Automation controller administration guide
Automation controller administration guide Red Hat Ansible Automation Platform 2.4 Administrator Guide for Automation Controller Red Hat Customer Content Services
subscription-manager list --available --all | grep "Ansible Automation Platform" -B 3 -A 6 Subscription Name: Red Hat Ansible Automation Platform, Premium (5000 Managed Nodes) Provides: Red Hat Ansible Engine Red Hat Single Sign-On Red Hat Ansible Automation Platform SKU: MCT3695 Contract: ******** Pool ID: ******************** Provides Management: No Available: 4999 Suggested: 1 subscription-manager attach --pool=<pool_id> subscription-manager list --consumed #subscription-manager remove --pool=<pool_id> root@localhost:~USD automation-controller-service restart [main] 127.0.0.1 _awx_description="my host 1" 127.0.0.2 _awx_description="my host 2" { "_meta": { "hostvars": { "host1": { "fly_rod": true } } }, "all": { "children": [ "groupA", "ungrouped" ] }, "groupA": { "hosts": [ "host1", "host10", "host11", "host12", "host13", "host14", "host15", "host16", "host17", "host18", "host19", "host2", "host20", "host21", "host22", "host23", "host24", "host25", "host3", "host4", "host5", "host6", "host7", "host8", "host9" ] } } GET /api/v2/job_templates/N/credentials/ POST /api/v2/job_templates/N/credentials/ {'associate': true, 'id': 'X'} POST /api/v2/job_templates/N/credentials/ {'disassociate': true, 'id': 'Y'} POST /api/v2/job_templates/N/launch/ {'credentials': [A, B, C]}` POST /api/v2/job_templates/N/credentials/ { 'associate': true, 'id': X } GET /api/v2/job_templates/N/launch/ { 'passwords_needed_to_start': [ 'vault_password.X', 'vault_password.Y', ] } POST /api/v2/job_templates/N/launch/ { 'credential_passwords': { 'vault_password.X': 'first-vault-password' 'vault_password.Y': 'second-vault-password' } } [automationcontroller] hostA hostB hostC [instance_group_east] hostB hostC [instance_group_west] hostC hostD [automationcontroller] hostA hostB hostC [database] hostDB [automationcontroller] hostA routable_hostname=10.1.0.2 hostB routable_hostname=10.1.0.3 hostC routable_hostname=10.1.0.4 routable_hostname awx-manage deprovision_instance --hostname=<name used in inventory file> awx-manage deprovision_instance --hostname=hostB [automationcontroller] 126-addr.tatu.home ansible_host=192.168.111.126 node_type=control [automationcontroller:vars] peers=execution_nodes [execution_nodes] [instance_group_test] 110-addr.tatu.home ansible_host=192.168.111.110 receptor_listener_port=8928 TASK [ansible.automation_platform_installer.check_config_static : Validate mesh topology] *** fatal: [126-addr.tatu.home -> localhost]: FAILED! => {"msg": "The host '110-addr.tatu.home' is not present in either [automationcontroller] or [execution_nodes]"} [automationcontroller] 126-addr.tatu.home ansible_host=192.168.111.126 node_type=control [automationcontroller:vars] peers=execution_nodes [execution_nodes] 110-addr.tatu.home ansible_host=192.168.111.110 receptor_listener_port=8928 [instance_group_test] 110-addr.tatu.home TASK [ansible.automation_platform_installer.check_config_static : Validate mesh topology] *** ok: [126-addr.tatu.home -> localhost] => {"changed": false, "mesh": {"110-addr.tatu.home": {"node_type": "execution", "peers": [], "receptor_control_filename": "receptor.sock", "receptor_control_service_name": "control", "receptor_listener": true, "receptor_listener_port": 8928, "receptor_listener_protocol": "tcp", "receptor_log_level": "info"}, "126-addr.tatu.home": {"node_type": "control", "peers": ["110-addr.tatu.home"], "receptor_control_filename": "receptor.sock", "receptor_control_service_name": "control", "receptor_listener": false, "receptor_listener_port": 27199, "receptor_listener_protocol": "tcp", "receptor_log_level": "info"}}} HTTP POST /api/v2/instance_groups/x/instances/ {'id': y}` HTTP PATCH /api/v2/instance_groups/N/ { "policy_instance_list": ["special-instance"] } HTTP PATCH /api/v2/instances/X/ { "managed_by_policy": False } max_concurrent_jobs: 10 max_forks: 50 automation-controller-service stop awx-manage deprovision_instance --hostname=<name used in inventory file> awx-manage deprovision_instance --hostname=hostB awx-manage unregister_queue --queuename=<name> --- apiVersion: v1 kind: ServiceAccount metadata: name: containergroup-service-account namespace: containergroup-namespace --- kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: role-containergroup-service-account namespace: containergroup-namespace rules: - apiGroups: [""] resources: ["pods"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] - apiGroups: [""] resources: ["pods/log"] verbs: ["get"] - apiGroups: [""] resources: ["pods/attach"] verbs: ["get", "list", "watch", "create"] --- kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: role-containergroup-service-account-binding namespace: containergroup-namespace subjects: - kind: ServiceAccount name: containergroup-service-account namespace: containergroup-namespace roleRef: kind: Role name: role-containergroup-service-account apiGroup: rbac.authorization.k8s.io apply -f containergroup-sa.yml export SA_SECRET=USD(oc get sa containergroup-service-account -o json | jq '.secrets[0].name' | tr -d '"') get secret USD(echo USD{SA_SECRET}) -o json | jq '.data.token' | xargs | base64 --decode > containergroup-sa.token get secret USDSA_SECRET -o json | jq '.data["ca.crt"]' | xargs | base64 --decode > containergroup-ca.crt {'ansible_host': '127.0.0.1', 'ansible_connection': 'local'} Error creating pod: pods is forbidden: User "system: serviceaccount: aap:example" cannot create resource "pods" in API group "" in the namespace "aap" create secret generic ee-pull-secret --from-literal=username=<username> --from-literal=password=<password> --from-literal=url=registry.redhat.io edit automationcontrollers <instance name> spec.ee_pull_credentials_secret=ee-pull-secret ssh [username]@[host_ip_address] ssh ec2-user@10.0.0.6 sudo subscription-manager register --auto-attach sudo subscription-manager register subscription-manager repos --enable ansible-automation-platform-2.4-for-rhel-8-x86_64-rpms for RHEL 8 subscription-manager repos --enable ansible-automation-platform-2.4-for-rhel-9-x86_64-rpms for RHEL 9 sudo dnf upgrade -y sudo dnf install -y ansible-core receptor-ca.crt work-public-key.pem receptor.key install_receptor.yml inventory.yml group_vars/all.yml requirements.yml ansible-galaxy collection install -r requirements.yml all: hosts: remote-execution: ansible_host: 10.0.0.6 ansible_user: <username> # user provided ansible_ssh_private_key_file: ~/.ssh/<id_rsa> ansible_ssh_common_args: <your ssh ProxyCommand setting> ansible-galaxy collection install ansible.receptor ansible-galaxy install -r requirements.yml sudo firewall-cmd --permanent --zone=public --add-port=27199/tcp ansible-playbook -i inventory.yml install_receptor.yml https://<yourcontrollerfqdn>/api/v2/settings/logging { "LOG_AGGREGATOR_HOST": "https://<yoursplunk>:8088/services/collector/event", "LOG_AGGREGATOR_PORT": null, "LOG_AGGREGATOR_TYPE": "splunk", "LOG_AGGREGATOR_USERNAME": "", "LOG_AGGREGATOR_PASSWORD": "USDencryptedUSD", "LOG_AGGREGATOR_LOGGERS": [ "awx", "activity_stream", "job_events", "system_tracking" ], "LOG_AGGREGATOR_INDIVIDUAL_FACTS": false, "LOG_AGGREGATOR_ENABLED": true, "LOG_AGGREGATOR_CONTROLLER_UUID": "" } filter { json { source => "message" } } ' status {status_code} received by user {user_name} attempting to access {url_path} from {remote_addr} ' scrape_configs - job_name: 'controller' tls_config: insecure_skip_verify: True metrics_path: /api/v2/metrics scrape_interval: 5s scheme: https bearer_token: <token_value> # basic_auth: # username: admin # password: password static_configs: - targets: - <controller_host> crontab -e export METRICS_UTILITY_SHIP_TARGET=directory export METRICS_UTILITY_SHIP_PATH=/awx_devel/awx-dev/metrics-utility/shipped_data/billing export METRICS_UTILITY_REPORT_TYPE=CCSP export METRICS_UTILITY_PRICE_PER_NODE=11.55 # in USD export METRICS_UTILITY_REPORT_SKU=MCT3752MO export METRICS_UTILITY_REPORT_SKU_DESCRIPTION="EX: Red Hat Ansible Automation Platform, Full Support (1 Managed Node, Dedicated, Monthly)" export METRICS_UTILITY_REPORT_H1_HEADING="CCSP Reporting <Company>: ANSIBLE Consumption" export METRICS_UTILITY_REPORT_COMPANY_NAME="Company Name" export METRICS_UTILITY_REPORT_EMAIL="email@email.com" export METRICS_UTILITY_REPORT_RHN_LOGIN="test_login" export METRICS_UTILITY_REPORT_COMPANY_BUSINESS_LEADER="BUSINESS LEADER" export METRICS_UTILITY_REPORT_COMPANY_PROCUREMENT_LEADER="PROCUREMENT LEADER" metrics-utility gather_automation_controller_billing_data --ship --until=10m 0 */1 * * * metrics-utility gather_automation_controller_billing_data --ship --until=10m 0 4 2 * * metrics-utility build_report crontab -l cat /var/log/cron May 8 09:45:03 ip-10-0-6-23 CROND[51623]: (root) CMDOUT (No billing data for month: 2024-04) May 8 09:45:03 ip-10-0-6-23 CROND[51623]: (root) CMDEND (metrics-utility build_report) May 8 09:45:19 ip-10-0-6-23 crontab[51619]: (root) END EDIT (root) May 8 09:45:34 ip-10-0-6-23 crontab[51659]: (root) BEGIN EDIT (root) May 8 09:46:01 ip-10-0-6-23 CROND[51688]: (root) CMD (metrics-utility gather_automation_controller_billing_data --ship --until=10m) May 8 09:46:03 ip-10-0-6-23 CROND[51669]: (root) CMDOUT (/tmp/9e3f86ee-c92e-4b05-8217-72c496e6ffd9-2024-05-08-093402+0000-2024-05-08-093602+0000-0.tar.gz) May 8 09:46:03 ip-10-0-6-23 CROND[51669]: (root) CMDEND (metrics-utility gather_automation_controller_billing_data --ship --until=10m) May 8 09:46:26 ip-10-0-6-23 crontab[51659]: (root) END EDIT (root) metrics-utility build_report apiVersion: v1 kind: ConfigMap metadata: name: automationcontroller-metrics-utility-configmap data: METRICS_UTILITY_SHIP_TARGET: directory METRICS_UTILITY_SHIP_PATH: /metrics-utility METRICS_UTILITY_REPORT_TYPE: CCSP METRICS_UTILITY_PRICE_PER_NODE: '11' # in USD METRICS_UTILITY_REPORT_SKU: MCT3752MO METRICS_UTILITY_REPORT_SKU_DESCRIPTION: "EX: Red Hat Ansible Automation Platform, Full Support (1 Managed Node, Dedicated, Monthly)" METRICS_UTILITY_REPORT_H1_HEADING: "CCSP Reporting <Company>: ANSIBLE Consumption" METRICS_UTILITY_REPORT_COMPANY_NAME: "Company Name" METRICS_UTILITY_REPORT_EMAIL: "email@email.com" METRICS_UTILITY_REPORT_RHN_LOGIN: "test_login" METRICS_UTILITY_REPORT_COMPANY_BUSINESS_LEADER: "BUSINESS LEADER" METRICS_UTILITY_REPORT_COMPANY_PROCUREMENT_LEADER: "PROCUREMENT LEADER" [cols="50%,50%",options="header"] |==== | *Parameter* | *Variable* | *`metrics_utility_enabled`* | True. | *`metrics_utility_cronjob_gather_schedule`* | @hourly or @daily. | *`metrics_utility_cronjob_report_schedule`* | @daily or @monthly. |==== scp -r username@controller_host:USDMETRICS_UTILITY_SHIP_PATH/data/<YYYY>/<MM>/ /local/directory/ - name: Copy directory from Kubernetes PVC to local machine hosts: localhost vars: report_dir_path: "/mnt/metrics/reports/{{ year }}/{{ month }}/" tasks: - name: Create a temporary pod to access PVC data kubernetes.core.k8s: definition: apiVersion: v1 kind: Pod metadata: name: temp-pod namespace: "{{ namespace_name }}" spec: containers: - name: busybox image: busybox command: ["/bin/sh"] args: ["-c", "sleep 3600"] # Keeps the container alive for 1 hour volumeMounts: - name: "{{ pvc }}" mountPath: "/mnt/metrics" volumes: - name: "{{ pvc }}" persistentVolumeClaim: claimName: automationcontroller-metrics-utility restartPolicy: Never register: pod_creation - name: Wait for both initContainer and main container to be ready kubernetes.core.k8s_info: kind: Pod namespace: "{{ namespace_name }}" name: temp-pod register: pod_status until: > pod_status.resources[0].status.containerStatuses[0].ready retries: 30 delay: 10 - name: Create a tarball of the directory of the report in the container kubernetes.core.k8s_exec: namespace: "{{ namespace_name }}" pod: temp-pod container: busybox command: tar czf /tmp/metrics.tar.gz -C "{{ report_dir_path }}" . register: tarball_creation - name: Copy the report tarball from the container to the local machine kubernetes.core.k8s_cp: namespace: "{{ namespace_name }}" pod: temp-pod container: busybox state: from_pod remote_path: /tmp/metrics.tar.gz local_path: "{{ local_dir }}/metrics.tar.gz" when: tarball_creation is succeeded - name: Ensure the local directory exists ansible.builtin.file: path: "{{ local_dir }}" state: directory - name: Extract the report tarball on the local machine ansible.builtin.unarchive: src: "{{ local_dir }}/metrics.tar.gz" dest: "{{ local_dir }}" remote_src: yes extra_opts: "--strip-components=1" when: tarball_creation is succeeded - name: Delete the temporary pod kubernetes.core.k8s: api_version: v1 kind: Pod namespace: "{{ namespace_name }}" name: temp-pod state: absent crontab -e */2 * * * * metrics-utility gather_automation_controller_billing_data --ship --until=10m */5 * * * * metrics-utili ty build_report metrics_utility_cronjob_gather_schedule: metrics_utility_cronjob_report_schedule: Total RAM * 0.25 / max_connections Total RAM * 0.05 ((number of worker nodes in kubernetes cluster) * (CPU available on each worker)) / (CPU request on pod_spec) = maximum number of concurrent jobs ((number of worker nodes in kubernetes cluster) * (memory available on each worker)) / (memory request on pod_spec) = maximum number of forks [automationcontroller] controller1 ansible_user=ec2-user ansible_host=10.10.12.11 node_type=hybrid routable_hostname=somehost.somecompany.org setup.sh -k. AUTH_PASSWORD_VALIDATORS = [ { 'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator', }, { 'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator', 'OPTIONS': { 'min_length': 9, } }, { 'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator', }, { 'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator', }, ] awx-manage inventory_import [--help] awx-manage inventory_import --source=/ansible/inventory/ --inventory-id=1 awx-manage inventory_import --source=/ansible/inventory/ --inventory-id=1 --overwrite awx-manage cleanup_jobs [--help] awx-manage cleanup_activitystream [--help] awx-manage create_oauth2_token --user example_user New OAuth2 token for example_user: j89ia8OO79te6IAZ97L7E8bMgXCON2 awx-manage revoke_oauth2_tokens awx-manage revoke_oauth2_tokens --revoke_refresh awx-manage revoke_oauth2_tokens --user example_user awx-manage revoke_oauth2_tokens --user example_user --revoke_refresh awx-manage expire_sessions awx-manage expire_sessions --user example_user awx-manage gather_analytics --ship awx-manage host_metric --since YYYY-MM-DD --until YYYY-MM-DD --json managed > manifest_limit => non-compliant managed =< manifest_limit => compliant AWX_ISOLATION_BASE_PATH = "/opt/tmp" AWX_ISOLATION_SHOW_PATHS = ['/list/of/', '/paths'] { "id": 1, "type": "o_auth2_application", "url": "/api/v2/applications/2/", "related": { "tokens": "/api/v2/applications/2/tokens/" }, "summary_fields": { "organization": { "id": 1, "name": "Default", "description": "" }, "user_capabilities": { "edit": true, "delete": true }, "tokens": { "count": 0, "results": [] } }, "created": "2018-07-02T21:16:45.824400Z", "modified": "2018-07-02T21:16:45.824514Z", "name": "My Application", "description": "", "client_id": "Ecmc6RjjhKUOWJzDYEP8TZ35P3dvsKt0AKdIjgHV", "client_secret": "7Ft7ym8MpE54yWGUNvxxg6KqGwPFsyhYn9QQfYHlgBxai74Qp1GE4zsvJduOfSFkTfWFnPzYpxqcRsy1KacD0HH0vOAQUDJDCidByMiUIH4YQKtGFM1zE1dACYbpN44E", "client_type": "confidential", "redirect_uris": "", "authorization_grant_type": "password", "skip_authorization": false, "organization": 1 } { "id": 4, "type": "o_auth2_access_token", "url": "/api/v2/tokens/4/", "related": { "user": "/api/v2/users/1/", "application": "/api/v2/applications/1/", "activity_stream": "/api/v2/tokens/4/activity_stream/" }, "summary_fields": { "application": { "id": 1, "name": "Default application for root", "client_id": "mcU5J5uGQcEQMgAZyr5JUnM3BqBJpgbgL9fLOVch" }, "user": { "id": 1, "username": "root", "first_name": "", "last_name": "" } }, "created": "2018-02-23T14:39:32.618932Z", "modified": "2018-02-23T14:39:32.643626Z", "description": "App Token Test", "user": 1, "token": "*************", "refresh_token": "*************", "application": 1, "expires": "2018-02-24T00:39:32.618279Z", "scope": "read" }, curl -XPOST -k -H "Content-type: application/json" -d '{"description":"Personal controller CLI token", "application":null, "scope":"write"}' https://<USERNAME>:<PASSWORD>@<CONTROLLER_SERVER>/api/v2/users/<USER_ID>/personal_tokens/ | python -m json.tool curl -k -H "Authorization: Bearer <token>" -H "Content-Type: application/json" -X POST -d '{}' https://controller/api/v2/job_templates/5/launch/ { "name": "Admin Internal Application", "description": "For use by secure services & clients. ", "client_type": "confidential", "redirect_uris": "", "authorization_grant_type": "password", "skip_authorization": false, "organization": <organization-id> } { "description": "My Access Token", "application": <application-id>, "scope": "write" } curl -H "Authorization: Bearer <token-value>" -H "Content-Type: application/json" -X GET https://<controller>/api/v2/users/ curl -ku <user>:<password> -X DELETE https://<controller>/api/v2/tokens/<pk>/ curl -H "Authorization: Bearer <token-value>" -X DELETE https://<controller>/api/v2/tokens/<pk>/ -k { "name": "AuthCodeApp", "user": 1, "client_type": "confidential", "redirect_uris": "http://<controller>/api/v2", "authorization_grant_type": "authorization-code", "skip_authorization": false } .. _`Django-oauth-toolkit simple test application`: http://django-oauth-toolkit.herokuapp.com/consumer/ CORS_ORIGIN_ALLOW_ALL = True CORS_ALLOWED_ORIGIN_REGEXES = [ r"http://django-oauth-toolkit.herokuapp.com*", r"http://www.example.com*" ] { "id": 6, "type": "application", "name": "Default Application", "user": 1, "client_id": "gwSPoasWSdNkMDtBN3Hu2WYQpPWCO9SwUEsKK22l", "client_secret": "fI6ZpfocHYBGfm1tP92r0yIgCyfRdDQt0Tos9L8a4fNsJjQQMwp9569eIaUBsaVDgt2eiwOGe0bg5m5vCSstClZmtdy359RVx2rQK5YlIWyPlrolpt2LEpVeKXWaiybo", "client_type": "confidential", "redirect_uris": "", "authorization_grant_type": "password", "skip_authorization": false } curl -k --user <user>:<password> -H "Content-type: application/json" -X POST --data '{ "description": "Token for Nagios Monitoring app", "application": 1, "scope": "write" }' https://<controller>/api/v2/tokens/ HTTP/1.1 200 OK Server: nginx/1.12.2 Date: Tue, 05 Dec 2017 16:48:09 GMT Content-Type: application/json Content-Length: 163 Connection: keep-alive Content-Language: en Vary: Accept-Language, Cookie Pragma: no-cache Cache-Control: no-store Strict-Transport-Security: max-age=15768000 {"access_token": "9epHOqHhnXUcgYK8QanOmUQPSgX92g", "token_type": "Bearer", "expires_in": 315360000000, "refresh_token": "jMRX6QvzOTf046KHee3TU5mT3nyXsz", "scope": "read"} { "id": 35, "type": "access_token", "user": 1, "token": "omMFLk7UKpB36WN2Qma9H3gbwEBSOc", "refresh_token": "AL0NK9TTpv0qp54dGbC4VUZtsZ9r8z", "application": 6, "expires": "2017-12-06T03:46:17.087022Z", "scope": "read write" } curl -X POST -d "grant_type=refresh_token&refresh_token=AL0NK9TTpv0qp54dGbC4VUZtsZ9r8z" -u "gwSPoasWSdNkMDtBN3Hu2WYQpPWCO9SwUEsKK22l:fI6ZpfocHYBGfm1tP92r0yIgCyfRdDQt0Tos9L8a4fNsJjQQMwp9569eIaUBsaVDgt2eiwOGe0bg5m5vCSstClZmtdy359RVx2rQK5YlIWyPlrolpt2LEpVeKXWaiybo" http://<controller>/api/o/token/ -i HTTP/1.1 200 OK Server: nginx/1.12.2 Date: Tue, 05 Dec 2017 17:54:06 GMT Content-Type: application/json Content-Length: 169 Connection: keep-alive Content-Language: en Vary: Accept-Language, Cookie Pragma: no-cache Cache-Control: no-store Strict-Transport-Security: max-age=15768000 {"access_token": "NDInWxGJI4iZgqpsreujjbvzCfJqgR", "token_type": "Bearer", "expires_in": 315360000000, "refresh_token": "DqOrmz8bx3srlHkZNKmDpqA86bnQkT", "scope": "read write"} curl -X POST -d "token=rQONsve372fQwuc2pn76k3IHDCYpi7" -u "gwSPoasWSdNkMDtBN3Hu2WYQpPWCO9SwUEsKK22l:fI6ZpfocHYBGfm1tP92r0yIgCyfRdDQt0Tos9L8a4fNsJjQQMwp9569eIaUBsaVDgt2eiwOGe0bg5m5vCSstClZmtdy359RVx2rQK5YlIWyPlrolpt2LEpVeKXWaiybo" http://<controller>/api/o/revoke_token/ -i { "Default": { "users": true }, "Test Org": { "admins": ["admin@example.com"], "users": true }, "Test Org 2": { "admins": ["admin@example.com", "/^controller-[^@]+?@.*USD/i"], "users": "/^[^@].*?@example\\.comUSD/" } } SOCIAL_AUTH_GOOGLE_OAUTH2_ORGANIZATION_MAP = {} SOCIAL_AUTH_GITHUB_ORGANIZATION_MAP = {} SOCIAL_AUTH_GITHUB_ORG_ORGANIZATION_MAP = {} SOCIAL_AUTH_GITHUB_TEAM_ORGANIZATION_MAP = {} SOCIAL_AUTH_SAML_ORGANIZATION_MAP = {} { "remove": true, "remove_admins": false, "remove_auditors": false, "saml_admin_attr": "admin-of", "saml_attr": "organizations" } 2025-01-17 14:19:36,624 DEBUG [7d3cf3b24d4e4d0e9edd5e2606d6ceba] awx.sso.common SAML adapter removing user auditor1 permission of auditor_role from organization Default { "My Team": { "organization": "Test Org", "users": ["/^[^@]+?@test\\.example\\.comUSD/"], "remove": true }, "Other Team": { "organization": "Test Org 2", "users": ["/^[^@]+?@test\\.example\\.comUSD/"], "remove": false } } SOCIAL_AUTH_GOOGLE_OAUTH2_TEAM_MAP = {} SOCIAL_AUTH_GITHUB_TEAM_MAP = {} SOCIAL_AUTH_GITHUB_ORG_TEAM_MAP = {} SOCIAL_AUTH_GITHUB_TEAM_TEAM_MAP = {} SOCIAL_AUTH_SAML_TEAM_MAP = {} SOCIAL_AUTH_USER_FIELDS = [] -----BEGIN CERTIFICATE----- ... cert text -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- ... key text -----END PRIVATE KEY----- { "en-US": { "url": "http://www.example.com", "displayname": "Example", "name": "example" } } { "givenName": "Some User", "emailAddress": "suser@example.com" } { "givenName": "Some User", "emailAddress": "suser@example.com" } Username(urn:oid:0.9.2342.19200300.100.1.1) Email(urn:oid:0.9.2342.19200300.100.1.3) FirstName(urn:oid:2.5.4.42) LastName(urn:oid:2.5.4.4) "myidp": { "entity_id": "https://idp.example.com", "url": "https://myidp.example.com/sso", "x509cert": "" }, "onelogin": { "entity_id": "https://app.onelogin.com/saml/metadata/123456", "url": "https://example.onelogin.com/trust/saml2/http-post/sso/123456", "x509cert": "", "attr_user_permanent_id": "name_id", "attr_first_name": "User.FirstName", "attr_last_name": "User.LastName", "attr_username": "User.email", "attr_email": "User.email" } } <saml2:AttributeStatement> <saml2:Attribute FriendlyName="member-of" Name="member-of" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"> <saml2:AttributeValue>Engineering</saml2:AttributeValue> <saml2:AttributeValue>IT</saml2:AttributeValue> <saml2:AttributeValue>HR</saml2:AttributeValue> <saml2:AttributeValue>Sales</saml2:AttributeValue> </saml2:Attribute> <saml2:Attribute FriendlyName="admin-of" Name="admin-of" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"> <saml2:AttributeValue>Engineering</saml2:AttributeValue> </saml2:Attribute> </saml2:AttributeStatement> { "saml_attr": "member-of", "saml_admin_attr": "admin-of", "remove": true, "remove_admins": false } <saml:AttributeStatement> <saml:Attribute xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500" x500:Encoding="LDAP" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" FriendlyName="eduPersonAffiliation"> <saml:AttributeValue xsi:type="xs:string">member</saml:AttributeValue> <saml:AttributeValue xsi:type="xs:string">staff</saml:AttributeValue> </saml:Attribute> </saml:AttributeStatement> { "saml_attr": "eduPersonAffiliation", "remove": true, "team_org_map": [ { "team": "member", "organization": "Default1" }, { "team": "staff", "organization": "Default2" } ] } { "remove": false, "team_org_map": [ { "team": "internal:unix:domain:admins", "organization": "Default", "team_alias": "Administrators" }, { "team": "Domain Users", "organization_alias": "OrgAlias", "organization": "Default" } ], "saml_attr": "member-of" } // Indicates whether the <samlp:AuthnRequest> messages sent by this SP // will be signed. [Metadata of the SP will offer this info] "authnRequestsSigned": false, // Indicates a requirement for the <samlp:Response>, <samlp:LogoutRequest> // and <samlp:LogoutResponse> elements received by this SP to be signed. "wantMessagesSigned": false, // Indicates a requirement for the <saml:Assertion> elements received by // this SP to be signed. [Metadata of the SP will offer this info] "wantAssertionsSigned": false, { "is_superuser_attr": "blueGroups", "is_superuser_role": ["is_superuser"], "is_superuser_value": ["cn=My-Sys-Admins,ou=memberlist,ou=mygroups,o=myco.com"], "is_system_auditor_attr": "blueGroups", "is_system_auditor_role": ["is_system_auditor"], "is_system_auditor_value": ["cn=My-Auditors,ou=memberlist,ou=mygroups,o=myco.com"] } ldapsearch -x -H ldap://win -D "CN=josie,CN=Users,DC=website,DC=com" -b "dc=website,dc=com" -w Josie4Cloud [ "OU=Users,DC=website,DC=com", "SCOPE_SUBTREE", "(cn=%(user)s)" ] [ [ "OU=Users,DC=northamerica,DC=acme,DC=com", "SCOPE_SUBTREE", "(sAMAccountName=%(user)s)" ], [ "OU=Users,DC=apac,DC=corp,DC=com", "SCOPE_SUBTREE", "(sAMAccountName=%(user)s)" ], [ "OU=Users,DC=emea,DC=corp,DC=com", "SCOPE_SUBTREE", "(sAMAccountName=%(user)s)" ] ] [ "dc=example,dc=com", "SCOPE_SUBTREE", "(objectClass=group)" ] { "first_name": "givenName", "last_name": "sn", "email": "mail" } {"name_attr": "cn", "member_attr": "member"} { "is_superuser": "cn=superusers,ou=groups,dc=website,dc=com", "is_system_auditor": "cn=auditors,ou=groups,dc=website,dc=com" } { "LDAP Organization": { "admins": "cn=engineering_admins,ou=groups,dc=example,dc=com", "remove_admins": false, "users": [ "cn=engineering,ou=groups,dc=example,dc=com", "cn=sales,ou=groups,dc=example,dc=com", "cn=it,ou=groups,dc=example,dc=com" ], "remove_users": false }, "LDAP Organization 2": { "admins": [ "cn=Administrators,cn=Builtin,dc=example,dc=com" ], "remove_admins": false, "users": true, "remove_users": false } } { "LDAP Engineering": { "organization": "LDAP Organization", "users": "cn=engineering,ou=groups,dc=example,dc=com", "remove": true }, "LDAP IT": { "organization": "LDAP Organization", "users": "cn=it,ou=groups,dc=example,dc=com", "remove": true }, "LDAP Sales": { "organization": "LDAP Organization", "users": "cn=sales,ou=groups,dc=example,dc=com", "remove": true } } AUTH_LDAP_ALWAYS_UPDATE_USER = False automation-controller-service restart 2020-04-28 17:25:36,184 WARNING django_auth_ldap Caught LDAPError while authenticating e079127: SERVER_DOWN({'info': 'error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (unable to get issuer certificate)', 'desc': "Can't contact LDAP server"},) 2020-06-02 11:48:24,840 WARNING django_auth_ldap Caught LDAPError while authenticating reinernippes: SERVER_DOWN({'desc': "Can't contact LDAP server", 'info': 'error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (certificate has expired)'},) cp ldap_server-CA.crt /etc/pki/ca-trust/source/anchors/ update-ca-trust AUTH_LDAP_GLOBAL_OPTIONS = { ldap.OPT_REFERRALS: False, } install krb5-workstation install krb5-devel install krb5-libs [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = WEBSITE.COM dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true [realms] WEBSITE.COM = { kdc = WIN-SA2TXZOTVMV.website.com admin_server = WIN-SA2TXZOTVMV.website.com } [domain_realm] .website.com = WEBSITE.COM website.com = WEBSITE.COM kinit username Password for username@WEBSITE.COM: klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: username@WEBSITE.COM Valid starting Expires Service principal 01/25/23 11:42:56 01/25/23 21:42:53 krbtgt/WEBSITE.COM@WEBSITE.COM renew until 02/01/23 11:42:56 [windows] win01.WEBSITE.COM [windows:vars] ansible_user = username@WEBSITE.COM ansible_connection = winrm ansible_port = 5986 root@localhost:~# ./setup.sh -b root@localhost:~# ./setup.sh -r root@localhost:~# ./setup.sh -e 'backup_dest=/path/to/backup_dir/' -b root@localhost:~# ./setup.sh -e 'restore_backup_file=/path/to/nondefault/backup.tar.gz' -r setup.sh -i <inventory file> "config.json": "1.1", "counts.json": "1.0", "cred_type_counts.json": "1.0", "events_table.csv": "1.1", "instance_info.json": "1.0", "inventory_counts.json": "1.2", "job_counts.json": "1.0", "job_instance_counts.json": "1.0", "org_counts.json": "1.0", "projects_by_scm_type.json": "1.0", "query_info.json": "1.0", "unified_job_template_table.csv": "1.0", "unified_jobs_table.csv": "1.0", "workflow_job_node_table.csv": "1.0", "workflow_job_template_node_table.csv": "1.0" } { "ansible_version": "2.9.1", "authentication_backends": [ "social_core.backends.azuread.AzureADOAuth2", "django.contrib.auth.backends.ModelBackend" ], "external_logger_enabled": true, "external_logger_type": "splunk", "free_instances": 1234, "install_uuid": "d3d497f7-9d07-43ab-b8de-9d5cc9752b7c", "instance_uuid": "bed08c6b-19cc-4a49-bc9e-82c33936e91b", "license_expiry": 34937373, "license_type": "enterprise", "logging_aggregators": [ "awx", "activity_stream", "job_events", "system_tracking" ], "pendo_tracking": "detailed", "platform": { "dist": [ "redhat", "7.4", "Maipo" ], "release": "3.10.0-693.el7.x86_64", "system": "Linux", "type": "traditional" }, "total_licensed_instances": 2500, "controller_url_base": "https://ansible.rhdemo.io", "controller_version": "3.6.3" } { "bed08c6b-19cc-4a49-bc9e-82c33936e91b": { "capacity": 57, "cpu": 2, "enabled": true, "last_isolated_check": "2019-08-15T14:48:58.553005+00:00", "managed_by_policy": true, "memory": 8201400320, "uuid": "bed08c6b-19cc-4a49-bc9e-82c33936e91b", "version": "3.6.3" } "c0a2a215-0e33-419a-92f5-e3a0f59bfaee": { "capacity": 57, "cpu": 2, "enabled": true, "last_isolated_check": "2019-08-15T14:48:58.553005+00:00", "managed_by_policy": true, "memory": 8201400320, "uuid": "c0a2a215-0e33-419a-92f5-e3a0f59bfaee", "version": "3.6.3" } } { "active_anonymous_sessions": 1, "active_host_count": 682, "active_sessions": 2, "active_user_sessions": 1, "credential": 38, "custom_inventory_script": 2, "custom_virtualenvs": 4, "host": 697, "inventories": { "normal": 20, "smart": 1 }, "inventory": 21, "job_template": 78, "notification_template": 5, "organization": 10, "pending_jobs": 0, "project": 20, "running_jobs": 0, "schedule": 16, "team": 5, "unified_job": 7073, "user": 28, "workflow_job_template": 15 } { "1": { "name": "Operations", "teams": 5, "users": 17 }, "2": { "name": "Development", "teams": 27, "users": 154 }, "3": { "name": "Networking", "teams": 3, "users": 28 } } { "1": { "credential_count": 15, "managed_by_controller": true, "name": "Machine" }, "2": { "credential_count": 2, "managed_by_controller": true, "name": "Source Control" }, "3": { "credential_count": 3, "managed_by_controller": true, "name": "Vault" }, "4": { "credential_count": 0, "managed_by_controller": true, "name": "Network" }, "5": { "credential_count": 6, "managed_by_controller": true, "name": "Amazon Web Services" }, "6": { "credential_count": 0, "managed_by_controller": true, "name": "OpenStack" }, { "1": { "hosts": 211, "kind": "", "name": "AWS Inventory", "source_list": [ { "name": "AWS", "num_hosts": 211, "source": "ec2" } ], "sources": 1 }, "2": { "hosts": 15, "kind": "", "name": "Manual inventory", "source_list": [], "sources": 0 }, "3": { "hosts": 25, "kind": "", "name": "SCM inventory - test repo", "source_list": [ { "name": "Git source", "num_hosts": 25, "source": "scm" } ], "sources": 1 } "4": { "num_hosts": 5, "kind": "smart", "name": "Filtered AWS inventory", "source_list": [], "sources": 0 } } { "git": 27, "hg": 0, "insights": 1, "manual": 0, "svn": 0 } { "collection_type": "manual", "current_time": "2019-11-22 20:10:27.751267+00:00", "last_run": "2019-11-22 20:03:40.361225+00:00" } "launch_type": { "dependency": 3628, "manual": 799, "relaunch": 6, "scheduled": 1286, "scm": 6, "workflow": 1348 }, "status": { "canceled": 7, "failed": 108, "successful": 6958 }, "total_jobs": 7073 } { "localhost": { "launch_type": { "dependency": 3628, "manual": 770, "relaunch": 3, "scheduled": 1009, "scm": 6, "workflow": 1336 }, "status": { "canceled": 2, "failed": 60, "successful": 6690 } } } SESSION_COOKIE_SECURE = False CSRF_COOKIE_SECURE = False automation-controller-service restart chown awx -R /var/lib/awx/projects/ vpc_destination_variable: private_ip_address awx-manage changepassword admin awx-manage createsuperuser Host tampa Hostname 10.100.100.11 IdentityFile [privatekeyfile] Host 10.100.. Proxycommand ssh -W [jumphostuser]@%h:%p tampa ansible_user: <user_name> ansible_connection: ssh ansible_ssh_common_args: '-o ProxyCommand="ssh -W %h:%p -q <user_name>@<jump_server_name>"' ansible -m setup hostname curl -f -k -H 'Content-Type: application/json' -XPOST --user admin:awxsecret ht p://192.168.42.100/api/v2/job_templates/1/launch/ curl -f -k -H 'Content-Type: application/json' -XPOST -d '{"extra_vars": "{\"foo\": \"bar\"}"}' --user admin:awxsecret http://192.168.42.100/api/v2/job_templates/1/launch/ --- - hosts: tag_Name_webserver tasks: inventory/ |-- group_vars | `-- mygroup |-- host_vars | `-- myhost `-- hosts awx-manage inventory_import --source=inventory/ --inventory-name="My Controller Inventory" awx-manage inventory_import --source=./ansible-hosts --inventory-name="My Controller Inventory" awx-manage inventory_import --source=inventory/ --inventory-name="My Controller Inventory" --overwrite --overwrite-vars ValueError: need more than 1 value to unpack mkdir -p inventory-directory/group_vars