Chapter 3. Installing and configuring automation controller on Red Hat OpenShift Container Platform web console You can use these instructions to install the automation controller operator on Red Hat OpenShift Container Platform, specify custom resources, and deploy Ansible Automation Platform with an external database. Automation controller configuration can be done through the automation controller extra_settings or directly in the user interface after deployment. However, it is important to note that configurations made in extra_settings take precedence over settings made in the user interface. Note When an instance of automation controller is removed, the associated PVCs are not automatically deleted. This can cause issues during migration if the new deployment has the same name as the one. Therefore, it is recommended that you manually remove old PVCs before deploying a new automation controller instance in the same namespace. See Finding and deleting PVCs for more information. 3.1. Prerequisites You have installed the Red Hat Ansible Automation Platform catalog in Operator Hub. For Controller, a default StorageClass must be configured on the cluster for the operator to dynamically create needed PVCs. This is not necessary if an external PostgreSQL database is configured. For Hub a StorageClass that supports ReadWriteMany must be available on the cluster to dynamically created the PVC needed for the content, redis and api pods. If it is not the default StorageClass on the cluster, you can specify it when creating your AutomationHub object. 3.2. Installing the automation controller operator Use this procedure to install the automation controller operator. Procedure Navigate to Operators Installed Operators , then click on the Ansible Automation Platform operator. Locate the Automation controller tab, then click Create instance . You can proceed with configuring the instance using either the Form View or YAML view. 3.2.1. Creating your automation controller form-view Use this procedure to create your automation controller using the form-view. Procedure Ensure Form view is selected. It should be selected by default. Enter the name of the new controller. Optional: Add any labels necessary. Click Advanced configuration . Enter Hostname of the instance. The hostname is optional. The default hostname will be generated based upon the deployment name you have selected. Enter the Admin account username . Enter the Admin email address . From the Admin password secret drop-down menu, select the secret. From the Database configuration secret drop-down menu, select the secret. From the Old Database configuration secret drop-down menu, select the secret. From the Secret key secret drop-down menu, select the secret. From the Broadcast Websocket Secret drop-down menu, select the secret. Enter any Service Account Annotations necessary. From the PostgreSQL Container Storage Requirements drop down menu, select requests and enter "100Gi" in the storage field. Click Create . 3.2.2. Configuring your controller image pull policy Use this procedure to configure the image pull policy on your automation controller. Procedure Log in to Red Hat OpenShift Container Platform. Go to Operators Installed Operators . Select your Ansible Automation Platform Operator deployment. Select the Automation Controller tab. For new instances, click Create AutomationController . For existing instances, you can edit the YAML view by clicking the ... icon and then Edit AutomationController . Click advanced Configuration . Under Image Pull Policy , click on the radio button to select Always Never IfNotPresent To display the option under Image Pull Secrets , click the arrow. Click + beside Add Image Pull Secret and enter a value. To display fields under the Web container resource requirements drop-down list, click the arrow. Under Limits , and Requests , enter values for CPU cores , Memory , and Storage . To display fields under the Task container resource requirements drop-down list, click the arrow. Under Limits , and Requests , enter values for CPU cores , Memory , and Storage . To display fields under the EE Control Plane container resource requirements drop-down list, click the arrow. Under Limits , and Requests , enter values for CPU cores , Memory , and Storage . To display fields under the PostgreSQL init container resource requirements (when using a managed service) drop-down list, click the arrow. Under Limits , and Requests , enter values for CPU cores , Memory , and Storage . To display fields under the Redis container resource requirements drop-down list, click the arrow. Under Limits , and Requests , enter values for CPU cores , Memory , and Storage . To display fields under the PostgreSQL container resource requirements (when using a managed instance) * drop-down list, click the arrow. Under Limits , and Requests , enter values for CPU cores , Memory , and Storage . To display the PostgreSQL container storage requirements (when using a managed instance) drop-down list, click the arrow. Under Limits , and Requests , enter values for CPU cores , Memory , and Storage . Note Red Hat recommends using 100Gi for your storage requirements to prevent undersized databases in your production deployments. Under Replicas, enter the number of instance replicas. Under Remove used secrets on instance removal , select true or false . The default is false. Under Preload instance with data upon creation , select true or false . The default is true. 3.2.3. Configuring your controller LDAP security Use this procedure to configure LDAP security for your automation controller. Procedure If you do not have a ldap_cacert_secret , you can create one with the following command: USD oc create secret generic <resourcename>-custom-certs \ --from-file=ldap-ca.crt=<PATH/TO/YOUR/CA/PEM/FILE> \ 1 1 Modify this to point to where your CA cert is stored. This will create a secret that looks like this: USD oc get secret/mycerts -o yaml apiVersion: v1 data: ldap-ca.crt: <mysecret> 1 kind: Secret metadata: name: mycerts namespace: awx type: Opaque 1 Automation controller looks for the data field ldap-ca.crt in the specified secret when using the ldap_cacert_secret . Under LDAP Certificate Authority Trust Bundle click the drop-down menu and select your ldap_cacert_secret . Under LDAP Password Secret , click the drop-down menu and select a secret. Under EE Images Pull Credentials Secret , click the drop-down menu and select a secret. Under Bundle Cacert Secret , click the drop-down menu and select a secret. Under Service Type , click the drop-down menu and select ClusterIP LoadBalancer NodePort 3.2.4. Configuring your automation controller operator route options The Red Hat Ansible Automation Platform operator installation form allows you to further configure your automation controller operator route options under Advanced configuration . Procedure Log in to Red Hat OpenShift Container Platform. Navigate to Operators Installed Operators . Select your Ansible Automation Platform Operator deployment. Select the Automation Controller tab. For new instances, click Create AutomationController . For existing instances, you can edit the YAML view by clicking the ... icon and then Edit AutomationController . Click Advanced configuration . Under Ingress type , click the drop-down menu and select Route . Under Route DNS host , enter a common host name that the route answers to. Under Route TLS termination mechanism , click the drop-down menu and select Edge or Passthrough . For most instances Edge should be selected. Under Route TLS credential secret , click the drop-down menu and select a secret from the list. Under Enable persistence for /var/lib/projects directory select either true or false by moving the slider. 3.2.5. Configuring the Ingress type for your automation controller operator The Ansible Automation Platform Operator installation form allows you to further configure your automation controller operator ingress under Advanced configuration . Procedure Log in to Red Hat OpenShift Container Platform. Navigate to Operators Installed Operators . Select your Ansible Automation Platform Operator deployment. Select the Automation Controller tab. For new instances, click Create AutomationController . For existing instances, you can edit the YAML view by clicking the ... icon and then Edit AutomationController . Click Advanced configuration . Under Ingress type , click the drop-down menu and select Ingress . Under Ingress annotations , enter any annotations to add to the ingress. Under Ingress TLS secret , click the drop-down menu and select a secret from the list. After you have configured your automation controller operator, click Create at the bottom of the form view. Red Hat OpenShift Container Platform will now create the pods. This may take a few minutes. You can view the progress by navigating to Workloads Pods and locating the newly created instance. Verification Verify that the following operator pods provided by the Ansible Automation Platform Operator installation from automation controller are running: Operator manager controllers automation controller automation hub The operator manager controllers for each of the 3 operators, include the following: automation-controller-operator-controller-manager automation-hub-operator-controller-manager resource-operator-controller-manager After deploying automation controller, you will see the addition of these pods: controller controller-postgres After deploying automation hub, you will see the addition of these pods: hub-api hub-content hub-postgres hub-redis hub-worker Note A missing pod can indicate the need for a pull secret. Pull secrets are required for protected or private image registries. See Using image pull secrets for more information. You can diagnose this issue further by running oc describe pod <pod-name> to see if there is an ImagePullBackOff error on that pod. 3.3. Configuring an external database for automation controller on Red Hat Ansible Automation Platform Operator For users who prefer to deploy Ansible Automation Platform with an external database, they can do so by configuring a secret with instance credentials and connection information, then applying it to their cluster using the oc create command. By default, the Ansible Automation Platform Operator automatically creates and configures a managed PostgreSQL pod in the same namespace as your Ansible Automation Platform deployment. You can deploy Ansible Automation Platform with an external database instead of the managed PostgreSQL pod that the Ansible Automation Platform Operator automatically creates. Using an external database lets you share and reuse resources and manually manage backups, upgrades, and performance optimizations. Note The same external database (PostgreSQL instance) can be used for both automation hub and automation controller as long as the database names are different. In other words, you can have multiple databases with different names inside a single PostgreSQL instance. The following section outlines the steps to configure an external database for your automation controller on a Ansible Automation Platform Operator. Prerequisite The external database must be a PostgreSQL database that is the version supported by the current release of Ansible Automation Platform. Note Ansible Automation Platform 2.4 supports PostgreSQL 13. Procedure The external postgres instance credentials and connection information must be stored in a secret, which is then set on the automation controller spec. Create a postgres_configuration_secret .yaml file, following the template below: apiVersion: v1 kind: Secret metadata: name: external-postgres-configuration namespace: <target_namespace> 1 stringData: host: "<external_ip_or_url_resolvable_by_the_cluster>" 2 port: "<external_port>" 3 database: "<desired_database_name>" username: "<username_to_connect_as>" password: "<password_to_connect_with>" 4 sslmode: "prefer" 5 type: "unmanaged" type: Opaque 1 Namespace to create the secret in. This should be the same namespace you want to deploy to. 2 The resolvable hostname for your database node. 3 External port defaults to 5432 . 4 Value for variable password should not contain single or double quotes (', ") or backslashes (\) to avoid any issues during deployment, backup or restoration. 5 The variable sslmode is valid for external databases only. The allowed values are: prefer , disable , allow , require , verify-ca , and verify-full . Apply external-postgres-configuration-secret.yml to your cluster using the oc create command. USD oc create -f external-postgres-configuration-secret.yml When creating your AutomationController custom resource object, specify the secret on your spec, following the example below: apiVersion: automationcontroller.ansible.com/v1beta1 kind: AutomationController metadata: name: controller-dev spec: postgres_configuration_secret: external-postgres-configuration 3.4. Finding and deleting PVCs A persistent volume claim (PVC) is a storage volume used to store data that automation hub and automation controller applications use. These PVCs are independent from the applications and remain even when the application is deleted. If you are confident that you no longer need a PVC, or have backed it up elsewhere, you can manually delete them. Procedure List the existing PVCs in your deployment namespace: oc get pvc -n <namespace> Identify the PVC associated with your deployment by comparing the old deployment name and the PVC name. Delete the old PVC: oc delete pvc -n <namespace> <pvc-name> 3.5. Additional resources For more information on running operators on OpenShift Container Platform, navigate to the OpenShift Container Platform product documentation and click the Operators - Working with Operators in OpenShift Container Platform guide.

Commands:
oc create secret generic <resourcename>-custom-certs --from-file=ldap-ca.crt=<PATH/TO/YOUR/CA/PEM/FILE> \ 1
oc get secret/mycerts -o yaml apiVersion: v1 data: ldap-ca.crt: <mysecret> 1 kind: Secret metadata: name: mycerts namespace: awx type: Opaque
apiVersion: v1 kind: Secret metadata: name: external-postgres-configuration namespace: <target_namespace> 1 stringData: host: "<external_ip_or_url_resolvable_by_the_cluster>" 2 port: "<external_port>" 3 database: "<desired_database_name>" username: "<username_to_connect_as>" password: "<password_to_connect_with>" 4 sslmode: "prefer" 5 type: "unmanaged" type: Opaque
oc create -f external-postgres-configuration-secret.yml
apiVersion: automationcontroller.ansible.com/v1beta1 kind: AutomationController metadata: name: controller-dev spec: postgres_configuration_secret: external-postgres-configuration
get pvc -n <namespace>
delete pvc -n <namespace> <pvc-name>