| name | aap-openshift-2-6 |
| description | Summarizes Red Hat Ansible Automation Platform 2.6 operator deployment on OpenShift (AnsibleAutomationPlatform CR, platform gateway, external PostgreSQL for gateway/controller/hub/EDA, channels, CSRF, idle_aap). Use when installing or configuring AAP on OpenShift, AAP operator custom resources, external Postgres, Event-Driven Ansible, or automation hub with the 2.6 operator. |
Ansible Automation Platform 2.6 on OpenShift (operator)
Authoritative source: Installing on OpenShift Container Platform — Red Hat Ansible Automation Platform 2.6. Prefer that guide over this skill for procedure text, screenshots, and version-specific errata.
Scope
- Ground answers in AAP 2.6 operator on OpenShift unless the user specifies another version or target (KVM, VMware, etc.).
- In 2.6, the platform gateway is the unified UI; components are managed through a parent
AnsibleAutomationPlatform custom resource (CR).
Planning checklist
- Parent CR required: After installing the operator, create an
AnsibleAutomationPlatform CR—even if AutomationController, AutomationHub, or EDA objects already exist. Existing components must be registered via matching spec.controller.name, spec.hub.name, spec.eda.name in the same namespace as those CRs.
- Namespace: Do not deploy AAP in
default. Docs recommend ansible-automation-platform or aap; use a namespace that runs only AAP workloads.
- Operator channel (Subscription):
stable-2.6: namespace-scoped operator (typical).stable-2.6-cluster-scoped: manages AAP CRs across namespaces; needs broader permissions.- Do not switch between normal and cluster-scoped channels on the same install.
- OpenShift: AAP 2.6 operator is documented for OpenShift 4.12 through 4.17 and later—confirm current matrix in the same guide if the cluster version is edge.
- Storage: Automation Hub needs ReadWriteMany file storage (or S3/Azure per docs), independent of Postgres placement.
External PostgreSQL (single server, multiple databases)
One external PostgreSQL instance may back gateway, controller, hub, and EDA if each component uses a different database name on that instance.
| Component | Where to reference the secret on AnsibleAutomationPlatform |
|---|
| Platform gateway (shared platform DB) | spec.database.database_secret |
| Automation controller | spec.controller.postgres_configuration_secret |
| Automation hub | spec.hub.postgres_configuration_secret |
| Event-Driven Ansible | spec.eda.database.database_secret |
PostgreSQL versions: Managed DB shipped with the operator uses PostgreSQL 15. External databases support 15, 16, and 17; for 16/17 you rely on external backup/restore processes (not the operator-managed Postgres backup story).
Secret (type: unmanaged): Use stringData with at least host, port, database, username, password, type: "unmanaged". For controller/hub, sslmode is valid for external DBs (prefer, disable, allow, require, verify-ca, verify-full). Password must not contain single quote, double quote, or backslash (docs warn this breaks deploy/backup/restore).
Automation Hub on external Postgres: Enable the hstore extension on the Hub database before install (migrations assume it; managed Postgres does this automatically).
Optional_TLS: If automation controller must trust a private CA, use bundle_cacert_secret on the AnsibleAutomationPlatform CR (secret containing bundle-ca.crt).
For copy-paste YAML skeletons, see reference.md.
Configuration discovery
- Parent CR:
oc explain ansibleautomationplatform.spec
- Nested examples:
oc explain ansibleautomationplatform.spec.controller.postgres_configuration_secret
- Full tree:
oc explain ansibleautomationplatform.spec.controller --recursive (repeat for hub, eda)
Prefer editing the AnsibleAutomationPlatform CR so the operator propagates settings. When removing parameters, clear them from both the parent CR and any nested component CR if the operator created overrides.
Platform gateway / CSRF / ingress
- Operator creates Routes and CSRF defaults for OpenShift Routes.
- External ingress (non-Route): configure
CSRF_TRUSTED_ORIGINS (and related gateway settings) per Configuring your CSRF settings for your platform gateway operator ingress in the same guide.
- Controller UI "CSRF" settings in 2.6 do not drive platform gateway CSRF behavior (gateway is separate).
Scaling and DR-friendly idle
- To scale down controller, hub, gateway, EDA workloads together: set
idle_aap: true under spec on the AnsibleAutomationPlatform CR; set false to bring services back.
- For upgrades/migrations, follow the guide's backup CRs (AutomationControllerBackup, AutomationHubBackup, EDABackup) and release notes.
Common pitfalls (from product docs)
- DateStyle / timestamptz: External DBs with non-ISO
DateStyle (e.g. Redwood) can break parsing; docs describe setting datestyle = 'iso, mdy' and reloading Postgres.
- PVCs: Deleting an
AutomationController or AutomationHub CR does not delete PVCs—clean up stale claims before redeploying the same instance name.
- Existing 2.4 external DB on upgrade: May only need
spec.database.database_secret while other components keep prior DBs until migrated—see aap-configuring-existing-external-db-all-default-components in the guide appendix.
When unsure
- Cite or follow the linked Installing on OpenShift Container Platform 2.6 chapter that matches the task (external DB, Hub storage, EDA, Lightspeed, MCP, upgrade).
- Use
oc explain on the live cluster for field names—CRDs can add fields in newer z-streams.
Further detail
- reference.md — Minimal
AnsibleAutomationPlatform external-DB layout and secret keys.
