Automation controller administration guide Red Hat Ansible Automation Platform 2.4 Administrator Guide for Automation Controller Red Hat Customer Content Services

Commands:
subscription-manager list --available --all | grep "Ansible Automation Platform" -B 3 -A 6
Subscription Name: Red Hat Ansible Automation Platform, Premium (5000 Managed Nodes) Provides: Red Hat Ansible Engine Red Hat Single Sign-On Red Hat Ansible Automation Platform SKU: MCT3695 Contract: ******** Pool ID: ******************** Provides Management: No Available: 4999 Suggested: 1
subscription-manager attach --pool=<pool_id>
subscription-manager list --consumed
#subscription-manager remove --pool=<pool_id>
root@localhost:~USD automation-controller-service restart
[main] 127.0.0.1 _awx_description="my host 1" 127.0.0.2 _awx_description="my host 2"
{ "_meta": { "hostvars": { "host1": { "fly_rod": true } } }, "all": { "children": [ "groupA", "ungrouped" ] }, "groupA": { "hosts": [ "host1", "host10", "host11", "host12", "host13", "host14", "host15", "host16", "host17", "host18", "host19", "host2", "host20", "host21", "host22", "host23", "host24", "host25", "host3", "host4", "host5", "host6", "host7", "host8", "host9" ] } }
GET /api/v2/job_templates/N/credentials/
POST /api/v2/job_templates/N/credentials/ {'associate': true, 'id': 'X'} POST /api/v2/job_templates/N/credentials/ {'disassociate': true, 'id': 'Y'}
POST /api/v2/job_templates/N/launch/ {'credentials': [A, B, C]}`
POST /api/v2/job_templates/N/credentials/ { 'associate': true, 'id': X }
GET /api/v2/job_templates/N/launch/ { 'passwords_needed_to_start': [ 'vault_password.X', 'vault_password.Y', ] }
POST /api/v2/job_templates/N/launch/ { 'credential_passwords': { 'vault_password.X': 'first-vault-password' 'vault_password.Y': 'second-vault-password' } }
[automationcontroller] hostA hostB hostC [instance_group_east] hostB hostC [instance_group_west] hostC hostD
[automationcontroller] hostA hostB hostC [database] hostDB
[automationcontroller] hostA routable_hostname=10.1.0.2 hostB routable_hostname=10.1.0.3 hostC routable_hostname=10.1.0.4 routable_hostname
awx-manage deprovision_instance --hostname=<name used in inventory file>
awx-manage deprovision_instance --hostname=hostB
[automationcontroller] 126-addr.tatu.home ansible_host=192.168.111.126 node_type=control [automationcontroller:vars] peers=execution_nodes [execution_nodes] [instance_group_test] 110-addr.tatu.home ansible_host=192.168.111.110 receptor_listener_port=8928
TASK [ansible.automation_platform_installer.check_config_static : Validate mesh topology] *** fatal: [126-addr.tatu.home -> localhost]: FAILED! => {"msg": "The host '110-addr.tatu.home' is not present in either [automationcontroller] or [execution_nodes]"}
[automationcontroller] 126-addr.tatu.home ansible_host=192.168.111.126 node_type=control [automationcontroller:vars] peers=execution_nodes [execution_nodes] 110-addr.tatu.home ansible_host=192.168.111.110 receptor_listener_port=8928 [instance_group_test] 110-addr.tatu.home
TASK [ansible.automation_platform_installer.check_config_static : Validate mesh topology] *** ok: [126-addr.tatu.home -> localhost] => {"changed": false, "mesh": {"110-addr.tatu.home": {"node_type": "execution", "peers": [], "receptor_control_filename": "receptor.sock", "receptor_control_service_name": "control", "receptor_listener": true, "receptor_listener_port": 8928, "receptor_listener_protocol": "tcp", "receptor_log_level": "info"}, "126-addr.tatu.home": {"node_type": "control", "peers": ["110-addr.tatu.home"], "receptor_control_filename": "receptor.sock", "receptor_control_service_name": "control", "receptor_listener": false, "receptor_listener_port": 27199, "receptor_listener_protocol": "tcp", "receptor_log_level": "info"}}}
HTTP POST /api/v2/instance_groups/x/instances/ {'id': y}`
HTTP PATCH /api/v2/instance_groups/N/ { "policy_instance_list": ["special-instance"] } HTTP PATCH /api/v2/instances/X/ { "managed_by_policy": False }
max_concurrent_jobs: 10 max_forks: 50
automation-controller-service stop
awx-manage deprovision_instance --hostname=<name used in inventory file>
awx-manage deprovision_instance --hostname=hostB
awx-manage unregister_queue --queuename=<name>
--- apiVersion: v1 kind: ServiceAccount metadata: name: containergroup-service-account namespace: containergroup-namespace --- kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: role-containergroup-service-account namespace: containergroup-namespace rules: - apiGroups: [""] resources: ["pods"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] - apiGroups: [""] resources: ["pods/log"] verbs: ["get"] - apiGroups: [""] resources: ["pods/attach"] verbs: ["get", "list", "watch", "create"] --- kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: role-containergroup-service-account-binding namespace: containergroup-namespace subjects: - kind: ServiceAccount name: containergroup-service-account namespace: containergroup-namespace roleRef: kind: Role name: role-containergroup-service-account apiGroup: rbac.authorization.k8s.io
apply -f containergroup-sa.yml
export SA_SECRET=USD(oc get sa containergroup-service-account -o json | jq '.secrets[0].name' | tr -d '"')
get secret USD(echo USD{SA_SECRET}) -o json | jq '.data.token' | xargs | base64 --decode > containergroup-sa.token
get secret USDSA_SECRET -o json | jq '.data["ca.crt"]' | xargs | base64 --decode > containergroup-ca.crt
ansible_host: 127.0.0.1
ansible_connection: local
Error creating pod: pods is forbidden: User "system: serviceaccount: aap:example" cannot create resource "pods" in API group "" in the namespace "aap"
create secret generic ee-pull-secret --from-literal=username=<username> --from-literal=password=<password> --from-literal=url=registry.redhat.io edit automationcontrollers <instance name>
spec.ee_pull_credentials_secret=ee-pull-secret
ssh [username]@[host_ip_address]
ssh ec2-user@10.0.0.6
sudo subscription-manager register --auto-attach
sudo subscription-manager register
subscription-manager repos --enable ansible-automation-platform-2.4-for-rhel-8-x86_64-rpms for RHEL 8 subscription-manager repos --enable ansible-automation-platform-2.4-for-rhel-9-x86_64-rpms for RHEL 9
sudo dnf upgrade -y
sudo dnf install -y ansible-core
receptor-ca.crt work-public-key.pem receptor.key install_receptor.yml inventory.yml group_vars/all.yml requirements.yml
ansible-galaxy collection install -r requirements.yml
all: hosts: remote-execution: ansible_host: 10.0.0.6 ansible_user: <username> # user provided ansible_ssh_private_key_file: ~/.ssh/<id_rsa>
ansible_ssh_common_args: <your ssh ProxyCommand setting>
ansible-galaxy collection install ansible.receptor
ansible-galaxy install -r requirements.yml
sudo firewall-cmd --permanent --zone=public --add-port=27199/tcp
ansible-playbook -i inventory.yml install_receptor.yml
https://<yourcontrollerfqdn>/api/v2/settings/logging { "LOG_AGGREGATOR_HOST": "https://<yoursplunk>:8088/services/collector/event", "LOG_AGGREGATOR_PORT": null, "LOG_AGGREGATOR_TYPE": "splunk", "LOG_AGGREGATOR_USERNAME": "", "LOG_AGGREGATOR_PASSWORD": "USDencryptedUSD", "LOG_AGGREGATOR_LOGGERS": [ "awx", "activity_stream", "job_events", "system_tracking" ], "LOG_AGGREGATOR_INDIVIDUAL_FACTS": false, "LOG_AGGREGATOR_ENABLED": true, "LOG_AGGREGATOR_CONTROLLER_UUID": "" }
filter { json { source => "message" } }
' status {status_code} received by user {user_name} attempting to access {url_path} from {remote_addr} '
scrape_configs - job_name: 'controller' tls_config: insecure_skip_verify: True metrics_path: /api/v2/metrics scrape_interval: 5s scheme: https bearer_token: <token_value> # basic_auth: # username: admin # password: password static_configs: - targets: - <controller_host>
crontab -e
export METRICS_UTILITY_SHIP_TARGET=directory export METRICS_UTILITY_SHIP_PATH=/awx_devel/awx-dev/metrics-utility/shipped_data/billing
export METRICS_UTILITY_REPORT_TYPE=CCSP export METRICS_UTILITY_PRICE_PER_NODE=11.55 # in USD export METRICS_UTILITY_REPORT_SKU=MCT3752MO export METRICS_UTILITY_REPORT_SKU_DESCRIPTION="EX: Red Hat Ansible Automation Platform, Full Support (1 Managed Node, Dedicated, Monthly)" export METRICS_UTILITY_REPORT_H1_HEADING="CCSP Reporting <Company>: ANSIBLE Consumption" export METRICS_UTILITY_REPORT_COMPANY_NAME="Company Name" export METRICS_UTILITY_REPORT_EMAIL="email@email.com" export METRICS_UTILITY_REPORT_RHN_LOGIN="test_login" export METRICS_UTILITY_REPORT_COMPANY_BUSINESS_LEADER="BUSINESS LEADER" export METRICS_UTILITY_REPORT_COMPANY_PROCUREMENT_LEADER="PROCUREMENT LEADER"
metrics-utility gather_automation_controller_billing_data --ship --until=10m
0 */1 * * * metrics-utility gather_automation_controller_billing_data --ship --until=10m 0 4 2 * * metrics-utility build_report
crontab -l
cat /var/log/cron
May 8 09:45:03 ip-10-0-6-23 CROND[51623]: (root) CMDOUT (No billing data for month: 2024-04) May 8 09:45:03 ip-10-0-6-23 CROND[51623]: (root) CMDEND (metrics-utility build_report) May 8 09:45:19 ip-10-0-6-23 crontab[51619]: (root) END EDIT (root) May 8 09:45:34 ip-10-0-6-23 crontab[51659]: (root) BEGIN EDIT (root) May 8 09:46:01 ip-10-0-6-23 CROND[51688]: (root) CMD (metrics-utility gather_automation_controller_billing_data --ship --until=10m) May 8 09:46:03 ip-10-0-6-23 CROND[51669]: (root) CMDOUT (/tmp/9e3f86ee-c92e-4b05-8217-72c496e6ffd9-2024-05-08-093402+0000-2024-05-08-093602+0000-0.tar.gz) May 8 09:46:03 ip-10-0-6-23 CROND[51669]: (root) CMDEND (metrics-utility gather_automation_controller_billing_data --ship --until=10m) May 8 09:46:26 ip-10-0-6-23 crontab[51659]: (root) END EDIT (root)
metrics-utility build_report
apiVersion: v1 kind: ConfigMap metadata: name: automationcontroller-metrics-utility-configmap data: METRICS_UTILITY_SHIP_TARGET: directory METRICS_UTILITY_SHIP_PATH: /metrics-utility METRICS_UTILITY_REPORT_TYPE: CCSP METRICS_UTILITY_PRICE_PER_NODE: '11' # in USD METRICS_UTILITY_REPORT_SKU: MCT3752MO METRICS_UTILITY_REPORT_SKU_DESCRIPTION: "EX: Red Hat Ansible Automation Platform, Full Support (1 Managed Node, Dedicated, Monthly)" METRICS_UTILITY_REPORT_H1_HEADING: "CCSP Reporting <Company>: ANSIBLE Consumption" METRICS_UTILITY_REPORT_COMPANY_NAME: "Company Name" METRICS_UTILITY_REPORT_EMAIL: "email@email.com" METRICS_UTILITY_REPORT_RHN_LOGIN: "test_login" METRICS_UTILITY_REPORT_COMPANY_BUSINESS_LEADER: "BUSINESS LEADER" METRICS_UTILITY_REPORT_COMPANY_PROCUREMENT_LEADER: "PROCUREMENT LEADER"
[cols="50%,50%",options="header"] |==== | *Parameter* | *Variable* | *`metrics_utility_enabled`* | True. | *`metrics_utility_cronjob_gather_schedule`* | @hourly or @daily. | *`metrics_utility_cronjob_report_schedule`* | @daily or @monthly. |====
scp -r username@controller_host:USDMETRICS_UTILITY_SHIP_PATH/data/<YYYY>/<MM>/ /local/directory/
- name: Copy directory from Kubernetes PVC to local machine hosts: localhost vars: report_dir_path: "/mnt/metrics/reports/{{ year }}/{{ month }}/" tasks: - name: Create a temporary pod to access PVC data kubernetes.core.k8s: definition: apiVersion: v1 kind: Pod metadata: name: temp-pod namespace: "{{ namespace_name }}" spec: containers: - name: busybox image: busybox command: ["/bin/sh"] args: ["-c", "sleep 3600"] # Keeps the container alive for 1 hour volumeMounts: - name: "{{ pvc }}" mountPath: "/mnt/metrics" volumes: - name: "{{ pvc }}" persistentVolumeClaim: claimName: automationcontroller-metrics-utility restartPolicy: Never register: pod_creation - name: Wait for both initContainer and main container to be ready kubernetes.core.k8s_info: kind: Pod namespace: "{{ namespace_name }}" name: temp-pod register: pod_status until: > pod_status.resources[0].status.containerStatuses[0].ready retries: 30 delay: 10 - name: Create a tarball of the directory of the report in the container kubernetes.core.k8s_exec: namespace: "{{ namespace_name }}" pod: temp-pod container: busybox command: tar czf /tmp/metrics.tar.gz -C "{{ report_dir_path }}" . register: tarball_creation - name: Copy the report tarball from the container to the local machine kubernetes.core.k8s_cp: namespace: "{{ namespace_name }}" pod: temp-pod container: busybox state: from_pod remote_path: /tmp/metrics.tar.gz local_path: "{{ local_dir }}/metrics.tar.gz" when: tarball_creation is succeeded - name: Ensure the local directory exists ansible.builtin.file: path: "{{ local_dir }}" state: directory - name: Extract the report tarball on the local machine ansible.builtin.unarchive: src: "{{ local_dir }}/metrics.tar.gz" dest: "{{ local_dir }}" remote_src: yes extra_opts: "--strip-components=1" when: tarball_creation is succeeded - name: Delete the temporary pod kubernetes.core.k8s: api_version: v1 kind: Pod namespace: "{{ namespace_name }}" name: temp-pod state: absent
crontab -e
*/2 * * * * metrics-utility gather_automation_controller_billing_data --ship --until=10m */5 * * * * metrics-utili ty build_report
metrics_utility_cronjob_gather_schedule: metrics_utility_cronjob_report_schedule:
Total RAM * 0.25 / max_connections
Total RAM * 0.05
((number of worker nodes in kubernetes cluster) * (CPU available on each worker)) / (CPU request on pod_spec) = maximum number of concurrent jobs
((number of worker nodes in kubernetes cluster) * (memory available on each worker)) / (memory request on pod_spec) = maximum number of forks
[automationcontroller] controller1 ansible_user=ec2-user ansible_host=10.10.12.11 node_type=hybrid routable_hostname=somehost.somecompany.org
setup.sh -k.
AUTH_PASSWORD_VALIDATORS = [ { 'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator', }, { 'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator', 'OPTIONS': { 'min_length': 9, } }, { 'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator', }, { 'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator', }, ]
awx-manage inventory_import [--help]
awx-manage inventory_import --source=/ansible/inventory/ --inventory-id=1
awx-manage inventory_import --source=/ansible/inventory/ --inventory-id=1 --overwrite
awx-manage cleanup_jobs [--help]
awx-manage cleanup_activitystream [--help]
awx-manage create_oauth2_token --user example_user New OAuth2 token for example_user: j89ia8OO79te6IAZ97L7E8bMgXCON2
awx-manage revoke_oauth2_tokens
awx-manage revoke_oauth2_tokens --revoke_refresh
awx-manage revoke_oauth2_tokens --user example_user
awx-manage revoke_oauth2_tokens --user example_user --revoke_refresh
awx-manage expire_sessions
awx-manage expire_sessions --user example_user
awx-manage gather_analytics --ship
awx-manage host_metric --since YYYY-MM-DD --until YYYY-MM-DD --json
managed > manifest_limit => non-compliant managed =< manifest_limit => compliant
AWX_ISOLATION_BASE_PATH = "/opt/tmp"
AWX_ISOLATION_SHOW_PATHS = ['/list/of/', '/paths']
{ "id": 1, "type": "o_auth2_application", "url": "/api/v2/applications/2/", "related": { "tokens": "/api/v2/applications/2/tokens/" }, "summary_fields": { "organization": { "id": 1, "name": "Default", "description": "" }, "user_capabilities": { "edit": true, "delete": true }, "tokens": { "count": 0, "results": [] } }, "created": "2018-07-02T21:16:45.824400Z", "modified": "2018-07-02T21:16:45.824514Z", "name": "My Application", "description": "", "client_id": "Ecmc6RjjhKUOWJzDYEP8TZ35P3dvsKt0AKdIjgHV", "client_secret": "7Ft7ym8MpE54yWGUNvxxg6KqGwPFsyhYn9QQfYHlgBxai74Qp1GE4zsvJduOfSFkTfWFnPzYpxqcRsy1KacD0HH0vOAQUDJDCidByMiUIH4YQKtGFM1zE1dACYbpN44E", "client_type": "confidential", "redirect_uris": "", "authorization_grant_type": "password", "skip_authorization": false, "organization": 1 }
{ "id": 4, "type": "o_auth2_access_token", "url": "/api/v2/tokens/4/", "related": { "user": "/api/v2/users/1/", "application": "/api/v2/applications/1/", "activity_stream": "/api/v2/tokens/4/activity_stream/" }, "summary_fields": { "application": { "id": 1, "name": "Default application for root", "client_id": "mcU5J5uGQcEQMgAZyr5JUnM3BqBJpgbgL9fLOVch" }, "user": { "id": 1, "username": "root", "first_name": "", "last_name": "" } }, "created": "2018-02-23T14:39:32.618932Z", "modified": "2018-02-23T14:39:32.643626Z", "description": "App Token Test", "user": 1, "token": "*************", "refresh_token": "*************", "application": 1, "expires": "2018-02-24T00:39:32.618279Z", "scope": "read" },
curl -XPOST -k -H "Content-type: application/json" -d '{"description":"Personal controller CLI token", "application":null, "scope":"write"}' https://<USERNAME>:<PASSWORD>@<CONTROLLER_SERVER>/api/v2/users/<USER_ID>/personal_tokens/ | python -m json.tool
curl -k -H "Authorization: Bearer <token>" -H "Content-Type: application/json" -X POST -d '{}' https://controller/api/v2/job_templates/5/launch/
{ "name": "Admin Internal Application", "description": "For use by secure services & clients. ", "client_type": "confidential", "redirect_uris": "", "authorization_grant_type": "password", "skip_authorization": false, "organization": <organization-id> }
{ "description": "My Access Token", "application": <application-id>, "scope": "write" }
curl -H "Authorization: Bearer <token-value>" -H "Content-Type: application/json" -X GET https://<controller>/api/v2/users/
curl -ku <user>:<password> -X DELETE https://<controller>/api/v2/tokens/<pk>/
curl -H "Authorization: Bearer <token-value>" -X DELETE https://<controller>/api/v2/tokens/<pk>/ -k
{ "name": "AuthCodeApp", "user": 1, "client_type": "confidential", "redirect_uris": "http://<controller>/api/v2", "authorization_grant_type": "authorization-code", "skip_authorization": false } .. _`Django-oauth-toolkit simple test application`: http://django-oauth-toolkit.herokuapp.com/consumer/
CORS_ORIGIN_ALLOW_ALL = True CORS_ALLOWED_ORIGIN_REGEXES = [ r"http://django-oauth-toolkit.herokuapp.com*", r"http://www.example.com*" ]
id: 6
type: application
name: Default Application
user: 1
client_id: gwSPoasWSdNkMDtBN3Hu2WYQpPWCO9SwUEsKK22l
client_secret: fI6ZpfocHYBGfm1tP92r0yIgCyfRdDQt0Tos9L8a4fNsJjQQMwp9569eIaUBsaVDgt2eiwOGe0bg5m5vCSstClZmtdy359RVx2rQK5YlIWyPlrolpt2LEpVeKXWaiybo
client_type: confidential
authorization_grant_type: password
skip_authorization: no
curl -k --user <user>:<password> -H "Content-type: application/json" -X POST --data '{ "description": "Token for Nagios Monitoring app", "application": 1, "scope": "write" }' https://<controller>/api/v2/tokens/
HTTP/1.1 200 OK Server: nginx/1.12.2 Date: Tue, 05 Dec 2017 16:48:09 GMT Content-Type: application/json Content-Length: 163 Connection: keep-alive Content-Language: en Vary: Accept-Language, Cookie Pragma: no-cache Cache-Control: no-store Strict-Transport-Security: max-age=15768000 {"access_token": "9epHOqHhnXUcgYK8QanOmUQPSgX92g", "token_type": "Bearer", "expires_in": 315360000000, "refresh_token": "jMRX6QvzOTf046KHee3TU5mT3nyXsz", "scope": "read"}
id: 35
type: access_token
user: 1
token: omMFLk7UKpB36WN2Qma9H3gbwEBSOc
refresh_token: AL0NK9TTpv0qp54dGbC4VUZtsZ9r8z
application: 6
expires: 2017-12-06T03:46:17.087022Z
scope: read write
curl -X POST -d "grant_type=refresh_token&refresh_token=AL0NK9TTpv0qp54dGbC4VUZtsZ9r8z" -u "gwSPoasWSdNkMDtBN3Hu2WYQpPWCO9SwUEsKK22l:fI6ZpfocHYBGfm1tP92r0yIgCyfRdDQt0Tos9L8a4fNsJjQQMwp9569eIaUBsaVDgt2eiwOGe0bg5m5vCSstClZmtdy359RVx2rQK5YlIWyPlrolpt2LEpVeKXWaiybo" http://<controller>/api/o/token/ -i
HTTP/1.1 200 OK Server: nginx/1.12.2 Date: Tue, 05 Dec 2017 17:54:06 GMT Content-Type: application/json Content-Length: 169 Connection: keep-alive Content-Language: en Vary: Accept-Language, Cookie Pragma: no-cache Cache-Control: no-store Strict-Transport-Security: max-age=15768000 {"access_token": "NDInWxGJI4iZgqpsreujjbvzCfJqgR", "token_type": "Bearer", "expires_in": 315360000000, "refresh_token": "DqOrmz8bx3srlHkZNKmDpqA86bnQkT", "scope": "read write"}
curl -X POST -d "token=rQONsve372fQwuc2pn76k3IHDCYpi7" -u "gwSPoasWSdNkMDtBN3Hu2WYQpPWCO9SwUEsKK22l:fI6ZpfocHYBGfm1tP92r0yIgCyfRdDQt0Tos9L8a4fNsJjQQMwp9569eIaUBsaVDgt2eiwOGe0bg5m5vCSstClZmtdy359RVx2rQK5YlIWyPlrolpt2LEpVeKXWaiybo" http://<controller>/api/o/revoke_token/ -i
{ "Default": { "users": true }, "Test Org": { "admins": ["admin@example.com"], "users": true }, "Test Org 2": { "admins": ["admin@example.com", "/^controller-[^@]+?@.*USD/i"], "users": "/^[^@].*?@example\\.comUSD/" } }
SOCIAL_AUTH_GOOGLE_OAUTH2_ORGANIZATION_MAP = {} SOCIAL_AUTH_GITHUB_ORGANIZATION_MAP = {} SOCIAL_AUTH_GITHUB_ORG_ORGANIZATION_MAP = {} SOCIAL_AUTH_GITHUB_TEAM_ORGANIZATION_MAP = {} SOCIAL_AUTH_SAML_ORGANIZATION_MAP = {}
remove: yes
remove_admins: no
remove_auditors: no
saml_admin_attr: admin-of
saml_attr: organizations
2025-01-17 14:19:36,624 DEBUG [7d3cf3b24d4e4d0e9edd5e2606d6ceba] awx.sso.common SAML adapter removing user auditor1 permission of auditor_role from organization Default
{ "My Team": { "organization": "Test Org", "users": ["/^[^@]+?@test\\.example\\.comUSD/"], "remove": true }, "Other Team": { "organization": "Test Org 2", "users": ["/^[^@]+?@test\\.example\\.comUSD/"], "remove": false } }
SOCIAL_AUTH_GOOGLE_OAUTH2_TEAM_MAP = {} SOCIAL_AUTH_GITHUB_TEAM_MAP = {} SOCIAL_AUTH_GITHUB_ORG_TEAM_MAP = {} SOCIAL_AUTH_GITHUB_TEAM_TEAM_MAP = {} SOCIAL_AUTH_SAML_TEAM_MAP = {}
SOCIAL_AUTH_USER_FIELDS = []
-----BEGIN CERTIFICATE----- ... cert text -----END CERTIFICATE-----
-----BEGIN PRIVATE KEY----- ... key text -----END PRIVATE KEY-----
{ "en-US": { "url": "http://www.example.com", "displayname": "Example", "name": "example" } }
givenName: Some User
emailAddress: suser@example.com
givenName: Some User
emailAddress: suser@example.com
Username(urn:oid:0.9.2342.19200300.100.1.1) Email(urn:oid:0.9.2342.19200300.100.1.3) FirstName(urn:oid:2.5.4.42) LastName(urn:oid:2.5.4.4)
"myidp": { "entity_id": "https://idp.example.com", "url": "https://myidp.example.com/sso", "x509cert": "" }, "onelogin": { "entity_id": "https://app.onelogin.com/saml/metadata/123456", "url": "https://example.onelogin.com/trust/saml2/http-post/sso/123456", "x509cert": "", "attr_user_permanent_id": "name_id", "attr_first_name": "User.FirstName", "attr_last_name": "User.LastName", "attr_username": "User.email", "attr_email": "User.email" } }
<saml2:AttributeStatement> <saml2:Attribute FriendlyName="member-of" Name="member-of" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"> <saml2:AttributeValue>Engineering</saml2:AttributeValue> <saml2:AttributeValue>IT</saml2:AttributeValue> <saml2:AttributeValue>HR</saml2:AttributeValue> <saml2:AttributeValue>Sales</saml2:AttributeValue> </saml2:Attribute> <saml2:Attribute FriendlyName="admin-of" Name="admin-of" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"> <saml2:AttributeValue>Engineering</saml2:AttributeValue> </saml2:Attribute> </saml2:AttributeStatement>
saml_attr: member-of
saml_admin_attr: admin-of
remove: yes
remove_admins: no
<saml:AttributeStatement> <saml:Attribute xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500" x500:Encoding="LDAP" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" FriendlyName="eduPersonAffiliation"> <saml:AttributeValue xsi:type="xs:string">member</saml:AttributeValue> <saml:AttributeValue xsi:type="xs:string">staff</saml:AttributeValue> </saml:Attribute> </saml:AttributeStatement> { "saml_attr": "eduPersonAffiliation", "remove": true, "team_org_map": [ { "team": "member", "organization": "Default1" }, { "team": "staff", "organization": "Default2" } ] }
{ "remove": false, "team_org_map": [ { "team": "internal:unix:domain:admins", "organization": "Default", "team_alias": "Administrators" }, { "team": "Domain Users", "organization_alias": "OrgAlias", "organization": "Default" } ], "saml_attr": "member-of" }
// Indicates whether the <samlp:AuthnRequest> messages sent by this SP // will be signed. [Metadata of the SP will offer this info] "authnRequestsSigned": false, // Indicates a requirement for the <samlp:Response>, <samlp:LogoutRequest> // and <samlp:LogoutResponse> elements received by this SP to be signed. "wantMessagesSigned": false, // Indicates a requirement for the <saml:Assertion> elements received by // this SP to be signed. [Metadata of the SP will offer this info] "wantAssertionsSigned": false,
{ "is_superuser_attr": "blueGroups", "is_superuser_role": ["is_superuser"], "is_superuser_value": ["cn=My-Sys-Admins,ou=memberlist,ou=mygroups,o=myco.com"], "is_system_auditor_attr": "blueGroups", "is_system_auditor_role": ["is_system_auditor"], "is_system_auditor_value": ["cn=My-Auditors,ou=memberlist,ou=mygroups,o=myco.com"] }
ldapsearch -x -H ldap://win -D "CN=josie,CN=Users,DC=website,DC=com" -b "dc=website,dc=com" -w Josie4Cloud
OU=Users,DC=website,DC=com
SCOPE_SUBTREE
(cn=%(user)s)
[ [ "OU=Users,DC=northamerica,DC=acme,DC=com", "SCOPE_SUBTREE", "(sAMAccountName=%(user)s)" ], [ "OU=Users,DC=apac,DC=corp,DC=com", "SCOPE_SUBTREE", "(sAMAccountName=%(user)s)" ], [ "OU=Users,DC=emea,DC=corp,DC=com", "SCOPE_SUBTREE", "(sAMAccountName=%(user)s)" ] ]
dc=example,dc=com
SCOPE_SUBTREE
(objectClass=group)
first_name: givenName
last_name: sn
email: mail
name_attr: cn
member_attr: member
is_superuser: cn=superusers,ou=groups,dc=website,dc=com
is_system_auditor: cn=auditors,ou=groups,dc=website,dc=com
{ "LDAP Organization": { "admins": "cn=engineering_admins,ou=groups,dc=example,dc=com", "remove_admins": false, "users": [ "cn=engineering,ou=groups,dc=example,dc=com", "cn=sales,ou=groups,dc=example,dc=com", "cn=it,ou=groups,dc=example,dc=com" ], "remove_users": false }, "LDAP Organization 2": { "admins": [ "cn=Administrators,cn=Builtin,dc=example,dc=com" ], "remove_admins": false, "users": true, "remove_users": false } }
{ "LDAP Engineering": { "organization": "LDAP Organization", "users": "cn=engineering,ou=groups,dc=example,dc=com", "remove": true }, "LDAP IT": { "organization": "LDAP Organization", "users": "cn=it,ou=groups,dc=example,dc=com", "remove": true }, "LDAP Sales": { "organization": "LDAP Organization", "users": "cn=sales,ou=groups,dc=example,dc=com", "remove": true } }
AUTH_LDAP_ALWAYS_UPDATE_USER = False
automation-controller-service restart
2020-04-28 17:25:36,184 WARNING django_auth_ldap Caught LDAPError while authenticating e079127: SERVER_DOWN({'info': 'error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (unable to get issuer certificate)', 'desc': "Can't contact LDAP server"},)
2020-06-02 11:48:24,840 WARNING django_auth_ldap Caught LDAPError while authenticating reinernippes: SERVER_DOWN({'desc': "Can't contact LDAP server", 'info': 'error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (certificate has expired)'},)
cp ldap_server-CA.crt /etc/pki/ca-trust/source/anchors/
update-ca-trust
AUTH_LDAP_GLOBAL_OPTIONS = { ldap.OPT_REFERRALS: False, }
install krb5-workstation install krb5-devel install krb5-libs
[logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = WEBSITE.COM dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true [realms] WEBSITE.COM = { kdc = WIN-SA2TXZOTVMV.website.com admin_server = WIN-SA2TXZOTVMV.website.com } [domain_realm] .website.com = WEBSITE.COM website.com = WEBSITE.COM
kinit username Password for username@WEBSITE.COM:
klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: username@WEBSITE.COM Valid starting Expires Service principal 01/25/23 11:42:56 01/25/23 21:42:53 krbtgt/WEBSITE.COM@WEBSITE.COM renew until 02/01/23 11:42:56
[windows] win01.WEBSITE.COM [windows:vars] ansible_user = username@WEBSITE.COM ansible_connection = winrm ansible_port = 5986
root@localhost:~# ./setup.sh -b root@localhost:~# ./setup.sh -r
root@localhost:~# ./setup.sh -e 'backup_dest=/path/to/backup_dir/' -b
root@localhost:~# ./setup.sh -e 'restore_backup_file=/path/to/nondefault/backup.tar.gz' -r
setup.sh -i <inventory file>
"config.json": "1.1", "counts.json": "1.0", "cred_type_counts.json": "1.0", "events_table.csv": "1.1", "instance_info.json": "1.0", "inventory_counts.json": "1.2", "job_counts.json": "1.0", "job_instance_counts.json": "1.0", "org_counts.json": "1.0", "projects_by_scm_type.json": "1.0", "query_info.json": "1.0", "unified_job_template_table.csv": "1.0", "unified_jobs_table.csv": "1.0", "workflow_job_node_table.csv": "1.0", "workflow_job_template_node_table.csv": "1.0" }
{ "ansible_version": "2.9.1", "authentication_backends": [ "social_core.backends.azuread.AzureADOAuth2", "django.contrib.auth.backends.ModelBackend" ], "external_logger_enabled": true, "external_logger_type": "splunk", "free_instances": 1234, "install_uuid": "d3d497f7-9d07-43ab-b8de-9d5cc9752b7c", "instance_uuid": "bed08c6b-19cc-4a49-bc9e-82c33936e91b", "license_expiry": 34937373, "license_type": "enterprise", "logging_aggregators": [ "awx", "activity_stream", "job_events", "system_tracking" ], "pendo_tracking": "detailed", "platform": { "dist": [ "redhat", "7.4", "Maipo" ], "release": "3.10.0-693.el7.x86_64", "system": "Linux", "type": "traditional" }, "total_licensed_instances": 2500, "controller_url_base": "https://ansible.rhdemo.io", "controller_version": "3.6.3" }
{ "bed08c6b-19cc-4a49-bc9e-82c33936e91b": { "capacity": 57, "cpu": 2, "enabled": true, "last_isolated_check": "2019-08-15T14:48:58.553005+00:00", "managed_by_policy": true, "memory": 8201400320, "uuid": "bed08c6b-19cc-4a49-bc9e-82c33936e91b", "version": "3.6.3" } "c0a2a215-0e33-419a-92f5-e3a0f59bfaee": { "capacity": 57, "cpu": 2, "enabled": true, "last_isolated_check": "2019-08-15T14:48:58.553005+00:00", "managed_by_policy": true, "memory": 8201400320, "uuid": "c0a2a215-0e33-419a-92f5-e3a0f59bfaee", "version": "3.6.3" } }
{ "active_anonymous_sessions": 1, "active_host_count": 682, "active_sessions": 2, "active_user_sessions": 1, "credential": 38, "custom_inventory_script": 2, "custom_virtualenvs": 4, "host": 697, "inventories": { "normal": 20, "smart": 1 }, "inventory": 21, "job_template": 78, "notification_template": 5, "organization": 10, "pending_jobs": 0, "project": 20, "running_jobs": 0, "schedule": 16, "team": 5, "unified_job": 7073, "user": 28, "workflow_job_template": 15 }
{ "1": { "name": "Operations", "teams": 5, "users": 17 }, "2": { "name": "Development", "teams": 27, "users": 154 }, "3": { "name": "Networking", "teams": 3, "users": 28 } }
{ "1": { "credential_count": 15, "managed_by_controller": true, "name": "Machine" }, "2": { "credential_count": 2, "managed_by_controller": true, "name": "Source Control" }, "3": { "credential_count": 3, "managed_by_controller": true, "name": "Vault" }, "4": { "credential_count": 0, "managed_by_controller": true, "name": "Network" }, "5": { "credential_count": 6, "managed_by_controller": true, "name": "Amazon Web Services" }, "6": { "credential_count": 0, "managed_by_controller": true, "name": "OpenStack" },
{ "1": { "hosts": 211, "kind": "", "name": "AWS Inventory", "source_list": [ { "name": "AWS", "num_hosts": 211, "source": "ec2" } ], "sources": 1 }, "2": { "hosts": 15, "kind": "", "name": "Manual inventory", "source_list": [], "sources": 0 }, "3": { "hosts": 25, "kind": "", "name": "SCM inventory - test repo", "source_list": [ { "name": "Git source", "num_hosts": 25, "source": "scm" } ], "sources": 1 } "4": { "num_hosts": 5, "kind": "smart", "name": "Filtered AWS inventory", "source_list": [], "sources": 0 } }
git: 27
hg: 0
insights: 1
manual: 0
svn: 0
collection_type: manual
current_time: 2019-11-22 20:10:27.751267+00:00
last_run: 2019-11-22 20:03:40.361225+00:00
"launch_type": { "dependency": 3628, "manual": 799, "relaunch": 6, "scheduled": 1286, "scm": 6, "workflow": 1348 }, "status": { "canceled": 7, "failed": 108, "successful": 6958 }, "total_jobs": 7073 }
{ "localhost": { "launch_type": { "dependency": 3628, "manual": 770, "relaunch": 3, "scheduled": 1009, "scm": 6, "workflow": 1336 }, "status": { "canceled": 2, "failed": 60, "successful": 6690 } } }
SESSION_COOKIE_SECURE = False CSRF_COOKIE_SECURE = False
automation-controller-service restart
chown awx -R /var/lib/awx/projects/
vpc_destination_variable: private_ip_address
awx-manage changepassword admin
awx-manage createsuperuser
Host tampa Hostname 10.100.100.11 IdentityFile [privatekeyfile] Host 10.100.. Proxycommand ssh -W [jumphostuser]@%h:%p tampa
ansible_user: <user_name> ansible_connection: ssh ansible_ssh_common_args: '-o ProxyCommand="ssh -W %h:%p -q <user_name>@<jump_server_name>"'
ansible -m setup hostname
curl -f -k -H 'Content-Type: application/json' -XPOST --user admin:awxsecret ht p://192.168.42.100/api/v2/job_templates/1/launch/
curl -f -k -H 'Content-Type: application/json' -XPOST -d '{"extra_vars": "{\"foo\": \"bar\"}"}' --user admin:awxsecret http://192.168.42.100/api/v2/job_templates/1/launch/
--- - hosts: tag_Name_webserver tasks:
inventory/ |-- group_vars | `-- mygroup |-- host_vars | `-- myhost `-- hosts
awx-manage inventory_import --source=inventory/ --inventory-name="My Controller Inventory"
awx-manage inventory_import --source=./ansible-hosts --inventory-name="My Controller Inventory"
awx-manage inventory_import --source=inventory/ --inventory-name="My Controller Inventory" --overwrite --overwrite-vars
ValueError: need more than 1 value to unpack
mkdir -p inventory-directory/group_vars