Managing Enterprise Automation with Red Hat Ansible Automation Platform

Procedure 6.2. Instructions

1. Review the automation controller resources created by the lab command for this exercise.

   The lab command configured a workflow job template named DEV - Deploy HTTPS and Populate Webservers. You can add an approval node to that workflow job template that uses an existing notification template to alert your operations team by email. If you add that approval node at the beginning of the workflow job template, then your operations team must approve jobs launched using the workflow job template before the next on success node in the job runs.

   1. Navigate to https://controller.lab.example.com and log in as the admin user with redhat as the password.

   2. Navigate to Resources → Templates. The lab command created the workflow job template and the job templates used in this exercise. The DEV - Deploy HTTPS and Populate Webservers workflow job template runs the DEV - Deploy HTTPS job template and then runs either the DEV - Populate Webservers job template if the previous job succeeds, or the DEV - Revert HTTPS job template if the previous job fails.

   3. Navigate to Administration → Notifications. You can see the Email AAP Admins notification listed as a notification template of type Email. Click the Test notification icon for the notification template and wait for the Status column to display the Successful message. This ensures that the notification is working as expected.

   4. Navigate to Access → Teams. You can see the Developers and Operations teams listed as part of the Default organization.

2. Insert a workflow approval node as the first step for the workflow job template and modify the workflow so that it only executes when approved.

   1. Navigate to Resources → Templates and click the Visualizer icon for the DEV - Deploy HTTPS and Populate Webservers workflow job template.

   2. In the workflow visualizer, hover over the line connecting the START button and the Synchronize Project node, and then click the + icon (notice the Add a new node between these two nodes description at the upper-left corner of the workflow editor).

   3. Create the new node using the following information. Do not modify any of the other fields. Click Save when finished.

      Field	Value
      Node Type	Approval
      Name	Dev approval
      Description	Require approval before even starting the workflow
      Timeout (min)	60
      Alias	Approval

   4. Hover over the line connecting the new Approval approval node and the Synchronize Project node and click the Edit this link icon.

      Figure 6.18: Editing an existing link in the workflow

   5. In the Run list, choose On Success and click Save. Notice how the line that connects the two nodes changes from blue (Always) to green (On Success).

   6. Click Save in the upper-right corner to save the changes you made to the workflow job template.

      Figure 6.19: Inserted approval node as the first step for the workflow

3. On the DEV - Deploy HTTPS and Populate Webservers workflow job template, assign the Approve role to the Developers team. Give the Operations team the Execute role.

   1. Navigate to Resources → Templates and click the DEV - Deploy HTTPS and Populate Webservers link.

   2. Click the Access tab and then click Add.

   3. Click Teams and then click Next.

   4. Select the Developers team and then click Next.

   5. Select the Approve role and then click Save to assign the role. Because they are part of the Developers team, the daniel and david users now have the Approve role.

   6. Click Add again, select Teams, and then click Next.

   7. Select the Operations team and then click Next.

   8. Select the Execute role and then click Save to assign the role. Because they are part of the Operations team, the oliver and ophelia users now have the Execute role.

4. Configure the workflow job template to use the Email AAP Admins notification template. When a workflow job launched by the template requests an approval, it should trigger the notification.

   1. Navigate to Resources → Templates and click the DEV - Deploy HTTPS and Populate Webservers link.

   2. Click the Notifications tab and set Approval to on for the Email AAP Admins notification.

      Figure 6.20: Notification for a required approval

5. Run the workflow job template as user ophelia, who is a member of the Operations team.

   1. Navigate to admin → Logout to log out of the admin account. Log in again, using the ophelia user, with redhat123 as the password.

      Important

      Because you were on the Notifications tab when you logged out as the admin user, when you log in with the ophelia user, the web UI attempts to return to the same tab.

      The ophelia user only has the Execute role on the workflow job template. Consequently, the ophelia user does not have permission to see the notifications associated with the workflow job template, and the web UI displays a Not Found message.

   2. Navigate to Resources → Templates. Because the Operations team has the Execute role, and the ophelia user is a member of that team, the ophelia user can launch the DEV - Deploy HTTPS and Populate Webservers workflow job template.

   3. Click the Launch Template icon for the DEV - Deploy HTTPS and Populate Webservers workflow job template. A workflow job launches, but its workflow stops at the approval node.

   4. Notice that the Pending Workflow Approvals icon at the top of the page indicates one pending workflow approval. Click the icon and then select the checkbox for the Dev approval workflow approval. Even though the ophelia user can see the workflow approval, that user does not have sufficient permissions to approve it.

   5. Click the notification icon in the top of the page, then select the checkbox for the Dev approval workflow approval. Even though the ophelia user can see the workflow approval, that user does not have sufficient permissions to approve it.

6. Verify that the workflow job triggered a notification email. In a real situation, this mail would reach the people with permissions to approve the workflow. In this exercise, those people are the members of the Developers team.

   1. Open a terminal and connect to the utility server.

      [student@workstation ~]$ ssh student@utility

   2. Use the tail command to read incoming email messages delivered to the local mailbox file of the student user. You should see the email that was sent for the approval. Your message looks similar to the following example:

      [student@utility ~]$ tail -f /var/mail/student
          "id": 4,
          "name": "Dev approval",
          "url": "https://controller.lab.example.com/#/jobs/workflow/3",
          "created_by": "ophelia",
          "started": "2022-05-05T18:00:11.884846+00:00",
          "finished": null,
          "status": "pending",
          "traceback": ""
      }

7. As user david, who is a member of the Developers team, approve the workflow job.

   1. Navigate to ophelia → Logout to log out as user ophelia. Log in again as the david user, with redhat123 as the password.

   2. Click the notification icon, and then select the checkbox for the Dev approval workflow approval. The david user has the permissions needed to approve or deny the approval request.

   3. Click Approve to approve the request.

   4. Go to the terminal window that is running the tail command and wait. After a few seconds, you should see a notification email arrive that looks similar to the following example:

      From system@controller.lab.example.com  Thu May  5 14:18:35 2022
      Return-Path: <system@controller.lab.example.com>
      X-Original-To: aap-admins@lab.example.com
      Delivered-To: aap-admins@lab.example.com
      Received: from controller.lab.example.com (controller.lab.example.com [172.25.250.7])
              by utility.lab.example.com (Postfix) with ESMTPS id B5ABD938DAC
              for <aap-admins@lab.example.com>; Thu,  5 May 2022 14:18:35 -0400 (EDT)
      Received: from controller.lab.example.com (localhost [IPv6:::1])
              by controller.lab.example.com (Postfix) with ESMTP id 9DF3A30404AA
              for <aap-admins@lab.example.com>; Thu,  5 May 2022 14:18:35 -0400 (EDT)
      Content-Type: text/plain; charset="utf-8"
      MIME-Version: 1.0
      Content-Transfer-Encoding: 7bit
      Subject: The approval node "Dev approval" was approved.
       https://controller.lab.example.com/#/jobs/workflow/3
      From: system@controller.lab.example.com
      To: aap-admins@lab.example.com
      Date: Thu, 05 May 2022 18:18:35 -0000
      Message-ID:
       <165177471562.4668.18225658775475317495@controller.lab.example.com>
      
      The approval node "Dev approval" was approved. https://controller.lab.example.com/#/jobs/workflow/3
      
      {
          "id": 4,
          "name": "Dev approval",
          "url": "https://controller.lab.example.com/#/jobs/workflow/3",
          "created_by": "ophelia",
          "started": "2022-05-05T18:00:11.884846+00:00",
          "finished": "2022-05-05T18:18:35.040965+00:00",
          "status": "successful",
          "traceback": ""
      }

      When finished, press Ctrl+C to exit the tail command.

   5. Exit the terminal session on the utility system.

      [student@utility ~]$ exit

8. Verify that the workflow job completed successfully.

   1. Navigate to Views → Jobs and wait for the workflow job to finish.

   2. After the job succeeds, click the link for the job name, such as the 3 — DEV - Deploy HTTPS and Populate Webservers link, to see the workflow results for the completed job. The number in the job name might be different from the one listed here.

      Figure 6.21: The results of the completed workflow

9. (Optional) Repeat the exercise starting at step 5. This time, have the david user deny the approval request for the workflow job.

10. Log out from the automation controller web UI.