Appendix A. Inventory file variables The following tables contain information about the pre-defined variables used in Ansible installation inventory files. Not all of these variables are required. A.1. General variables Variable Description enable_insights_collection The default install registers the node to the Red Hat Insights for Red Hat Ansible Automation Platform Service if the node is registered with Subscription Manager. Set to False to disable. Default = true registry_password registry_password is only required if a non-bundle installer is used. Password credential for access to registry_url . Used for both [automationcontroller] and [automationhub] groups. Enter your Red Hat Registry Service Account credentials in registry_username and registry_password to link to the Red Hat container registry. When registry_url is registry.redhat.io , username and password are required if not using bundle installer. registry_url Used for both [automationcontroller] and [automationhub] groups. Default = registry.redhat.io . registry_username registry_username is only required if a non-bundle installer is used. User credential for access to registry_url . Used for both [automationcontroller] and [automationhub] groups, but only if the value of registry_url is registry.redhat.io . Enter your Red Hat Registry Service Account credentials in registry_username and registry_password to link to the Red Hat container registry. routable_hostname routable hostname is used if the machine running the installer can only route to the target host through a specific URL, for example, if you use shortnames in your inventory, but the node running the installer can only resolve that host using FQDN. If routable_hostname is not set, it should default to ansible_host . Then if, and only if ansible_host is not set, inventory_hostname is used as a last resort. Note that this variable is used as a host variable for particular hosts and not under the [all:vars] section. For further information, see Assigning a variable to one machine:host variables A.2. Ansible automation hub variables Variable Description automationhub_admin_password Required automationhub_api_token If upgrading from Ansible Automation Platform 2.0 or earlier, you must either: provide an existing Ansible automation hub token as automationhub_api_token , or set generate_automationhub_token to true to generate a new token Generating a new token invalidates the existing token. automationhub_authentication_backend This variable is not set by default. Set it to ldap to use LDAP authentication. When this is set to ldap , you must also set the following variables: automationhub_ldap_server_uri automationhub_ldap_bind_dn automationhub_ldap_bind_password automationhub_ldap_user_search_base_dn automationhub_ldap_group_search_base_dn automationhub_auto_sign_collections If a collection signing service is enabled, collections are not signed automatically by default. Setting this parameter to true signs them by default. Default = false . automationhub_backup_collections Optional Ansible automation hub provides artifacts in /var/lib/pulp . Automation controller automatically backs up the artifacts by default. You can also set automationhub_backup_collections = false and the backup/restore process does not then backup or restore /var/lib/pulp . Default = true automationhub_collection_seed_repository When the bundle installer is run, validated content is uploaded to the validated repository, and certified content is uploaded to the rh-certified repository. By default, both certified and validated content are uploaded. Possible values of this variable are 'certified' or 'validated'. If you do not want to install content, set automationhub_seed_collections to false to disable the seeding. If you only want one type of content, set automationhub_seed_collections to true and automationhub_collection_seed_repository to the type of content you do want to include. automationhub_collection_signing_service_key If a collection signing service is enabled, you must provide this variable to ensure that collections can be properly signed. /absolute/path/to/key/to/sign automationhub_collection_signing_service_script If a collection signing service is enabled, you must provide this variable to ensure that collections can be properly signed. /absolute/path/to/script/that/signs automationhub_create_default_collection_signing_service The default install does not create a signing service. If set to true a signing service is created. Default = false automationhub_container_signing_service_key If a container signing service is enabled, you must provide this variable to ensure that containers can be properly signed. /absolute/path/to/key/to/sign automationhub_container_signing_service_script If a collection signing service is enabled, you must provide this variable to ensure that containers can be properly signed. /absolute/path/to/script/that/signs automationhub_create_default_contaier_signing_service The default install does not create a signing service. If set to true a signing service is created. Default = false automationhub_disable_hsts The default install deploys a TLS enabled Ansible automation hub. Use if automation hub is deployed with HTTP Strict Transport Security (HSTS) web-security policy enabled. Unless specified otherwise, the HSTS web-security policy mechanism is enabled. This setting allows you to disable it if required. Default = false automationhub_disable_https Optional If Ansible automation hub is deployed with HTTPS enabled. Default = false . automationhub_enable_api_access_log When set to true , creates a log file at /var/log/galaxy_api_access.log that logs all user actions made to the platform, including their username and IP address. Default = false . automationhub_enable_analytics A Boolean indicating whether to enable pulp analytics for the version of pulpcore used in automation hub in Ansible Automation Platform 2.3. To enable pulp analytics, set automationhub_enable_analytics = true . Default = false . automationhub_enable_unauthenticated_collection_access Enables unauthorized users to view collections. To enable unauthorized users to view collections, set automationhub_enable_unauthenticated_collection_access = true . Default = false . automation_hub_enable_unauthenticated_collection_download Enables unauthorized users to download collections. To enable unauthorized users to download collections, set automationhub_enable_unauthenticated_collection_download = true . Default = false . automationhub_importer_settings Optional Dictionary of setting to pass to galaxy-importer. At import time collections can go through a series of checks. Behavior is driven by galaxy-importer.cfg configuration. Examples are ansible-doc , ansible-lint , and flake8 . This parameter enables you to drive this configuration. automationhub_main_url The main {HubNameShort} URL that clients connect to. For example, https://<load balancer host>. If not specified, the first node in the [automationhub] group is used. Use automationhub_main_url to specify the main automation hub URL that clients connect to if you are implementing Red Hat Single Sign-On on your automation hub environment. automationhub_pg_database Required The database name. Default = automationhub automationhub_pg_host Required if not using internal database. automationhub_pg_password The password for the automation hub PostgreSQL database. Do not use special characters for automationhub_pg_password . They can cause the password to fail. automationhub_pg_port Required if not using internal database. Default = 5432 automationhub_pg_sslmode Required. Default = prefer automationhub_pg_username Required Default = automationhub automationhub_require_content_approval Optional If automation hub enforces the approval mechanism before collections are made available. By default when you upload collections to automation hub an administrator must approve it before it is made available to the users. If you want to disable the content approval flow, set the variable to false . Default = true automationhub_seed_collections A boolean that defines whether or not preloading is enabled. When the bundle installer is run, by a new repository is created by default in private automation hub named validated` and the list of the validated collections is updated. If you do not want to install content, set automationhub_seed_collections to false to disable the seeding. If you only want one type of content, set automationhub_seed_collections to true and automationhub_collection_seed_repository to the type of content you do want to include. Default = true automationhub_ssl_cert Optional /path/to/automationhub.cert Same as web_server_ssl_cert but for automation hub UI and API automationhub_ssl_key Optional /path/to/automationhub.key Same as web_server_ssl_key but for automation hub UI and API automationhub_ssl_validate_certs For Red Hat Ansible Automation Platform 2.3 and later, this value is no longer used. If automation hub should validate certificate when requesting itself because by default, Ansible Automation Platform deploys with self-signed certificates. Default = false . automationhub_upgrade Deprecated For Ansible Automation Platform 2.2.1 and later, the value of this has been fixed at true. Automation hub always updates with the latest packages. generate_automationhub_token If upgrading from Red Hat Ansible Automation Platform 2.0 or earlier, you must either: provide an existing Ansible automation hub token as automationhub_api_token or set generate_automationhub_token to true to generate a new token. Generating a new token will invalidate the existing token. nginx_hsts_max_age This variable specifies how long, in seconds, the system should be considered as a HTTP Strict Transport Security (HSTS) host. That is, how long HTTPS is used exclusively for communication. Default = 63072000 seconds, or two years. nginx_tls_protocols Defines support for ssl_protocols in Nginx. Default = TLSv1.2 . pulp_db_fields_key Relative or absolute path to the Fernet symmetric encryption key you want to import. The path is on the Ansible management node. It is used to encrypt certain fields in the database (such as credentials.) If not specified, a new key will be generated. For Ansible automation hub to connect to LDAP directly; the following variables must be configured. A list of other LDAP related variables (not covered by the automationhub_ldap_xxx variables below) that can be passed using the ldap_extra_settings variable can be found here: https://django-auth-ldap.readthedocs.io/en/latest/reference.html#settings Variable Description automationhub_ldap_bind_dn The name to use when binding to the LDAP server with automationhub_ldap_bind_password . automationhub_ldap_bind_password Required The password to use with automationhub_ldap_bind_dn . automationhub_ldap_group_search_base_dn An LDAPSearch object that finds all LDAP groups that users might belong to. If your configuration makes any references to LDAP groups, this and automationhub_ldap_group_type must be set. Default = None automatiohub_ldap_group_search_filter Optional Search filter for finding group membership. Variable identifies what objectClass type to use for mapping groups with automation hub and LDAP. Used for installing automation hub with LDAP. Default = (objectClass=Group) automationhub_ldap_group_search_scope Optional Scope to search for groups in an LDAP tree using the django framework for LDAP authentication. Used for installing automation hub with LDAP. Default = SUBTREE automationhub_ldap_group_type_class Optional Variable identifies the group type used during group searches within the django framework for LDAP authentication. Used for installing automation hub with LDAP. Default = django_auth_ldap.config:GroupOfNamesType automationhub_ldap_server_uri The URI of the LDAP server. This can be any URI that is supported by your underlying LDAP libraries. automationhub_ldap_user_search_base_dn An LDAPSearch object that locates a user in the directory. The filter parameter should contain the placeholder %(user)s for the username. It must return exactly one result for authentication to succeed. automationhub_ldap_user-search_scope Optional Scope to search for users in an LDAP tree using django framework for LDAP authentication. Used for installing automation hub with LDAP. Default = `SUBTREE A.3. Red Hat Single Sign-On variables *Use these variables for automationhub or automationcatalog . Variable Description sso_automation_platform_login_theme Optional Used for Ansible Automation Platform managed and externally managed Red Hat Single Sign-On. Path to the directory where theme files are located. If changing this variable, you must provide your own theme files. Default = ansible-automation-platform sso_automation_platform_realm Optional Used for Ansible Automation Platform managed and externally managed Red Hat Single Sign-On. The name of the realm in SSO. Default = ansible-automation-platform sso_automation_platform_realm_displayname Optional Used for Ansible Automation Platform managed and externally managed Red Hat Single Sign-On. Display name for the realm. Default = Ansible Automation Platform sso_console_admin_username Optional Used for Ansible Automation Platform managed and externally managed Red Hat Single Sign-On. SSO administration username. Default = admin sso_console_admin_password Required Used for Ansible Automation Platform managed and externally managed Red Hat Single Sign-On. SSO administration password. sso_custom_keystore_file Optional Used for Ansible Automation Platform managed Red Hat Single Sign-On only. Customer-provided keystore for SSO. sso_host Required Used for Ansible Automation Platform externally managed Red Hat Single Sign-On only. Automation hub and Automation services catalog require SSO and SSO administration credentials for authentication. SSO administration credentials are also required to set automation services catalog specific roles needed for the application. If SSO is not provided in the inventory for configuration, then you must use this variable to define the SSO host. sso_keystore_file_remote Optional Used for Ansible Automation Platform managed Red Hat Single Sign-On only. Set to true if the customer-provided keystore is on a remote node. Default = false sso_keystore_name Optional Used for Ansible Automation Platform managed Red Hat Single Sign-On only. Name of keystore for SSO. Default = ansible-automation-platform sso_keystore_password Password for keystore for HTTPS enabled SSO. Required when using Ansible Automation Platform managed SSO and when HTTPS is enabled. The default install deploys SSO with sso_use_https=true . sso_redirect_host Optional Used for Ansible Automation Platform managed and externally managed Red Hat Single Sign-On. If sso_redirect_host is set, it is used by the application to connect to SSO for authentication. This must be reachable from client machines. sso_ssl_validate_certs Optional Used for Ansible Automation Platform managed and externally managed Red Hat Single Sign-On. Set to true if the certificate is to be validated during connection. Default = true sso_use_https Optional Used for Ansible Automation Platform managed and externally managed Red Hat Single Sign-On. If Single Sign On uses https. Default = true A.4. Automation services catalog variables Variable Description automationcatalog_controller_password Used to generate a token from a controller host. Requires automation_controller_main_url to be defined as well. automationcatalog_controller_token Used for a pre-created OAuth token for automation controller. This token will be used instead of generating a token. automationcatalog_controller_username Used to generate a token from a controller host. Requires automation_controller_main_url to be defined as well. automationcatalog_controller_verify_ssl Used to enable or disable SSL validation from automation services catalog to automation controller. Default = true . automationcatalog_disable_hsts Used to enable or disable HSTS web-security policy for automation services catalog. Default = `false. automationcatalog_disable_https Used to enable or disable HSTS web-security policy for Services Catalog. Default = false . automationcatalog_enable_analytics_collection Used to control activation of analytics collection for automation services catalog automationcatalog_main_url Used by the Red Hat Single Sign-On host configuration if there is an alternative hostname that needs to be used between the SSO and automation services catalog host. automationcatalog_pg_database The postgres database URL for your automation services catalog. automationcatalog_pg_host The PostgreSQL host (database node) for your automation services catalog automationcatalog_pg_password The password for the PostgreSQL database of your automation services catalog. Do not use special characters for automationcatalog_pg_password . They can cause the password to fail. automationcatalog_pg_port The PostgreSQL port to use for your automation services catalog. Default = 5432 automationcatalog_pg_username The postgres ID for your automation services catalog. automationcatalog_ssl_cert Path to a custom provided SSL certificate file. Requires automationcatalog_ssl_key The internally managed CA signs and creates the certificate if not provided and https is left enabled. automationcatalog_ssl_key Path to a custom provided SSL certificate key file. Requires automationcatalog_ssl_cert . The internally managed CA signs and creates the certificate if not provided and https is left enabled. A.5. Automation controller variables Variable Description admin_password The password for an administration user to access the UI upon install completion. automation_controller_main_url For an alternative front end URL needed for SSO configuration with automation services catalog, provide the URL. Automation services catalog requires either Controller to be installed with automation controller, or a URL to an active and routable Controller server must be provided with this variable automationcontroller_password Password for your automation controller instance. automationcontroller_username Username for your automation controller instance. nginx_http_port The nginx HTTP server listens for inbound connections. Default = 80 nginx_https_port The nginx HTTPS server listens for secure connections. Default = 443 nginx_hsts_max_age This variable specifies how long, in seconds, the system should be considered as a HTTP Strict Transport Security (HSTS) host. That is, how long HTTPS is used exclusively for communication. Default = 63072000 seconds, or two years. nginx_tls_protocols Defines support for ssl_protocols in Nginx. Default = TLSv1.2 . node_state Optional The status of a node or group of nodes. Valid options are active , deprovision to remove a node from a cluster or iso_migrate to migrate a legacy isolated node to an execution node. Default = active . node_type For [automationcontroller] group. Two valid node_types can be assigned for this group. A node_type=control implies that the node only runs project and inventory updates, but not regular jobs. A node_type=hybrid has the ability to run everything. Default for this group = hybrid . For [execution_nodes] group Two valid node_types can be assigned for this group. A node_type=hop implies that the node forwards jobs to an execution node. A node_type=execution implies that the node can run jobs. Default for this group = execution . peers Optional The peers variable is used to indicate which nodes a specific host or group connects to. Wherever the peers variable is defined, an outbound connection will be established to the specific host or group. This variable is used to add tcp-peer entries in the receptor.conf file used for establishing network connections with other nodes. See Peering The peers variable can be a comma-separated list of hosts and/or groups from the inventory. This is resolved into a set of hosts that is used to construct the receptor.conf file. pg_database The name of the postgres database. Default = awx . pg_host The postgreSQL host, which can be an externally managed database. pg_password The password for the postgreSQL database. Do not use special characters for pg_password . They can cause the password to fail. NOTE You no longer have to provide a pg_hashed_password in your inventory file at the time of installation because PostgreSQL 13 can now store user passwords more securely. When you supply pg_password in the inventory file for the installer, PostgreSQL uses the SCRAM-SHA-256 hash to secure that password as part of the installation process. pg_port The postgreSQL port to use. Default = 5432 pg_ssl_mode One of prefer or verify-full . Set to verify-full for client-side enforced SSL. Default = prefer . pg_username Your postgres database username. Default = awx . postgres_ssl_cert location of postgres ssl certificate. /path/to/pgsql_ssl.cert postgres_ssl_key location of postgres ssl key. /path/to/pgsql_ssl.key postgres_use_cert Location of postgres user certificate. /path/to/pgsql.crt postgres_use_key Location of postgres user key. /path/to/pgsql.key postgres_use_ssl If postgres is to use SSL. receptor_listener_port Port to use for recptor connection. Default = 27199. supervisor_start_retry_count When specified (no default value exists), adds startretries = <value specified> to the supervisor config file (/etc/supervisord.d/tower.ini). See program:x Section Values for further explanation about startretries . web_server_ssl_cert Optional /path/to/webserver.cert Same as automationhub_ssl_cert but for web server UI and API. web_server_ssl_key Optional /path/to/webserver.key Same as automationhub_server_ssl_key but for web server UI and API. A.6. Ansible variables The following variables control how Ansible Automation Platform interacts with remote hosts. Additional information on variables specific to certain plugins can be found at https://docs.ansible.com/ansible-core/devel/collections/ansible/builtin/index.html A list of global configuration options can be found at https://docs.ansible.com/ansible-core/devel/reference_appendices/config.html Variable Description ansible_connection The connection plugin used for the task on the target host. This can be the name of any of ansible connection plugin. SSH protocol types are smart , ssh or paramiko . Default = smart ansible_host The ip or name of the target host to use instead of inventory_hostname . ansible_port The connection port number, if not, the default (22 for ssh). ansible_user The user name to use when connecting to the host. ansible_password The password to use to authenticate to the host. Never store this variable in plain text. Always use a vault. ansible_ssh_private_key_file Private key file used by ssh. Useful if using multiple keys and you do not want to use an SSH agent. ansible_ssh_common_args This setting is always appended to the default command line for sftp , scp , and ssh . Useful to configure a ProxyCommand for a certain host (or group). ansible_sftp_extra_args This setting is always appended to the default sftp command line. ansible_scp_extra_args This setting is always appended to the default scp command line. ansible_ssh_extra_args This setting is always appended to the default ssh command line. ansible_ssh_pipelining Determines if SSH pipelining is used. This can override the pipelining setting in ansible.cfg . If using SSH key-based authentication, then the key must be managed by an SSH agent. ansible_ssh_executable (added in version 2.2) This setting overrides the default behavior to use the system ssh. This can override the ssh_executable setting in ansible.cfg . ansible_shell_type The shell type of the target system. You should not use this setting unless you have set the ansible_shell_executable to a non-Bourne (sh) compatible shell. By default commands are formatted using sh-style syntax. Setting this to csh or fish causes commands executed on target systems to follow the syntax of those shells instead. ansible_shell_executable This sets the shell that the ansible controller uses on the target machine, and overrides the executable in ansible.cfg which defaults to /bin/sh . You should only change if it is not possible to use /bin/sh , that is, if /bin/sh is not installed on the target machine or cannot be run from sudo. inventory_hostname This variable takes the hostname of the machine from the inventory script or the ansible configuration file. You cannot set the value of this variable. Because the value is taken from the configuration file, the actual runtime hostname value can vary from what is returned by this variable.

Commands: