/automationhub.key 3.1.1.8. Single automation hub with external (customer provided) database Use this example to populate the inventory file to deploy a single instance of automation hub with an external database that is not managed by the platform installer. Important This example does not have a host under the database group. This indicates to the installer that the database already exists, and is being managed elsewhere. [automationcontroller] [automationhub] automationhub.acme.org [database] [all:vars] registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' automationhub_admin_password= <PASSWORD> automationhub_pg_host='data.acme.org' automationhub_pg_port='5432' automationhub_pg_database='automationhub' automationhub_pg_username='automationhub' automationhub_pg_password=<PASSWORD> automationhub_pg_sslmode='prefer' # The default install will deploy a TLS enabled Automation Hub. # If for some reason this is not the behavior wanted one can # disable TLS enabled deployment. # # automationhub_disable_https = False # The default install will generate self-signed certificates for the Automation # Hub service. If you are providing valid certificate via automationhub_ssl_cert # and automationhub_ssl_key, one should toggle that value to True. # # automationhub_ssl_validate_certs = False # SSL-related variables # If set, this will install a custom CA certificate to the system trust store. # custom_ca_cert=/path/to/ca.crt # Certificate and key to install in Automation Hub node # automationhub_ssl_cert=/path/to/automationhub.cert # automationhub_ssl_key=/path/to/automationhub.key 3.1.1.9. LDAP configuration on private automation hub You must set the following six variables in your Red Hat Ansible Automation Platform installer inventory file to configure your private automation hub for LDAP authentication: automationhub_authentication_backend automationhub_ldap_server_uri automationhub_ldap_bind_dn automationhub_ldap_bind_password automationhub_ldap_user_search_base_dn automationhub_ldap_group_search_base_dn If any of these variables are missing, the Ansible Automation installer will not complete the installation. 3.1.1.9.1. Setting up your inventory file variables When you configure your private automation hub with LDAP authentication, you must set the proper variables in your inventory files during the installation process. Procedure Access your inventory file according to the procedure in Editing the Red Hat Ansible Automation Platform installer inventory file . Use the following example as a guide to set up your Ansible Automation Platform inventory file: automationhub_authentication_backend = "ldap" automationhub_ldap_server_uri = "ldap://ldap:389" (for LDAPs use automationhub_ldap_server_uri = "ldaps://ldap-server-fqdn") automationhub_ldap_bind_dn = "cn=admin,dc=ansible,dc=com" automationhub_ldap_bind_password = "GoodNewsEveryone" automationhub_ldap_user_search_base_dn = "ou=people,dc=ansible,dc=com" automationhub_ldap_group_search_base_dn = "ou=people,dc=ansible,dc=com" Note The following variables will be set with default values, unless you set them with other options. auth_ldap_user_search_scope= 'SUBTREE' auth_ldap_user_search_filter= '(uid=%(user)s)' auth_ldap_group_search_scope= 'SUBTREE' auth_ldap_group_search_filter= '(objectClass=Group)' auth_ldap_group_type_class= 'django_auth_ldap.config:GroupOfNamesType' Optional: Set up extra parameters in your private automation hub such as user groups, superuser access, or mirroring. Go to Configuring extra LDAP parameters to complete this optional step. 3.1.1.9.2. Configuring extra LDAP parameters If you plan to set up superuser access, user groups, mirroring or other extra parameters, you can create a YAML file that comprises them in your ldap_extra_settings dictionary. Procedure Create a YAML file that contains ldap_extra_settings . Example: #ldapextras.yml --- ldap_extra_settings: <LDAP_parameter>: <Values> ... Add any parameters that you require for your setup. The following examples describe the LDAP parameters that you can set in ldap_extra_settings : Use this example to set up a superuser flag based on membership in an LDAP group. #ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_USER_FLAGS_BY_GROUP: {"is_superuser": "cn=pah-admins,ou=groups,dc=example,dc=com",} ... Use this example to set up superuser access. #ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_USER_FLAGS_BY_GROUP: {"is_superuser": "cn=pah-admins,ou=groups,dc=example,dc=com",} ... Use this example to mirror all LDAP groups you belong to. #ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_MIRROR_GROUPS: True ... Use this example to map LDAP user attributes (such as first name, last name, and email address of the user). #ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_USER_ATTR_MAP: {"first_name": "givenName", "last_name": "sn", "email": "mail",} ... Use the following examples to grant or deny access based on LDAP group membership: To grant private automation hub access (for example, members of the cn=pah-nosoupforyou,ou=groups,dc=example,dc=com group): #ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_REQUIRE_GROUP: 'cn=pah-nosoupforyou,ou=groups,dc=example,dc=com' ... To deny private automation hub access (for example, members of the cn=pah-nosoupforyou,ou=groups,dc=example,dc=com group): #ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_REQUIRE_GROUP: 'cn=pah-nosoupforyou,ou=groups,dc=example,dc=com' ... Use this example to enable LDAP debug logging. #ldapextras.yml --- ldap_extra_settings: GALAXY_LDAP_LOGGING: True ... Note If it is not practical to re-run setup.sh or if debug logging is enabled for a short time, you can add a line containing GALAXY_LDAP_LOGGING: True manually to the /etc/pulp/settings.py file on private automation hub. Restart both pulpcore-api.service and nginx.service for the changes to take effect. To avoid failures due to human error, use this method only when necessary. Use this example to configure LDAP caching by setting the variable AUTH_LDAP_CACHE_TIMEOUT . #ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_CACHE_TIMEOUT: 3600 ... Run setup.sh -e @ldapextras.yml during private automation hub installation. .Verification To verify you have set up correctly, confirm you can view all of your settings in the /etc/pulp/settings.py file on your private automation hub. 3.2. Running the Red Hat Ansible Automation Platform installer setup script After you update the inventory file with required parameters for installing your private automation hub, run the installer setup script. Procedure Run the setup.sh script USD sudo ./setup.sh Installation of Red Hat Ansible Automation Platform will begin. 3.3. Verifying installation of automation controller Verify that you installed automation controller successfully by logging in with the admin credentials you inserted in the inventory file. Procedure Navigate to the IP address specified for the automation controller node in the inventory file. Log in with the Admin credentials you set in the inventory file. Note The automation controller server is accessible from port 80 ( https://<CONTROLLER_SERVER_NAME>/ ) but redirects to port 443, so port 443 must also be available. Important If the installation fails and you are a customer who has purchased a valid license for Red Hat Ansible Automation Platform, contact Ansible through the Red Hat Customer portal . After a successful login to automation controller, your installation of Red Hat Ansible Automation Platform 2.3 is complete. 3.3.1. Additional automation controller configuration and resources See the following resources to explore additional automation controller configurations. Table 3.1. Resources to configure automation controller Resource link Description Automation Controller Quick Setup Guide Set up automation controller and run your first playbook Automation Controller Administration Guide Configure automation controller administration through customer scripts, management jobs, etc. Configuring proxy support for Red Hat Ansible Automation Platform Set up automation controller with a proxy server Managing usability analytics and data collection from automation controller Manage what automation controller information you share with Red Hat Automation Controller User Guide Review automation controller functionality in more detail 3.4. Verifying installation of automation hub Verify that you installed your automation hub successfully by logging in with the admin credentials you inserted into the inventory file. Procedure Navigate to the IP address specified for the automation hub node in the inventory file. Log in with the Admin credentials you set in the inventory file. Important If the installation fails and you are a customer who has purchased a valid license for Red Hat Ansible Automation Platform, contact Ansible through the Red Hat Customer portal . After a successful login to automation hub, your installation of Red Hat Ansible Automation Platform 2.3 is complete. 3.4.1. Additional automation hub configuration and resources See the following resources to explore additional automation hub configurations. Table 3.2. Resources to configure automation controller Resource link Description Managing user access in private automation hub Configure user access for automation hub Managing Red Hat Certified and Ansible Galaxy collections in automation hub Add content to your automation hub Publishing proprietary content collections in automation hub Publish internally developed collections on your automation hub 3.5. Post-installation steps Whether you are a new Ansible Automation Platform user looking to start automating, or an existing administrator looking to migrate old Ansible content to your latest installed version of Red Hat Ansible Automation Platform, explore the steps to begin leveraging the new features of Ansible Automation Platform 2.3: 3.5.1. Migrating data to Ansible Automation Platform 2.3 For platform administrators looking to complete an upgrade to the Ansible Automation Platform 2.3, there may be additional steps needed to migrate data to a new instance: 3.5.1.1. Migrating from legacy virtual environments (venvs) to automation execution environments Ansible Automation Platform 2.3 moves you away from custom Python virtual environments (venvs) in favor of automation execution environments - containerized images that packages the necessary components needed to execute and scale your Ansible automation. This includes Ansible Core, Ansible Content Collections, Python dependencies, Red Hat Enterprise Linux UBI 8, and any additional package dependencies. If you are looking to migrate your venvs to execution environments, you will (1) need to use the awx-manage command to list and export a list of venvs from your original instance, then (2) use ansible-builder to create execution environments. Additional resources Upgrading to Automation Execution Environments guide Creating and Consuming Execution Environments . 3.5.1.2. Migrating to Ansible Engine 2.9 images using Ansible Builder To migrate Ansible Engine 2.9 images for use with Ansible Automation Platform 2.3, the ansible-builder tool automates the process of rebuilding images (including its custom plugins and dependencies) for use with automation execution environments. Additional resources For more information on using Ansible Builder to build execution environments, see the Creating and Consuming Execution Environments . 3.5.1.3. Migrating to Ansible Core 2.13 When upgrading to Ansible Core 2.13, you need to update your playbooks, plugins, or other parts of your Ansible infrastructure in order to be supported by the latest version of Ansible Core. For instructions on updating your Ansible content for Ansible Core 2.13 compatibility, see the Ansible-core 2.13 Porting Guide . 3.5.2. Updating execution environment image locations If your private automation hub was installed separately, you can update your execution environment image locations to point to your private automation hub. Use this procedure to update your execution environment image locations. Procedure Navigate to the directory containing setup.sh Create ./group_vars/automationcontroller by running the following command: touch ./group_vars/automationcontroller Paste the following content into ./group_vars/automationcontroller , being sure to adjust the settings to fit your environment: # Automation Hub Registry registry_username: 'your-automation-hub-user' registry_password: 'your-automation-hub-password' registry_url: 'automationhub.example.org' registry_verify_ssl: False ## Execution Environments control_plane_execution_environment: 'automationhub.example.org/ee-supported-rhel8:latest' global_job_execution_environments: - name: "Default execution environment" image: "automationhub.example.org/ee-supported-rhel8:latest" - name: "Ansible Engine 2.9 execution environment" image: "automationhub.example.org/ee-29-rhel8:latest" - name: "Minimal execution environment" image: "automationhub.example.org/ee-minimal-rhel8:latest" Run the ./setup.sh script USD ./setup.sh Verification Log into Ansible Automation Platform as a user with system administrator access. Navigate to Administration Execution Environments . In the Image column, confirm that the execution environment image location has changed from the default value of <registry url>/ansible-automation-platform-<version>/<image name>:<tag> to <automation hub url>/<image name>:<tag> . 3.5.3. Scale up your automation using automation mesh The automation mesh component of the Red Hat Ansible Automation Platform simplifies the process of distributing automation across multi-site deployments. For enterprises with multiple isolated IT environments, automation mesh provides a consistent and reliable way to deploy and scale up automation across your execution nodes using a peer-to-peer mesh communication network. When upgrading from version 1.x to the latest version of the Ansible Automation Platform, you will need to migrate the data from your legacy isolated nodes into execution nodes necessary for automation mesh. You can implement automation mesh by planning out a network of hybrid and control nodes, then editing the inventory file found in the Ansible Automation Platform installer to assign mesh-related values to each of your execution nodes. For instructions on how to migrate from isolated nodes to execution nodes, see the Red Hat Ansible Automation Platform Upgrade and Migration Guide . For information about automation mesh and the various ways to design your automation mesh for your environment, see the Red Hat Ansible Automation Platform automation mesh guide .

Commands:
cd /opt/ansible-automation-platform/installer/
cd ansible-automation-platform-setup-bundle-<latest-version>
cd ansible-automation-platform-setup-<latest-version>
[automationcontroller] controller.acme.org [all:vars] admin_password='<password>' pg_host='' pg_port='5432' pg_database='awx' pg_username='awx' pg_password='<password>' pg_sslmode='prefer' # set to 'verify-full' for client-side enforced SSL registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' SSL-related variables If set, this will install a custom CA certificate to the system trust store. custom_ca_cert=/path/to/ca.crt Certificate and key to install in nginx for the web UI and API web_server_ssl_cert=/path/to/tower.cert web_server_ssl_key=/path/to/tower.key Server-side SSL settings for PostgreSQL (when we are installing it). postgres_use_ssl=False postgres_ssl_cert=/path/to/pgsql.crt postgres_ssl_key=/path/to/pgsql.key
[automationcontroller] controller.acme.org [database] data.acme.org [all:vars] admin_password='<password>' pg_host='data.acme.org' pg_port='5432' pg_database='awx' pg_username='awx' pg_password='<password>' pg_sslmode='prefer' # set to 'verify-full' for client-side enforced SSL registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' SSL-related variables If set, this will install a custom CA certificate to the system trust store. custom_ca_cert=/path/to/ca.crt Certificate and key to install in nginx for the web UI and API web_server_ssl_cert=/path/to/tower.cert web_server_ssl_key=/path/to/tower.key Server-side SSL settings for PostgreSQL (when we are installing it). postgres_use_ssl=False postgres_ssl_cert=/path/to/pgsql.crt postgres_ssl_key=/path/to/pgsql.key
[automationcontroller] controller.acme.org [database] [all:vars] admin_password='<password>' pg_host='data.acme.org' pg_port='5432' pg_database='awx' pg_username='awx' pg_password='<password>' pg_sslmode='prefer' # set to 'verify-full' for client-side enforced SSL registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' SSL-related variables If set, this will install a custom CA certificate to the system trust store. custom_ca_cert=/path/to/ca.crt Certificate and key to install in nginx for the web UI and API web_server_ssl_cert=/path/to/tower.cert web_server_ssl_key=/path/to/tower.key Server-side SSL settings for PostgreSQL (when we are installing it). postgres_use_ssl=False postgres_ssl_cert=/path/to/pgsql.crt postgres_ssl_key=/path/to/pgsql.key
Automation Controller Nodes There are two valid node_types that can be assigned for this group. A node_type=control implies that the node will only be able to run project and inventory updates, but not regular jobs. A node_type=hybrid will have the ability to run everything. If you do not define the node_type, it defaults to hybrid. # control.example node_type=control hybrid.example node_type=hybrid hybrid2.example <- this will default to hybrid [automationcontroller] controller1.acme.org node_type=control controller2.acme.org node_type=control Execution Nodes There are two valid node_types that can be assigned for this group. A node_type=hop implies that the node will forward jobs to an execution node. A node_type=execution implies that the node will be able to run jobs. If you do not define the node_type, it defaults to execution. # hop.example node_type=hop execution.example node_type=execution execution2.example <- this will default to execution [execution_nodes] execution1.acme.org node_type=execution execution2.acme.org node_type=execution [automationhub] automationhub.acme.org [database] data.acme.org [all:vars] admin_password='<password>' pg_host='data.acme.org' pg_port='5432' pg_database='awx' pg_username='awx' pg_password='<password>' pg_sslmode='prefer' # set to 'verify-full' for client-side enforced SSL registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' Receptor Configuration # receptor_listener_port=27199 Automation Hub Configuration # automationhub_admin_password='<password>' automationhub_pg_host='data.acme.org' automationhub_pg_port='5432' automationhub_pg_database='automationhub' automationhub_pg_username='automationhub' automationhub_pg_password='<password>' automationhub_pg_sslmode='prefer' The default install will deploy a TLS enabled Automation Hub. If for some reason this is not the behavior wanted one can disable TLS enabled deployment. # automationhub_disable_https = False The default install will generate self-signed certificates for the Automation Hub service. If you are providing valid certificate via automationhub_ssl_cert and automationhub_ssl_key, one should toggle that value to True. # automationhub_ssl_validate_certs = False SSL-related variables If set, this will install a custom CA certificate to the system trust store. custom_ca_cert=/path/to/ca.crt Certificate and key to install in nginx for the web UI and API web_server_ssl_cert=/path/to/tower.cert web_server_ssl_key=/path/to/tower.key Certificate and key to install in Automation Hub node automationhub_ssl_cert=/path/to/automationhub.cert automationhub_ssl_key=/path/to/automationhub.key Server-side SSL settings for PostgreSQL (when we are installing it). postgres_use_ssl=False postgres_ssl_cert=/path/to/pgsql.crt postgres_ssl_key=/path/to/pgsql.key
Automation Controller Nodes There are two valid node_types that can be assigned for this group. A node_type=control implies that the node will only be able to run project and inventory updates, but not regular jobs. A node_type=hybrid will have the ability to run everything. If you do not define the node_type, it defaults to hybrid. # control.example node_type=control hybrid.example node_type=hybrid hybrid2.example <- this will default to hybrid [automationcontroller] hybrid1.acme.org node_type=hybrid controller1.acme.org node_type=control Execution Nodes There are two valid node_types that can be assigned for this group. A node_type=hop implies that the node will forward jobs to an execution node. A node_type=execution implies that the node will be able to run jobs. If you do not define the node_type, it defaults to execution. # hop.example node_type=hop execution.example node_type=execution execution2.example <- this will default to execution [execution_nodes] hop1.acme.org node_type=hop execution1.acme.org node_type=execution [automationhub] automationhub.acme.org [database] [all:vars] admin_password='<password>' pg_host='data.acme.org' pg_port='5432' pg_database='awx' pg_username='awx' pg_password='<password>' pg_sslmode='prefer' # set to 'verify-full' for client-side enforced SSL registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' Receptor Configuration # receptor_listener_port=27199 Automation Hub Configuration # automationhub_admin_password='<password>' automationhub_pg_host='data.acme.org' automationhub_pg_port='5432' automationhub_pg_database='automationhub' automationhub_pg_username='automationhub' automationhub_pg_password='<password>' automationhub_pg_sslmode='prefer' The default install will deploy a TLS enabled Automation Hub. If for some reason this is not the behavior wanted one can disable TLS enabled deployment. # automationhub_disable_https = False The default install will generate self-signed certificates for the Automation Hub service. If you are providing valid certificate via automationhub_ssl_cert and automationhub_ssl_key, one should toggle that value to True. # automationhub_ssl_validate_certs = False SSL-related variables If set, this will install a custom CA certificate to the system trust store. custom_ca_cert=/path/to/ca.crt Certificate and key to install in nginx for the web UI and API web_server_ssl_cert=/path/to/tower.cert web_server_ssl_key=/path/to/tower.key Certificate and key to install in Automation Hub node automationhub_ssl_cert=/path/to/automationhub.cert automationhub_ssl_key=/path/to/automationhub.key Server-side SSL settings for PostgreSQL (when we are installing it). postgres_use_ssl=False postgres_ssl_cert=/path/to/pgsql.crt postgres_ssl_key=/path/to/pgsql.key
[automationcontroller] [automationhub] automationhub.acme.org ansible_connection=local [all:vars] registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' automationhub_admin_password= <PASSWORD> automationhub_pg_host='' automationhub_pg_port='5432' automationhub_pg_database='automationhub' automationhub_pg_username='automationhub' automationhub_pg_password=<PASSWORD> automationhub_pg_sslmode='prefer' The default install will deploy a TLS enabled Automation Hub. If for some reason this is not the behavior wanted one can disable TLS enabled deployment. # automationhub_disable_https = False The default install will generate self-signed certificates for the Automation Hub service. If you are providing valid certificate via automationhub_ssl_cert and automationhub_ssl_key, one should toggle that value to True. # automationhub_ssl_validate_certs = False SSL-related variables If set, this will install a custom CA certificate to the system trust store. custom_ca_cert=/path/to/ca.crt Certificate and key to install in Automation Hub node automationhub_ssl_cert=/path/to/automationhub.cert automationhub_ssl_key=/path/to/automationhub.key
[automationcontroller] [automationhub] automationhub.acme.org [database] data.acme.org [all:vars] registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' automationhub_admin_password= <PASSWORD> automationhub_pg_host='data.acme.org' automationhub_pg_port='5432' automationhub_pg_database='automationhub' automationhub_pg_username='automationhub' automationhub_pg_password=<PASSWORD> automationhub_pg_sslmode='prefer' The default install will deploy a TLS enabled Automation Hub. If for some reason this is not the behavior wanted one can disable TLS enabled deployment. # automationhub_disable_https = False The default install will generate self-signed certificates for the Automation Hub service. If you are providing valid certificate via automationhub_ssl_cert and automationhub_ssl_key, one should toggle that value to True. # automationhub_ssl_validate_certs = False SSL-related variables If set, this will install a custom CA certificate to the system trust store. custom_ca_cert=/path/to/ca.crt Certificate and key to install in Automation Hub node automationhub_ssl_cert=/path/to/automationhub.cert automationhub_ssl_key=/path/to/automationhub.key
[automationcontroller] [automationhub] automationhub.acme.org [database] [all:vars] registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' automationhub_admin_password= <PASSWORD> automationhub_pg_host='data.acme.org' automationhub_pg_port='5432' automationhub_pg_database='automationhub' automationhub_pg_username='automationhub' automationhub_pg_password=<PASSWORD> automationhub_pg_sslmode='prefer' The default install will deploy a TLS enabled Automation Hub. If for some reason this is not the behavior wanted one can disable TLS enabled deployment. # automationhub_disable_https = False The default install will generate self-signed certificates for the Automation Hub service. If you are providing valid certificate via automationhub_ssl_cert and automationhub_ssl_key, one should toggle that value to True. # automationhub_ssl_validate_certs = False SSL-related variables If set, this will install a custom CA certificate to the system trust store. custom_ca_cert=/path/to/ca.crt Certificate and key to install in Automation Hub node automationhub_ssl_cert=/path/to/automationhub.cert automationhub_ssl_key=/path/to/automationhub.key
automationhub_authentication_backend = "ldap" automationhub_ldap_server_uri = "ldap://ldap:389" (for LDAPs use automationhub_ldap_server_uri = "ldaps://ldap-server-fqdn") automationhub_ldap_bind_dn = "cn=admin,dc=ansible,dc=com" automationhub_ldap_bind_password = "GoodNewsEveryone" automationhub_ldap_user_search_base_dn = "ou=people,dc=ansible,dc=com" automationhub_ldap_group_search_base_dn = "ou=people,dc=ansible,dc=com"
auth_ldap_user_search_scope= 'SUBTREE' auth_ldap_user_search_filter= '(uid=%(user)s)' auth_ldap_group_search_scope= 'SUBTREE' auth_ldap_group_search_filter= '(objectClass=Group)' auth_ldap_group_type_class= 'django_auth_ldap.config:GroupOfNamesType'
#ldapextras.yml --- ldap_extra_settings: <LDAP_parameter>: <Values>
#ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_USER_FLAGS_BY_GROUP: {"is_superuser": "cn=pah-admins,ou=groups,dc=example,dc=com",}
#ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_USER_FLAGS_BY_GROUP: {"is_superuser": "cn=pah-admins,ou=groups,dc=example,dc=com",}
#ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_MIRROR_GROUPS: True
#ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_USER_ATTR_MAP: {"first_name": "givenName", "last_name": "sn", "email": "mail",}
#ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_REQUIRE_GROUP: 'cn=pah-nosoupforyou,ou=groups,dc=example,dc=com'
#ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_REQUIRE_GROUP: 'cn=pah-nosoupforyou,ou=groups,dc=example,dc=com'
#ldapextras.yml --- ldap_extra_settings: GALAXY_LDAP_LOGGING: True
#ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_CACHE_TIMEOUT: 3600
sudo ./setup.sh
touch ./group_vars/automationcontroller
Automation Hub Registry registry_username: 'your-automation-hub-user' registry_password: 'your-automation-hub-password' registry_url: 'automationhub.example.org' registry_verify_ssl: False ## Execution Environments control_plane_execution_environment: 'automationhub.example.org/ee-supported-rhel8:latest' global_job_execution_environments: - name: "Default execution environment" image: "automationhub.example.org/ee-supported-rhel8:latest" - name: "Ansible Engine 2.9 execution environment" image: "automationhub.example.org/ee-29-rhel8:latest" - name: "Minimal execution environment" image: "automationhub.example.org/ee-minimal-rhel8:latest"
./setup.sh