Chapter 5. Configuring the Red Hat Ansible Automation Platform Operator on Red Hat OpenShift Container Platform The platform gateway for Ansible Automation Platform enables you to manage the following Ansible Automation Platform components to form a single user interface: Automation controller Automation hub Event-Driven Ansible Red Hat Ansible Lightspeed (This feature is disabled by default, you must opt in to use it.) Before you can deploy the platform gateway you must have Ansible Automation Platform Operator installed in a namespace. If you have not installed Ansible Automation Platform Operator see Installing the Red Hat Ansible Automation Platform Operator on Red Hat OpenShift Container Platform . Note Platform gateway is only available under Ansible Automation Platform Operator version 2.5. Every component deployed under Ansible Automation Platform Operator 2.5 defaults to version 2.5. If you have the Ansible Automation Platform Operator and some or all of the Ansible Automation Platform components installed see Deploying the platform gateway with existing Ansible Automation Platform components for how to proceed. 5.1. Linking your components to the platform gateway After installing the Ansible Automation Platform Operator in your namespace you can set up your Ansible Automation Platform instance. Then link all the platform components to a single user interface. Procedure Log in to Red Hat OpenShift Container Platform. Navigate to Operators Installed Operators . Select your Ansible Automation Platform Operator deployment. Select the Details tab. On the Ansible Automation Platform tile click Create instance . From the Create Ansible Automation Platform page enter a name for your instance in the Name field. Click YAML view and paste the following: spec: database: resource_requirements: requests: cpu: 200m memory: 512Mi storage_requirements: requests: storage: 100Gi controller: disabled: false eda: disabled: false hub: disabled: false storage_type: file file_storage_storage_class: <read-write-many-storage-class> file_storage_size: 10Gi Click Create . Verification Go to your Ansible Automation Platform Operator deployment and click All instances to verify if all instances deployed correctly. You should see the Ansible Automation Platform instance and the deployed AutomationController , EDA , and AutomationHub instances here. Alternatively you can check by the command line, run: oc get route 5.2. Accessing the platform gateway You should use the Ansible Automation Platform instance as your default. This instance links the automation controller, automation hub, and Event-Driven Ansible deployments to a single interface. Procedure To access your Ansible Automation Platform instance: Log in to Red Hat OpenShift Container Platform. Navigate to Networking Routes Click the link under Location for Ansible Automation Platform . This redirects you to the Ansible Automation Platform login page. Enter "admin" as your username in the Username field. For the password you need to: Go to to Workloads Secrets . Click <your instance name>-admin-password and copy the password. Paste the password into the Password field. Click Login . Apply your subscription: Click Subscription manifest or Username/password . Upload your manifest or enter your username and password. Select your subscription from the Subscription list. Click . This redirects you to the Analytics page. Click . Select the I agree to the terms of the license agreement checkbox. Click . You now have access to the platform gateway user interface. If you cannot access the Ansible Automation Platform see Frequently asked questions on platform gateway for help with troubleshooting and debugging. 5.3. Deploying the platform gateway with existing Ansible Automation Platform components You can link any components of the Ansible Automation Platform, that you have already installed to a new Ansible Automation Platform instance. The following procedure simulates a scenario where you have automation controller as an existing component and want to add automation hub and Event-Driven Ansible. Procedure Log in to Red Hat OpenShift Container Platform. Navigate to Operators Installed Operators . Select your Ansible Automation Platform Operator deployment. Click Subscriptions and edit your Update channel to stable-2.5 . Click Details and on the Ansible Automation Platform tile click Create instance . From the Create Ansible Automation Platform page enter a name for your instance in the Name field. When deploying an Ansible Automation Platform instance, ensure that auto_update is set to the default value of false on your existing automation controller instance in order for the integration to work. Click YAML view and copy in the following: apiVersion: aap.ansible.com/v1alpha1 kind: AnsibleAutomationPlatform metadata: name: example-aap namespace: aap spec: database: resource_requirements: requests: cpu: 200m memory: 512Mi storage_requirements: requests: storage: 100Gi # Platform image_pull_policy: IfNotPresent # Components controller: disabled: false name: existing-controller-name eda: disabled: false hub: disabled: false ## uncomment if using file storage for Content pod storage_type: file file_storage_storage_class: <your-read-write-many-storage-class> file_storage_size: 10Gi ## uncomment if using S3 storage for Content pod # storage_type: S3 # object_storage_s3_secret: example-galaxy-object-storage ## uncomment if using Azure storage For new components, if you do not specify a name, a default name is generated. Click Create . To access your new instance, see Accessing the platform gateway . Note If you have an existing controller with a managed Postgres pod, after creating the Ansible Automation Platform resource your automation controller instance will continue to use that original Postgres pod. If you were to do a fresh install you would have a single Postgres managed pod for all instances. 5.4. Configuring an external database for platform gateway on Red Hat Ansible Automation Platform Operator There are two scenarios for deploying Ansible Automation Platform with an external database: Scenario Action required Fresh install You must specify a single external database instance for the platform to use for the following: Platform gateway Automation controller Automation hub Event-Driven Ansible Red Hat Ansible Lightspeed (If enabled) See the aap-configuring-external-db-all-default-components.yml example in the 14.1. Custom resources section for help with this. If using Red Hat Ansible Lightspeed, use the aap-configuring-external-db-with-lightspeed-enabled.yml example. Existing external database in 2.4 Your existing external database remains the same after upgrading but you must specify the external-postgres-configuration-gateway (spec.database.database_secret) on the Ansible Automation Platform custom resource. To deploy Ansible Automation Platform with an external database, you must first create a Kubernetes secret with credentials for connecting to the database. By default, the Ansible Automation Platform Operator automatically creates and configures a managed PostgreSQL pod in the same namespace as your Ansible Automation Platform deployment. You can deploy Ansible Automation Platform with an external database instead of the managed PostgreSQL pod that the Ansible Automation Platform Operator automatically creates. Using an external database lets you share and reuse resources and manually manage backups, upgrades, and performance optimizations. Note The same external database (PostgreSQL instance) can be used for both automation hub, automation controller, and platform gateway as long as the database names are different. In other words, you can have multiple databases with different names inside a single PostgreSQL instance. The following section outlines the steps to configure an external database for your platform gateway on a Ansible Automation Platform Operator. Prerequisite The external database must be a PostgreSQL database that is the version supported by the current release of Ansible Automation Platform. Note Ansible Automation Platform 2.5 supports PostgreSQL 15. Procedure The external postgres instance credentials and connection information must be stored in a secret, which is then set on the platform gateway spec. Create a postgres_configuration_secret YAML file, following the template below: apiVersion: v1 kind: Secret metadata: name: external-postgres-configuration namespace: <target_namespace> 1 stringData: host: "<external_ip_or_url_resolvable_by_the_cluster>" 2 port: "<external_port>" 3 database: "<desired_database_name>" username: "<username_to_connect_as>" password: "<password_to_connect_with>" 4 type: "unmanaged" type: Opaque 1 Namespace to create the secret in. This should be the same namespace you want to deploy to. 2 The resolvable hostname for your database node. 3 External port defaults to 5432 . 4 Value for variable password should not contain single or double quotes (', ") or backslashes (\) to avoid any issues during deployment, backup or restoration. Apply external-postgres-configuration-secret.yml to your cluster using the oc create command. USD oc create -f external-postgres-configuration-secret.yml Note The following example is for a platform gateway deployment. To configure an external database for all components, use the aap-configuring-external-db-all-default-components.yml example in the 14.1. Custom resources section. When creating your AnsibleAutomationPlatform custom resource object, specify the secret on your spec, following the example below: apiVersion: aap.ansible.com/v1alpha1 kind: AnsibleAutomationPlatform metadata: name: example-aap Namespace: aap spec: database: database_secret: automation-platform-postgres-configuration 5.5. Enabling HTTPS redirect for single sign-on (SSO) for platform gateway on OpenShift Container Platform HTTPS redirect for SAML, allows you to log in once and access all of the platform gateway without needing to reauthenticate. Prerequisites You have successfully configured SAML in the gateway from the Ansible Automation Platform Operator. Refer to Configuring SAML authentication for help with this. Procedure Log in to Red Hat OpenShift Container Platform. Go to Operators Installed Operators . Select your Ansible Automation Platform Operator deployment. Select All Instances and go to your AnsibleAutomationPlatform instance. Click the ... icon and then select Edit AnsibleAutomationPlatform . In the YAML view paste the following YAML code under the spec: section: spec: extra_settings: - setting: REDIRECT_IS_HTTPS value: '"True"' Click Save . Verification After you have added the REDIRECT_IS_HTTPS setting, wait for the pod to redeploy automatically. You can verify this setting makes it into the pod by running: oc exec -it <gateway-pod-name> -- grep REDIRECT /etc/ansible-automation-platform/gateway/settings.py 5.6. Frequently asked questions on platform gateway If I delete my Ansible Automation Platform deployment will I still have access to automation controller? No, automation controller, automation hub, and Event-Driven Ansible are nested within the deployment and are also deleted. Something went wrong with my deployment but I'm not sure what, how can I find out? You can follow along in the command line while the operator is reconciling, this can be helpful for debugging. Alternatively you can click into the deployment instance to see the status conditions being updated as the deployment goes on. Is it still possible to view individual component logs? When troubleshooting you should examine the Ansible Automation Platform instance for the main logs and then each individual component ( EDA , AutomationHub , AutomationController ) for more specific information. Where can I view the condition of an instance? To display status conditions click into the instance, and look under the Details or Events tab. Alternatively, to display the status conditions you can run the get command: oc get automationcontroller <instance-name> -o jsonpath=Pipe "| jq" Can I track my migration in real time? To help track the status of the migration or to understand why migration might have failed you can look at the migration logs as they are running. Use the logs command: oc logs fresh-install-controller-migration-4.6.0-jwfm6 -f I have configured my SAML but authentication fails with this error: "Unable to complete social auth login" What can I do? You must update your Ansible Automation Platform instance to include the REDIRECT_IS_HTTPS extra setting. See Enabling single sign-on (SSO) for platform gateway on OpenShift Container Platform for help with this.

Commands:
spec: database: resource_requirements: requests: cpu: 200m memory: 512Mi storage_requirements: requests: storage: 100Gi controller: disabled: false eda: disabled: false hub: disabled: false storage_type: file file_storage_storage_class: <read-write-many-storage-class> file_storage_size: 10Gi
apiVersion: aap.ansible.com/v1alpha1 kind: AnsibleAutomationPlatform metadata: name: example-aap namespace: aap spec: database: resource_requirements: requests: cpu: 200m memory: 512Mi storage_requirements: requests: storage: 100Gi # Platform image_pull_policy: IfNotPresent # Components controller: disabled: false name: existing-controller-name eda: disabled: false hub: disabled: false ## uncomment if using file storage for Content pod storage_type: file file_storage_storage_class: <your-read-write-many-storage-class> file_storage_size: 10Gi ## uncomment if using S3 storage for Content pod # storage_type: S3 # object_storage_s3_secret: example-galaxy-object-storage ## uncomment if using Azure storage
apiVersion: v1 kind: Secret metadata: name: external-postgres-configuration namespace: <target_namespace> 1 stringData: host: "<external_ip_or_url_resolvable_by_the_cluster>" 2 port: "<external_port>" 3 database: "<desired_database_name>" username: "<username_to_connect_as>" password: "<password_to_connect_with>" 4 type: "unmanaged" type: Opaque
oc create -f external-postgres-configuration-secret.yml
apiVersion: aap.ansible.com/v1alpha1 kind: AnsibleAutomationPlatform metadata: name: example-aap Namespace: aap spec: database: database_secret: automation-platform-postgres-configuration
spec: extra_settings: - setting: REDIRECT_IS_HTTPS value: '"True"'
exec -it <gateway-pod-name> -- grep REDIRECT /etc/ansible-automation-platform/gateway/settings.py