Managing Enterprise Automation with Red Hat Ansible Automation Platform

For various reasons, you might want to require that a particular person or group explicitly approve or reject execution of a workflow job template.

You can add approval nodes to a workflow job template that pause the workflow until a user with an appropriate role manually approves or rejects further execution of the workflow. You can also set a time limit on the approval node, so that further execution is automatically rejected if execution is not approved before the limit expires. It is possible to add several approval nodes inside a workflow, on various branches of a workflow, and at the start of a workflow.

Some reasons to use approval nodes within your workflow job templates include:

You can create an approval node through the workflow visualizer in the automation controller UI. To create an approval node, you need to be logged in as a user with sufficient permissions:

There are several different ways to add approval nodes to a workflow:

Whichever method you use, select Approval in the Node Type field when you create the new node or edit the existing node.

For example, if you need approval before running a job template then click directly on the line. A pop-up window opens that displays the message Add a new node between these two nodes.

Figure 6.11: Creating an approval node before the first job template node

If you want to replace an existing node with an approval node, click the Edit this node pencil icon on the job template.

Figure 6.12: Editing the "Set up WEB STACK" job template node to make it an approval node instead

To view workflow approval requests, you need to have the Admin, Execute, Read, or Approve role on the workflow job template, or the System Administrator or System Auditor user type.

The Pending Workflow Approvals icon at the top of the page displays the number of workflows that require your approval. This number indicates how many workflow approval requests are pending.

Figure 6.13: Notification waiting

Click the Pending Workflow Approvals icon to see pending workflow approval requests, or navigate to Views → Workflow Approvals to see all workflow approval requests. Click the name of the pending workflow approval request that you want to approve or deny.

To actually approve or deny a workflow approval request, you must have either the Admin or the Approve role on the workflow job template. As always, a user with the System Administrator user type can perform any action. If you do not have sufficient access, then the Approve and Deny buttons are unavailable.

Figure 6.14: Pending workflow approval request

Often, you want workflow approval requests to be approved or denied within a certain period of time. You can set a time-out that automatically denies a request if it has not been approved within a certain time limit.

You can set a time-out from the Add Node page. Click the down arrow of the Node Type drop-down list and select Approval. There are two fields in the Timeout section, for minutes and seconds. This specifies the length of time before the approval request expires and is automatically denied.

If you leave both fields blank, then no time-out is set. The workflow approval request never expires, and the workflow job waits indefinitely for manual approval or denial.

Figure 6.15: Setting the approval time-out

When you review pending workflow approval requests in automation controller, you can see their expiration times in the Status column.

Figure 6.16: Workflow approval with an expiration time

If someone does not approve the pending workflow approval request within the specified time limit, it is automatically denied and the next nodes that have an Always or On Failure configuration run.

If the pending workflow approval request is approved, then the next nodes that have an Always or On Success configuration run.

It is a good idea to use notifications in your workflow job template to alert the people who address workflow approval requests that a new request needs review. Notifications also alert the users about whether a workflow approval has been approved, denied, or timed out.

To configure your workflow job template to send workflow approval notifications, first make sure that you have configured an appropriate notification. IRC, Slack, email, or webhooks that you integrate with other chat or notification applications might be appropriate. You can customize the message that the notification sends if necessary.

Navigate to Templates and select the name of your workflow job template. Click Notifications and find the notification you want to use. You can use the search field to help locate the notification. For that notification, look in the Options column and enable Approval.

Figure 6.17: Enabling a notification for approval activity on a workflow job template

Remember to test your workflow job template to confirm that workflow approval notifications are being sent.