Red Hat Security: Linux in Physical, Virtual, and Cloud
This course is now legacy content
This course is using an outdated version of the technology and is now considered to be Legacy content. It will be removed from our catalog on June 28, 2024. Please be sure to complete your course and finish any remaining labs before that date. We recommend moving to version 9.2, which is the latest version currently available.
Objectives
After completing this section, students should be able to remediate issues reported by Red Hat Insights using Red Hat Ansible Engine and Red Hat Ansible Tower integration with Red Hat Satellite.
Remediating Issues from Insights with Ansible
You can create Ansible Playbooks in Red Hat Insights to remediate many of the issues it reports. When you create these playbooks you can tailor them for individual systems, and you may be able to choose between different approaches to mitigating or fixing problems.
To create an Ansible Playbook that you can use to automatically resolve issues, you need to use the Red Hat Insights to create a maintenance plan. In the maintenance plan you select the issues you want to resolve with this playbook. If there are multiple ways to address the issues, you need to select the approach you want to use to resolve them. Then you can download the resulting Ansible Playbook from Red Hat Insights and run it using the ansible-playbook command or Ansible Tower.
Creating a Red Hat Insights Maintenance Plan
You can create a Red Hat Insights maintenance plan using either the Insights Customer Portal or the Satellite Server's web UI. There are a number of ways to set up a plan. You can use the Planner tab or menu item to set up a maintenance plan to address issues that affect a specific host or host group, or that affect any of your registered systems. Alternatively, you can use the Inventory tab or menu item to select individual systems and then select the issues you want to fix.
 |
To create a maintenance plan in Red Hat Insights using the Customer Portal or the Red Hat Satellite Server's web UI:
Click the Inventory tab if you are using the Insights Customer Portal, or select → if you are using a Red Hat Satellite Server.
Select the registered systems to be included in the plan and choose → .
Select the check box associated with each issue that you want to remediate by the maintenance plan.
Click .
Sometimes, there will be more than one option to address an issue. In that case, a dialog box displays and prompts you to select which option the maintenance plan should use. Select the one you want, and click .
Figure 11.10: Selecting an issue resolution when creating an Insights plan
All the existing plans are listed in the Planner tab of the Insights Customer Portal. To list the plans in Satellite UI, navigate to → . Click to add actions to an existing plan.
Ansible Playbooks are generated at the time the maintenance plan is created. Click to download the playbook. Save the playbook YAML file in an appropriate directory.
Important
Ansible Playbooks are not available for all Red Hat Insights rules. Maintenance plans that include rules for which there is no playbook shows the disabled.
Creating a Maintenance Plan to Remediate Issues with Ansible Playbook
To create a maintenance plan to remediate issues with Ansible Playbooks provided by the Insights Customer Portal, the overall process is as follows:
Log in to the Customer Portal interface for Red Hat Insights at
https://access.redhat.com/insights.Click the Inventory tab.
Select the systems you want to include in the maintenance plan. All systems are listed by default, but you can use the filter to retrieve the list of systems based on groups, status, and health.
From the list, located above the list of systems, click or .
In the Plan/Playbook Builder dialog box, if you are creating a new plan, provide the plan name. If you are adding to an existing plan, choose it by name.
Select the check box associated with each issue that you want to remediate by the maintenance plan. Click .
If any issues provide more than one resolution, a dialog box displays for each one, prompting you to select the resolution for that issue that the maintenance plan should use. Select a resolution and click .
On the Maintenance Planner page, review the issues that are included in the plan. Click Edit to add or remove systems affected by the issue.
Click .
From an Ansible control host, run the following command to remediate the issues on the affected system:
[devops@demo ~]$ansible-playbookdemo-remediate-36366.ymlAfter applying the remediation steps on the system, the Ansible Playbook uploads the changes to the Insights Customer Portal.
On the Insights Customer portal, click the Inventory tab. Click the system name in the System Name column, and verify that the issue no longer appears in the list of issues.
 |
Automating Insights Remediation using Red Hat Ansible Tower
Integrating Red Hat Ansible Tower with Red Hat Insights allows you to automate Insights remediation for a group of registered systems. In Ansible Tower, you can create a Source Control Manager (SCM) project that uses Red Hat Insights as the SCM for the project's Ansible Playbooks. You need to create a credential in Ansible Tower of type Insights to store the user name and password for your Red Hat Insights account, and then configure your project to use that credential for authentication.
One of the advantages of this configuration is that users can run maintenance plan Ansible Playbooks from Ansible Tower without having direct access to the credentials for the Red Hat Insights account. These credentials are stored in Ansible Tower, and you can use Ansible Tower's permissions system to protect them from being read directly.
Creating Credentials for Insights in Ansible Tower
The Insights credential stores the user name and password used to log in to the Red Hat Insights interface in the Customer Portal. The Red Hat Insights project in Ansible Tower uses the Insights credential to download the Ansible Playbooks created using the Insights planner, and to list the Insights actions associated with a registered system.
To create a Red Hat Insights credential in Ansible Tower, click the gear icon at the upper-right of the web UI (SETTINGS), and then click CREDENTIALS to access the CREDENTIALS page. Click at the upper-right corner of the CREDENTIALS screen. Configure the following settings for the Insights credential:
NAME: Enter a name for your Red Hat Insights credential.
ORGANIZATION: Enter the name of the Ansible Tower organization that should own this credential.
CREDENTIAL TYPE: Select Insights.
Enter a valid USERNAME and PASSWORD for a Customer Portal account with access to your Red Hat Insights information. Click .
 |
Creating an Insights Project in Ansible Tower
Ansible Tower projects support a special SCM repository type specifically for Red Hat Insights. If you select this type, the project will get its Ansible Playbooks directly from the maintenance plans that you have created in Red Hat Insights.
To create an Insights project in Ansible Tower, navigate to the PROJECTS tab. Click and then enter the following information:
NAME: Enter a name for your Red Hat Insights project.
ORGANIZATION: Enter the name of the Ansible Tower organization that should own this project.
SCM TYPE: Choose Red Hat Insights.
CREDENTIAL: Select the name of your Insights credential on Ansible Tower.
 |
Creating an Inventory for Insights in Ansible Tower
The Ansible Playbooks created by Red Hat Insights specify specific hosts by name for each play. The host names in the inventory used by Ansible Tower must match the names used for registered systems in the Red Hat Insights Customer Portal. The hosts in the inventory can be added manually or can be fetched as dynamic inventory from Red Hat Satellite.
Important
It is particularly important that you configure an Ansible Tower inventory that uses the same host names as Red Hat Insights when you register hosts to Red Hat Insights using obfuscated host names.
To create a new inventory for use with Insights, click the INVENTORIES tab. Click and then enter the following information:
NAME: Enter the name of the Insights inventory.
ORGANIZATION: Enter the name of the organization for the Insights inventory.
INSIGHTS CREDENTIAL: Choose the Insights credential created in Ansible Tower.
Click the HOSTS tab and then click to add the Insights inventory hosts manually. Alternatively, click the SOURCES tab and then click to add the Satellite Server as the inventory source using the Satellite Server credential settings in Ansible Tower.
Importing Maintenance Plan Playbooks into Ansible Tower
To allow Ansible Tower to use the Ansible Playbooks from Red Hat Insights maintenance plans, the playbooks must be imported from your Red Hat Insights account into your project in Ansible Tower.
Create a scan project using the https://github.com/ansible/awx-facts-playbooks URL.
Use the following fields to enter Insights scan project-specific values:
NAME: Enter a name for your Red Hat Insights scan project.
ORGANIZATION: Enter the name of the Ansible Tower organization that should own the Red Hat Insights scan project.
SCM TYPE: Choose .
SCM URL: Enter
https://github.com/ansible/awx-facts-playbooks.
After the scan project is configured, create a scan job template that uses the scan facts playbook from that project. Click the TEMPLATES tab to create a job template. Use the following fields to create an Insights scan job template:
NAME: Enter a name for the Insights scan job template.
JOB TYPE: Choose .
INVENTORY: Enter the name of your Insights inventory.
PROJECT: Enter the name of your Insights scan project.
PLAYBOOK: Choose .
CREDENTIAL: Choose the name of the credential used to access the machines in your inventory. This is not the Insights credential.
Use Fact Cache: Select the check box under the OPTIONS section.
After creating the job template, launch the scan job template. When the job completes, the button will appear for each host in the Insights inventory, which lists the issues reported by Red Hat Insights.
Viewing Red Hat Insights Reports in Ansible Tower
For every host registered to Red Hat Insights and added to the inventory in Ansible Tower, issue information reported by Red Hat Insights about the system is listed in Ansible Tower.
To list the Insights reports in Ansible Tower:
Navigate to the HOSTS tab in the Insights inventory.
Click the host from the inventory list.
Click to list the Insights reports for the specific host.
Click to see the information in the Insights Customer Portal.
 |
Remediating Issues Reported by Insights in Ansible Tower
In Ansible Tower you can click to remediate issues reported by Red Hat Insights.
Navigate to the HOSTS tab in the Insights inventory.
Click the host from the inventory list.
Click to list the Insights reports for the specific host.
Click to display an Ansible Tower job template dialog box. Notice that the INVENTORY and PROJECT fields are prepopulated.
For PLAYBOOK, choose an Ansible Playbook associated with an Insights maintenance plan.
For CREDENTIAL, ensure that the credential used for running the remediation job template is a machine credential. This credential allows Ansible Tower to access the hosts on which remediation playbook is executed. This is not the Insights credential.
For VERBOSITY, and Enable Privilege Escalation under the OPTIONS section, select the appropriate value for the field. Leave all other settings to defaults.
Click .
Click the launch icon (a rocket) to launch the job template.
 |
Watch this video as the instructor shows how to remediate client issues reported by the Insights customer portal using Ansible Tower.
Demonstration: Remediating Issues Reported by Insights on Clients Using Ansible Tower
Log in to Ansible Tower.
Create a new Insights credential, using the user name and password for your Customer Portal account with Red Hat Insights access.
Create a project in Tower. Set the SCM TYPE to Red Hat Insights. Set the CREDENTIALS field to the name of the Insights credential you created. Click .
Create an Insights inventory.
Click the HOSTS tab and click to add new hosts manually.
Alternatively, create a dynamic inventory of type Red Hat Satellite 6, with your Satellite Server as the source, to include its registered hosts. Click the SOURCES tab and click to add your Satellite Server as a source. Click to get the hosts list.
Create an Insights scan project in Ansible Tower. Set its SCM TYPE to . For the SCM URL, enter
https://github.com/ansible/awx-facts-playbooks. Click .Create a scan job template using the Insights scan project. Use the fact scan playbook to get information about all hosts from Red Hat Insights.
Run the job template.
In Ansible Tower, confirm that you can view the Red Hat Insights issues for your hosts. Navigate to the Insights inventory and click the HOSTS tab. Click a host name in the HOSTS column to display its host details. The INSIGHTS tab provides the list of issues reported by Red Hat Insights.
To remediate issues, click to create a new job template for remediation.
In New Job Template, choose the playbook created by the Insights planner. Configure the job template with the machine credential needed to manage the hosts. This is not the Insights credential, but the one with administrative access to the hosts themselves.
Launch the job template to remediate issues on the registered systems.
References
For more information, refer to the Setting up an Insights Project chapter in Ansible Tower User Guide at https://docs.ansible.com/ansible-tower/latest/html/userguide/insights.html
For more information, refer to the Creating a Plan chapter in the Creating Insights Maintenance Plans with Ansible Playbook Integration at https://access.redhat.com/documentation/en-us/red_hat_insights/1.0/html-single/creating_insights_maintenance_plans_with_ansible_playbook_integration/#creating_a_plan
