Chapter 2. Installing a high availability automation hub Configure the Ansible Automation Platform installer to install automation hub in a highly available (HA) configuration. Install HA automation hub on SELinux by creating mount points and adding the appropriate SELinux contexts to your Ansible Automation Platform environment. 2.1. Highly available automation hub installation Install a highly available automation hub by making the following changes to the inventory file in the Ansible Automation Platform installer, then running the ./setup.sh script: Specify database host IP Specify the IP address for your database host, using the automation_pg_host and automation_pg_port inventory variables. For example: automationhub_pg_host='192.0.2.10' automationhub_pg_port='5432' also specify the IP address for your database host in the [database] section, using the value in the automationhub_pg_host inventory variable: [database] 192.0.2.10 List all instances in a clustered setup If installing a clustered setup, replace localhost ansible_connection=local in the [automationhub] section with the hostname or IP of all instances. For example: [automationhub] automationhub1.testing.ansible.com ansible_user=cloud-user ansible_host=192.0.2.18 automationhub2.testing.ansible.com ansible_user=cloud-user ansible_host=192.0.2.20 automationhub3.testing.ansible.com ansible_user=cloud-user ansible_host=192.0.2.22 Red Hat Single Sign-On requirements If you are implementing Red Hat Single Sign-On on your automation hub environment, specify the main automation hub URL that clients will connect to, using the automationhub_main_url inventory variable. For example: automationhub_main_url = 'https://automationhub.ansible.com' Note If automationhub_main_url is not specified, the first node in the [automationhub] group will be used as default. 2.2. Install a high availability (HA) deployment of automation hub on SELinux To set up a high availability (HA) deployment of automation hub on SELinux, create two mount points for /var/lib/pulp and /var/lib/pulp/pulpcore_static , then assign the appropriate SELinux contexts to each. You must add the context for /var/lib/pulp/pulpcore_static and run the Ansible Automation Platform installer before adding the context for /var/lib/pulp . Prerequisites You have already configured a NFS export on your server. Pre-installation procedure Create a mount point at /var/lib/pulp : USD mkdir /var/lib/pulp/ Open /etc/fstab using a text editor, then add the following values: srv_rhel8:/data /var/lib/pulp nfs defaults,_netdev,nosharecache 0 0 srv_rhel8:/data/pulpcore_static /var/lib/pulp/pulpcore_static nfs defaults,_netdev,nosharecache,context="system_u:object_r:httpd_sys_content_rw_t:s0" 0 0 Run the mount command for /var/lib/pulp : USD mount /var/lib/pulp Create a mount point at /var/lib/pulp/pulpcore_static : USD mkdir /var/lib/pulp/pulpcore_static Run the mount command: USD mount -a With the mount points set up, run the Ansible Automation Platform installer: USD setup.sh -- -b --become-user root Once the installation is complete, unmount the /var/lib/pulp/ mount point then apply the appropriate SELinux context: Post-installation procedure Shut down the Pulp service: USD systemctl stop pulpcore.service Unmount /var/lib/pulp/pulpcore_static : USD umount /var/lib/pulp/pulpcore_static Unmount /var/lib/pulp/ : USD umount /var/lib/pulp/ Open /etc/fstab using a text editor, then replace the existing value for /var/lib/pulp with the following: srv_rhel8:/data /var/lib/pulp nfs defaults,_netdev,nosharecache,context="system_u:object_r:pulpcore_var_lib_t:s0" 0 0 Run the mount command: USD mount -a Configure pulpcore.service: With the two mount points set up, shut down the Pulp service to configure pulpcore.service : USD systemctl stop pulpcore.service Edit pulpcore.service using systemctl : USD systemctl edit pulpcore.service Add the following entry to pulpcore.service to ensure that automation hub services starts only after starting the network and mounting the remote mount points: [Unit] After=network.target var-lib-pulp.mount Enable remote-fs.target : USD systemctl enable remote-fs.target Reboot the system: USD systemctl reboot Troubleshooting A bug in the pulpcore SELinux policies can cause the token authentication public/private keys in etc/pulp/certs/ to not have the proper SELinux labels, causing the pulp process to fail. When this occurs, run the following command to temporarily attach the proper labels: USD chcon system_u:object_r:pulpcore_etc_t:s0 /etc/pulp/certs/token_{private,public}_key.pem Note You must repeat this command to reattach the proper SELinux labels whenever you relabel your system. Additional Resources See the SELinux Requirements on the Pulp Project documentation for a list of SELinux contexts. See the Filesystem Layout information for a full description of Pulp folders.

Commands:
automationhub_pg_host='192.0.2.10' automationhub_pg_port='5432'
[database] 192.0.2.10
[automationhub] automationhub1.testing.ansible.com ansible_user=cloud-user ansible_host=192.0.2.18 automationhub2.testing.ansible.com ansible_user=cloud-user ansible_host=192.0.2.20 automationhub3.testing.ansible.com ansible_user=cloud-user ansible_host=192.0.2.22
automationhub_main_url = 'https://automationhub.ansible.com'
mkdir /var/lib/pulp/
srv_rhel8:/data /var/lib/pulp nfs defaults,_netdev,nosharecache 0 0 srv_rhel8:/data/pulpcore_static /var/lib/pulp/pulpcore_static nfs defaults,_netdev,nosharecache,context="system_u:object_r:httpd_sys_content_rw_t:s0" 0 0
mount /var/lib/pulp
mkdir /var/lib/pulp/pulpcore_static
mount -a
setup.sh -- -b --become-user root
systemctl stop pulpcore.service
umount /var/lib/pulp/pulpcore_static
umount /var/lib/pulp/
srv_rhel8:/data /var/lib/pulp nfs defaults,_netdev,nosharecache,context="system_u:object_r:pulpcore_var_lib_t:s0" 0 0
mount -a
systemctl stop pulpcore.service
systemctl edit pulpcore.service
[Unit] After=network.target var-lib-pulp.mount
systemctl enable remote-fs.target
systemctl reboot
chcon system_u:object_r:pulpcore_etc_t:s0 /etc/pulp/certs/token_{private,public}_key.pem