Managing Enterprise Automation with Red Hat Ansible Automation Platform

If you plan to host automation execution environments on private automation hub, then you might add one or more remote registries to private automation hub. You can choose how frequently you synchronize images from the remote registries, and you might even remove images from private automation hub. By hosting container images on private automation hub, you have a standard location for them to help control which images are used in your organization.

Use the following procedure to add the Red Hat Ecosystem Catalog remote registry to a private automation hub.

You can selectively synchronize specific container repositories.

After synchronization completes, you can view the available images. Navigate to Execution Environments → Execution Environments, click the name of a container repository, and then select the Images tag. Some images have more than one tag. For Ansible Automation Platform 2.1, the most recent image has several tags, such as 1.0 and latest.

Figure 1.10: Multiple image tags

Rather than synchronizing individual container repositories, you can synchronize all Ansible Automation Platform container repositories (this includes versions of the Ansible Automation Platform 2.0, 2.1, and 2.2 automation execution environment container images).

Figure 1.11: Synchronizing a remote registry

Organizations might choose to manually upload container images to private automation hub, such as custom automation execution environments or other approved container images.

The skopeo command (provided by the skopeo RPM) can perform several tasks on container images, such as inspecting both local and remote images, uploading a local archive to a remote repository, and copying container images from one repository to another without needing to download it to the local machine.

If a remote repository requires authentication, then use the skopeo login command to log in to the container registry. This is typically required in order to push or copy a container image to a remote repository. Authentication might also be required to inspect or copy a remote repository image.

[user@host ~]$ skopeo login registry.redhat.io
Username: your-username
Password: your-password
Login Succeeded!

Use the skopeo inspect command to inspect details of a container image. For example, you might use the command to inspect the ee-minimal-rhel8:latest container image, available from the Red Hat Ecosystem Catalog.

[user@host ~]$ skopeo inspect \
> docker://registry.redhat.io/ansible-automation-platform-22/ee-minimal-rhel8
...output omitted...

Use the skopeo copy command to copy a container image (either local or remote) to a remote registry. When copying from one remote registry to another, you might need to log in to both registries. If you prefer not to log in, then the skopeo copy command has options for specifying credentials from the command line. The following example copies a local archive to a remote registry and adds the 1.0 tag to the container image.

[user@host ~]$ skopeo copy docker-archive:///tmp/ee-29-rhel8.tar \
> docker://hub.lab.example.com/ansible-automation-platform-22/ee-29-rhel8:1.0
...output omitted...

Synchronizing content from a remote registry can download more content than you need. If you do not need a container repository, then you can delete it. For example, you might not need the Ansible Automation Platform 2.0 container repositories that appear when you synchronize all of container repositories from the https://registry.redhat.io remote registry.

To delete a container registry:

Figure 1.12: Deleting a container repository

An individual container repository can contain many container images, especially if it is synchronized from a remote registry. To delete an individual container image:

Figure 1.13: Deleting a container image

If you manually upload container images, then you might need to add new tags or remove tags from container images. Container images can have more than one tag, but the tags used within a container repository must be unique. For example, only one container image in a container repository can have the latest tag or the 1.0 tag.

Use the skopeo inspect command to display details about a container image. You can filter the output with the --format option to only display specific information, such as the version and release of the image. When not specified, the container image tag defaults to the latest tag. In the following example, the version and release of the latest container image available from the Red Hat Ecosystem Catalog is 1.0.1-27.

[user@host ~]$ skopeo inspect \
> --format "{{ .Labels.version }}-{{ .Labels.release }}" \
> docker://registry.redhat.io/ansible-automation-platform-22/ee-supported-rhel8
1.0.0-113

The 1.0.0-113 matches a tag visible from the Red Hat Ecosystem Catalog for the ansible-automation-platform-22/ee-supported-rhel8 container repository.

Figure 1.14: Tags visible from the Red Hat Ecosystem Catalog

You can manage container image tags from the private automation hub web UI.

Synchronizing Ansible Content Collections from automation hub (available at https://console.redhat.com/ansible/automation-hub) is the most efficient way to make Red Hat Ansible Certified Content Collections available to your private automation hub. Red Hat reviews, maintains, updates, and fully supports those collections. By using Red Hat Ansible Certified Content Collections instead of the collections from Ansible Galaxy, you benefit from the support from Red Hat.

Figure 1.15: Allowing collection synchronization

Within automation hub, navigate to Collections. If you are an automation hub administrator for your organization, then each collection has a Sync button. When enabled, this button allows the collection to be synchronized with your private automation hub. By synchronizing, you can provide a curated set of collections to your users from your private automation hub.

The following process synchronizes Ansible Content Collections (that have been marked for synchronization) from automation hub to private automation hub.

Remote repository synchronization creates the relevant namespaces for the Ansible Content Collections.

You can also synchronize Ansible Content Collections from Ansible Galaxy.

Figure 1.16: Successful remote repository synchronization

You can manually add Ansible Content Collections to private automation hub, such as custom Ansible Content Collections created by your organization. Organizations in a disconnected environment can also use this method to add previously downloaded Ansible Content Collections to their private automation hub.

Both automation hub (available at https://console.redhat.com/ansible/automation-hub) and Ansible Galaxy (available at https://galaxy.ansible.com) allow downloading Ansible Content Collections as TAR files. After locating an Ansible Content Collection, select a specific version and then click the Download tarball link. If you do not select a version, then you download the latest version of the Ansible Content Collection.

Figure 1.17: Downloading an Ansible Content Collection

The following procedure creates an Ansible Content Collection namespace.

The following procedure uploads an Ansible Content Collection to an existing namespace.

By default, private automation hub requires a user to approve uploaded Ansible Content Collections. Use the following procedure to approve or reject an uploaded Ansible Content Collection.

You can configure private automation hub to automatically approve uploaded Ansible Content Collections. Set the automationhub_require_content_approval variable to False in the installation inventory file. If you change this value after installation, then run the setup.sh installation script again to apply the change.

The Demo Project project resource pulls content from the Git repository located at https://github.com/ansible/ansible-tower-samples. Navigate to Resources → Projects and click the Sync Project icon.

Initiating a project synchronization verifies two things:

The installer uses the registry_url, registry_username, and registry_password variables in the installer inventory file to create the Default Execution Environment Registry Credential container registry credential. Navigate to Resources → Credentials on your automation controller to display existing credentials. The automation controller web UI does not allow you to make changes to the Default Execution Environment Registry Credential container registry credential. If you need to make a change, then modify the relevant inventory variables and run the setup.sh installation script again.

The installer creates the Demo Credential machine credential. The Demo Credential machine credential is not immediately useful by default. Recall that a machine credential allows automation controller to connect to machines.

You might modify the Demo Credential machine credential to use a valid username, and either a password or SSH private key for authentication, so that it can connect to machines in your environment.

The installer creates the Demo Inventory inventory resource, which includes the localhost host resource. When you run a playbook in an automation execution environment with automation controller, localhost refers to the automation execution environment container, not the automation controller that launched the job.

Navigate to Resources → Inventories to display existing inventories. Navigate to Resources → Hosts to display existing hosts.

To test functionality, you might consider adding a host from your environment to the Demo Inventory inventory. If so, then you should also update the Demo Credential machine credential. You might also delete the localhost host from the Demo Inventory inventory.

The Demo Job Template job template uses the hello_world.yml playbook from the Demo Project project. The job template targets all hosts defined in the Demo Inventory and uses the Demo Credential machine credential. Because localhost in the default inventory is configured to use a local connection, it is not necessary to use the Demo Credential machine credential when targeting just this host.

Navigate to Resources → Templates to display existing templates. Launching the Demo Job Template template initiates a job. The hello_world.yml playbook uses the debug module to print a Hello, World! message.