Red Hat Ansible Automation Platform installation guide Red Hat Ansible Automation Platform 2.4 Install Ansible Automation Platform Red Hat Customer Content Services

Commands:
dnf install firewalld
firewall-cmd --permanent --add-service=<service>
firewall-cmd --reload
psql -h <db.example.com> -U superuser -p 5432 -d postgres <Password for user superuser>:
-h hostname --host=hostname
-d dbname --dbname=dbname
-U username --username=username
[database] pg_host='db.example.com' pg_port=5432 pg_database='awx' pg_username='awx' pg_password='redhat'
psql -d <automation hub database> -c "SELECT * FROM pg_available_extensions WHERE name='hstore'"
name | default_version | installed_version |comment ------+-----------------+-------------------+--------------------------------------------------- hstore | 1.7 | | data type for storing sets of (key, value) pairs (1 row)
name | default_version | installed_version | comment ------+-----------------+-------------------+--------- (0 rows)
dnf install postgresql-contrib
psql -d <automation hub database> -c "CREATE EXTENSION hstore;"
CREATE EXTENSION
name | default_version | installed_version | comment -----+-----------------+-------------------+------------------------------------------------------ hstore | 1.7 | 1.7 | data type for storing sets of (key, value) pairs (1 row)
yum -y install fio
fio --name=write_iops --directory=/tmp --numjobs=3 --size=10G --time_based --runtime=60s --ramp_time=2s --ioengine=libaio --direct=1 --verify=0 --bs=4K --iodepth=64 --rw=randwrite --group_reporting=1 > /tmp/fio_benchmark_write_iops.log 2>> /tmp/fio_write_iops_error.log
fio --name=read_iops --directory=/tmp --numjobs=3 --size=10G --time_based --runtime=60s --ramp_time=2s --ioengine=libaio --direct=1 --verify=0 --bs=4K --iodepth=64 --rw=randread --group_reporting=1 > /tmp/fio_benchmark_read_iops.log 2>> /tmp/fio_read_iops_error.log
cat /tmp/fio_benchmark_read_iops.log read_iops: (g=0): rw=randread, bs=(R) 4096B-4096B, (W) 4096B-4096B, (T) 4096B-4096B, ioengine=libaio, iodepth=64 [...] iops : min=50879, max=61603, avg=56221.33, stdev=679.97, samples=360 [...]
cd /opt/ansible-automation-platform/installer/
cd ansible-automation-platform-setup-bundle-<latest-version>
cd ansible-automation-platform-setup-<latest-version>
[automationcontroller] controller.example.com [database] data.example.com [all:vars] admin_password='<password>' pg_host='data.example.com' pg_port=5432 pg_database='awx' pg_username='awx' pg_password='<password>' pg_sslmode='prefer' # set to 'verify-full' for client-side enforced SSL registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' SSL-related variables If set, this will install a custom CA certificate to the system trust store. custom_ca_cert=/path/to/ca.crt Certificate and key to install in nginx for the web UI and API web_server_ssl_cert=/path/to/tower.cert web_server_ssl_key=/path/to/tower.key Server-side SSL settings for PostgreSQL (when we are installing it). postgres_use_ssl=False postgres_ssl_cert=/path/to/pgsql.crt postgres_ssl_key=/path/to/pgsql.key
[automationcontroller] controller.example.com [automationhub] automationhub.example.com [database] data.example.com [all:vars] admin_password='<password>' pg_host='data.example.com' pg_port='5432' pg_database='awx' pg_username='awx' pg_password='<password>' pg_sslmode='prefer' # set to 'verify-full' for client-side enforced SSL registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' automationhub_admin_password= <PASSWORD> automationhub_pg_host='data.example.com' automationhub_pg_port=5432 automationhub_pg_database='automationhub' automationhub_pg_username='automationhub' automationhub_pg_password=<PASSWORD> automationhub_pg_sslmode='prefer' The default install will deploy a TLS enabled Automation Hub. If for some reason this is not the behavior wanted one can disable TLS enabled deployment. # automationhub_disable_https = False The default install will generate self-signed certificates for the Automation Hub service. If you are providing valid certificate via automationhub_ssl_cert and automationhub_ssl_key, one should toggle that value to True. # automationhub_ssl_validate_certs = False SSL-related variables If set, this will install a custom CA certificate to the system trust store. custom_ca_cert=/path/to/ca.crt Certificate and key to install in Automation Hub node automationhub_ssl_cert=/path/to/automationhub.cert automationhub_ssl_key=/path/to/automationhub.key Certificate and key to install in nginx for the web UI and API web_server_ssl_cert=/path/to/tower.cert web_server_ssl_key=/path/to/tower.key Server-side SSL settings for PostgreSQL (when we are installing it). postgres_use_ssl=False postgres_ssl_cert=/path/to/pgsql.crt postgres_ssl_key=/path/to/pgsql.key
automationhub_pg_host='192.0.2.10' automationhub_pg_port=5432
[database] 192.0.2.10
[automationhub] automationhub1.testing.ansible.com ansible_user=cloud-user ansible_host=192.0.2.18 automationhub2.testing.ansible.com ansible_user=cloud-user ansible_host=192.0.2.20 automationhub3.testing.ansible.com ansible_user=cloud-user ansible_host=192.0.2.22
USE_X_FORWARDED_PORT = True USE_X_FORWARDED_HOST = True
mkdir /var/lib/pulp/
srv_rhel8:/data /var/lib/pulp nfs defaults,_netdev,nosharecache,context="system_u:object_r:var_lib_t:s0" 0 0 srv_rhel8:/data/pulpcore_static /var/lib/pulp/pulpcore_static nfs defaults,_netdev,nosharecache,context="system_u:object_r:httpd_sys_content_rw_t:s0" 0 0
systemctl daemon-reload
mount /var/lib/pulp
mkdir /var/lib/pulp/pulpcore_static
mount -a
setup.sh -- -b --become-user root
systemctl stop pulpcore.service
systemctl edit pulpcore.service
[Unit] After=network.target var-lib-pulp.mount
systemctl enable remote-fs.target
systemctl reboot
chcon system_u:object_r:pulpcore_etc_t:s0 /etc/pulp/certs/token_{private,public}_key.pem
systemctl stop pulpcore.service
umount /var/lib/pulp/pulpcore_static
umount /var/lib/pulp/
srv_rhel8:/data /var/lib/pulp nfs defaults,_netdev,nosharecache,context="system_u:object_r:pulpcore_var_lib_t:s0" 0 0
mount -a
file: filename
signature: filename.asc
#!/usr/bin/env bash FILE_PATH=USD1 SIGNATURE_PATH="USD1.asc" ADMIN_ID="USDPULP_SIGNING_KEY_FINGERPRINT" PASSWORD="password" Create a detached signature gpg --quiet --batch --pinentry-mode loopback --yes --passphrase USDPASSWORD --homedir ~/.gnupg/ --detach-sign --default-key USDADMIN_ID --armor --output USDSIGNATURE_PATH USDFILE_PATH Check the exit status STATUS=USD? if [ USDSTATUS -eq 0 ]; then echo {\"file\": \"USDFILE_PATH\", \"signature\": \"USDSIGNATURE_PATH\"} else exit USDSTATUS fi
[all:vars] . . . automationhub_create_default_collection_signing_service = True automationhub_auto_sign_collections = True automationhub_require_content_approval = True automationhub_collection_signing_service_key = /abs/path/to/galaxy_signing_service.gpg automationhub_collection_signing_service_script = /abs/path/to/collection_signing.sh
automationhub_authentication_backend = "ldap" automationhub_ldap_server_uri = "ldap://ldap:389" (for LDAPs use automationhub_ldap_server_uri = "ldaps://ldap-server-fqdn") automationhub_ldap_bind_dn = "cn=admin,dc=ansible,dc=com" automationhub_ldap_bind_password = "GoodNewsEveryone" automationhub_ldap_user_search_base_dn = "ou=people,dc=ansible,dc=com" automationhub_ldap_group_search_base_dn = "ou=people,dc=ansible,dc=com"
auth_ldap_user_search_scope= 'SUBTREE' auth_ldap_user_search_filter= '(uid=%(user)s)' auth_ldap_group_search_scope= 'SUBTREE' auth_ldap_group_search_filter= '(objectClass=Group)' auth_ldap_group_type_class= 'django_auth_ldap.config:GroupOfNamesType'
#ldapextras.yml --- ldap_extra_settings: <LDAP_parameter>: <Values>
#ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_USER_FLAGS_BY_GROUP: {"is_superuser": "cn=pah-admins,ou=groups,dc=example,dc=com",}
#ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_USER_FLAGS_BY_GROUP: {"is_superuser": "cn=pah-admins,ou=groups,dc=example,dc=com",}
#ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_MIRROR_GROUPS: True
#ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_USER_ATTR_MAP: {"first_name": "givenName", "last_name": "sn", "email": "mail",}
#ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_REQUIRE_GROUP: 'cn=pah-nosoupforyou,ou=groups,dc=example,dc=com'
#ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_DENY_GROUP: 'cn=pah-nosoupforyou,ou=groups,dc=example,dc=com'
#ldapextras.yml --- ldap_extra_settings: GALAXY_LDAP_LOGGING: True
#ldapextras.yml --- ldap_extra_settings: AUTH_LDAP_CACHE_TIMEOUT: 3600
Operation unavailable without authentication
GALAXY_LDAP_DISABLE_REFERRALS = true
[automationcontroller] controller.example.com [automationhub] automationhub.example.com [automationedacontroller] automationedacontroller.example.com [database] data.example.com [all:vars] admin_password='<password>' pg_host='data.example.com' pg_port='5432' pg_database='awx' pg_username='awx' pg_password='<password>' pg_sslmode='prefer' # set to 'verify-full' for client-side enforced SSL registry_url='registry.redhat.io' registry_username='<registry username>' registry_password='<registry password>' Automation hub configuration automationhub_admin_password= <PASSWORD> automationhub_pg_host='data.example.com' automationhub_pg_port=5432 automationhub_pg_database='automationhub' automationhub_pg_username='automationhub' automationhub_pg_password=<PASSWORD> automationhub_pg_sslmode='prefer' Automation Event-Driven Ansible controller configuration automationedacontroller_admin_password='<eda-password>' automationedacontroller_pg_host='data.example.com' automationedacontroller_pg_port=5432 automationedacontroller_pg_database='automationedacontroller' automationedacontroller_pg_username='automationedacontroller' automationedacontroller_pg_password='<password>' Keystore file to install in SSO node sso_custom_keystore_file='/path/to/sso.jks' This install will deploy SSO with sso_use_https=True Keystore password is required for https enabled SSO sso_keystore_password='' This install will deploy a TLS enabled Automation Hub. If for some reason this is not the behavior wanted one can disable TLS enabled deployment. # automationhub_disable_https = False The default install will generate self-signed certificates for the Automation Hub service. If you are providing valid certificate via automationhub_ssl_cert and automationhub_ssl_key, one should toggle that value to True. # automationhub_ssl_validate_certs = False SSL-related variables If set, this will install a custom CA certificate to the system trust store. custom_ca_cert=/path/to/ca.crt Certificate and key to install in Automation Hub node automationhub_ssl_cert=/path/to/automationhub.cert automationhub_ssl_key=/path/to/automationhub.key Certificate and key to install in nginx for the web UI and API web_server_ssl_cert=/path/to/tower.cert web_server_ssl_key=/path/to/tower.key Server-side SSL settings for PostgreSQL (when we are installing it). postgres_use_ssl=False postgres_ssl_cert=/path/to/pgsql.crt postgres_ssl_key=/path/to/pgsql.key Boolean flag used to verify Automation Controller's web certificates when making calls from Automation Event-Driven Ansible controller. automationedacontroller_controller_verify_ssl = true # Certificate and key to install in Automation Event-Driven Ansible controller node automationedacontroller_ssl_cert=/path/to/automationeda.crt automationedacontroller_ssl_key=/path/to/automationeda.key
automationedacontroller_safe_plugins: "ansible.eda.webhook, ansible.eda.alertmanager"
sudo ./setup.sh
subscription-manager repos --enable rhel-8-for-x86_64-baseos-rpms --enable rhel-8-for-x86_64-appstream-rpms
dnf install yum-utils reposync -m --download-metadata --gpgcheck -p /path/to/download
sudo dnf install httpd
/etc/httpd/conf.d/repository.conf DocumentRoot '/path/to/repos' <LocationMatch "^/+USD"> Options -Indexes ErrorDocument 403 /.noindex.html </LocationMatch> <Directory '/path/to/repos'> Options All Indexes FollowSymLinks AllowOverride None Require all granted </Directory>
sudo chown -R apache /path/to/repos
sudo semanage fcontext -a -t httpd_sys_content_t "/path/to/repos(/.*)?" sudo restorecon -ir /path/to/repos
sudo systemctl enable --now httpd.service
sudo firewall-cmd --zone=public --add-service=http -add-service=https --permanent sudo firewall-cmd --reload
[Local-BaseOS] name=Local BaseOS baseurl=http://<webserver_fqdn>/rhel-8-for-x86_64-baseos-rpms enabled=1 gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release [Local-AppStream] name=Local AppStream baseurl=http://<webserver_fqdn>/rhel-8-for-x86_64-appstream-rpms enabled=1 gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
mkdir /media/rheldvd && mount /dev/sr0 /media/rheldvd
mkdir /media/rheldvd && mount -o loop rhrhel-8.6-x86_64-dvd.iso /media/rheldvd
[dvd-BaseOS] name=DVD for RHEL - BaseOS baseurl=file:///media/rheldvd/BaseOS enabled=1 gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release [dvd-AppStream] name=DVD for RHEL - AppStream baseurl=file:///media/rheldvd/AppStream enabled=1 gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
rpm --import /media/rheldvd/RPM-GPG-KEY-redhat-release
Curl error (6): Couldn't resolve host name for https://www.redhat.com/security/data/fd431d51.txt [Could not resolve host: www.redhat.com]
tar xvf ansible-automation-platform-setup-bundle-2.4-1.tar.gz cd ansible-automation-platform-setup-bundle-2.4-1
[automationcontroller] automationcontroller.example.org ansible_connection=local [automationcontroller:vars] peers=execution_nodes [automationhub] automationhub.example.org [all:vars] admin_password='password123' pg_database='awx' pg_username='awx' pg_password='dbpassword123' receptor_listener_port=27199 automationhub_admin_password='hubpassword123' automationhub_pg_host='automationcontroller.example.org' automationhub_pg_port=5432 automationhub_pg_database='automationhub' automationhub_pg_username='automationhub' automationhub_pg_password='dbpassword123' automationhub_pg_sslmode='prefer'
sudo -i cd /path/to/ansible-automation-platform-setup-bundle-2.4-1 ./setup.sh
cp /etc/pulp/certs/root.crt /etc/pki/ca-trust/source/anchors/automationhub-root.crt update-ca-trust
[galaxy] server_list = private_hub [galaxy_server.private_hub] url=https://<hub_fqdn>/api/galaxy/ token=<token_from_private_hub>
ansible-galaxy collection publish <collection_tarball>
podman image save localhost/custom-ee:latest | gzip -c custom-ee-latest.tar.gz
podman image load -i custom-ee-latest.tar.gz podman image tag localhost/custom-ee <hub_fqdn>/custom-ee:latest podman login <hub_fqdn> --tls-verify=false podman push <hub_fqdn>/custom-ee:latest
tar -xzvf ansible-automation-platform-setup-bundle-2.4-3-x86_64.tar.gz cd ansible-automation-platform-setup-bundle-2.4-3-x86_64/bundle/packages/el8/repos/ sudo dnf install ansible-builder-3.0.0-2.el8ap.noarch.rpm python39-requirements-parser-0.2.0-4.el8ap.noarch.rpm python39-bindep-2.10.2-3.el8ap.noarch.rpm python39-jsonschema-4.16.0-1.el8ap.noarch.rpm python39-pbr-5.8.1-2.el8ap.noarch.rpm python39-distro-1.6.0-3.el8pc.noarch.rpm python39-packaging-21.3-2.el8ap.noarch.rpm python39-parsley-1.3-2.el8pc.noarch.rpm python39-attrs-21.4.0-2.el8pc.noarch.rpm python39-pyrsistent-0.18.1-2.el8ap.x86_64.rpm python39-pyparsing-3.0.9-1.el8ap.noarch.rpm
mkdir USDHOME/custom-ee USDHOME/custom-ee/files cd USDHOME/custom-ee/
cat execution-environment.yml --- version: 3 images: base_image: name: private-hub.example.com/ee-minimal-rhel8:latest dependencies: python: requirements.txt galaxy: requirements.yml additional_build_files: - src: files/ansible.cfg dest: configs - src: files/pip.conf dest: configs - src: files/hub-ca.crt dest: configs # uncomment if custom RPM repositories are required #- src: files/custom.repo # dest: configs additional_build_steps: prepend_base: # copy a custom pip.conf to override the location of the PyPI content - ADD _build/configs/pip.conf /etc/pip.conf # remove the default UBI repository definition - RUN rm -f /etc/yum.repos.d/ubi.repo # copy the hub CA certificate and update the trust store - ADD _build/configs/hub-ca.crt /etc/pki/ca-trust/source/anchors - RUN update-ca-trust # if needed, uncomment to add a custom RPM repository configuration #- ADD _build/configs/custom.repo /etc/yum.repos.d/custom.repo prepend_galaxy: - ADD _build/configs/ansible.cfg ~/.ansible.cfg
cat files/ansible.cfg [galaxy] server_list = private_hub [galaxy_server.private_hub] url = https://private-hub.example.com/api/galaxy/
cat files/pip.conf [global] index-url = https://<pypi_mirror_fqdn>/ trusted-host = <pypi_mirror_fqdn>
cat files/custom.repo [ubi-8-baseos] name = Red Hat Universal Base Image 8 (RPMs) - BaseOS baseurl = http://<ubi_mirror_fqdn>/repos/ubi-8-baseos enabled = 1 gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release gpgcheck = 1 [ubi-8-appstream] name = Red Hat Universal Base Image 8 (RPMs) - AppStream baseurl = http://<ubi_mirror_fqdn>/repos/ubi-8-appstream enabled = 1 gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release gpgcheck = 1
cd USDHOME/custom-ee tree . . ├── bindep.txt ├── execution-environment.yml ├── files │ ├── ansible.cfg │ ├── custom.repo │ ├── hub-ca.crt │ └── pip.conf ├── requirements.txt └── requirements.yml 1 directory, 8 files
export ANSIBLE_GALAXY_SERVER_PRIVATE_HUB_TOKEN=<your_token>
cd USDHOME/custom-ee ansible-builder build -f execution-environment.yml -t private-hub.example.com/custom-ee:latest -v 3
podman pull private-hub.example.com/ee-minimal-rhel8:latest --tls-verify=false
sudo mkdir /etc/containers/certs.d/private-hub.example.com sudo cp USDHOME/custom-ee/files/hub-ca.crt /etc/containers/certs.d/private-hub.example.com
podman images --format "table {{.ID}} {{.Repository}} {{.Tag}}" IMAGE ID REPOSITORY TAG b38e3299a65e private-hub.example.com/custom-ee latest 8e38be53b486 private-hub.example.com/ee-minimal-rhel8 latest
podman login private-hub.example.com -u admin Password: Login Succeeded! podman push private-hub.example.com/custom-ee:latest
ls -1F ansible-automation-platform-setup-bundle-2.2.0-7/ ansible-automation-platform-setup-bundle-2.2.0-7.tar.gz ansible-automation-platform-setup-bundle-2.3-1.2/ ansible-automation-platform-setup-bundle-2.3-1.2.tar.gz
cd ansible-automation-platform-setup-bundle-2.2.0-7 sudo ./setup.sh -b cd ..
cd ansible-automation-platform-setup-bundle-2.2.0-7 cp inventory ../ansible-automation-platform-setup-bundle-2.3-1.2/ cd ..
cd ansible-automation-platform-setup-bundle-2.3-1.2 sudo ./setup.sh