1. In a browser, navigate to the Azure Marketplace.
2. From the navigation panel, select Private Products from the menu on the left of the screen.
3. Search for Red Hat Ansible Automation Platform.
4. Click the card that is returned in the search. Be sure to select the official offering from Red Hat.
5. Click Get it Now, Continue, and then Create to initiate the deployment process.

1. Enter values for your deployment in the following fields in the form:

   • Subscription: Select Ansible on Clouds.
   • Resource Group: Create or select a resource group where you want to deploy the managed application.
   • Region: The Azure region where the application will be deployed.
   • Application Name: A unique name for the managed application.

   • Administrator Password: Create an adminstrator password for your deployment.

     The Administrator Password must contain at least 8 characters, and must include uppercase letters, lowercase letters, and numbers.

   • Confirm Administrator Password: Confirm the Administrator Password.
   • Access: Choose whether your deployment will be public or private.

   • Managed Resource Group: A resource group for the managed application infrastructure.

     Keep this resource group isolated from other resource groups, including the Resource Group where you will deploy the managed application.

2. Store the information that you entered in the form in a secure place. You will need to provide the Administrator password to access automation controller and private automation hub.
3. Click Next
4. Follow the steps in Red Hat Ansible Automation Platform on Microsoft Azure VNet Preparation to configure your network configuration.
5. Click Review + Create.
6. If the information you entered in the form is valid, the window displays Validation Passed.
7. Select I agree to accept the Co-Admin Access Permissions terms and conditions.
8. Click Create to begin the provisioning process for the application.

Configuring the base URL for the Ansible Automation Platform deployment

1. In a browser, navigate to the Automation controller URL and log in using the following credentials:

   • Username: admin
   • Password: Use the Administrator password you provided when you deployed the Ansible Automation Platform application.
2. In the Automation controller console, click Settings.
3. Click Miscellaneous System settings under the System settings.
4. Click Edit. Enter the Automation controller URL in the Base URl of the service field.
5. Click Save.

Fetching the Azure AD OAuth2 Callback URL

1. In a web browser, open the automation controller console.
2. Click Settings in the menu to open the main settings page.
3. Click Azure AD settings in the Authentication category to open the Details page.
4. Copy the value for Azure AD OAuth2 Callback URL. You will need this value when you register your deployed application in Azure AD.

Creating a registered application in Azure AD

1. In a web browser, open the Azure portal.
2. Ensure that you are using the tenant where you deployed Ansible Automation Platform.
3. Type Azure Active Directory in the search bar.
4. Select Azure Active Directory from the search results.
5. From the menu options, select Manage → App registrations.
6. In the App registrations page, click + New registration.

7. Configure the new registration as follows:

   • In the Name field, enter the same name that you used for the deployed application.
   • Select the default value for Supported account types.
   • Select Web for Redirect URI (optional).
   • In the Redirect URI (optional) field, enter the Azure AD OAuth2 Callback URL value that you fetched from automation controller.
8. Click Register to create the registration.

Generating secrets for communication

1. In the Automation controller application registration page on Azure, copy and save the value of Application (client) ID.

   You will use this value for the Azure AD OAuth2 Key in the Ansible Automation Platform settings.

2. Select Manage → Certificates & secrets.
3. Click Client secrets and then New client secret.

4. Provide a description for the new secret.

   It is not possible to automatically renew a certificate or identify when it is about to expire.

   It is useful to include the date in the description, for example: AAP Client Secret <Today’s Date in YYYY-MM-DD format>.

5. Provide an expiration date for the new secret.

   The maximum lifetime for the certificate is 2 years. Unless you have specific security needs that prevent the creation of a long term certificate, select an expiration date of 24 months.

6. Save the secret Value to a location on your local machine. Once you navigate away from this page it will be hidden and no longer retrievable.

1. Open the automation controller console in a web browser.
2. Click Settings → Azure AD settings.
3. Click Edit.
4. Enter the information for the secret that you generated in Azure AD:
5. In Azure AD OAuth2 Key, paste the Application (client) ID.
6. In Azure AD OAuth2 Secret, paste the secret Value.
7. Click Save.

Adding Azure Credentials to Automation controller

1. Open the automation controller in a web browser.
2. Select Resources → Credentials and click Add to open the Create New Credentials page.
3. Enter a name for the new credential and select Azure Resource Manager for the credential type.

4. Use the Service Principal details to fill out the values of the form:

   • Name: Choose a descriptive name for the credential, for example *Azure Infrastructure*.
   • Subscription ID: Enter the subscription id where your resources created in Azure should be associated. This is unique to your tenant. Your organization may have multiple subscription ids; consult your Azure administrator regarding the subscription id that you should use.
   • Client ID: Enter the appId value from the Service Principal creation.
   • Client Secret: Enter the password from the Service Principal creation.
   • Tenant ID: Enter the tenant from the Service Principal creation.
5. Click Save to save the credential.

Procedure

1. Find the CIDR Block for the Ansible Automation Platform on Microsoft Azure managed application Kubernetes cluster. See Finding the CIDR Block of the managed application Kubernetes cluster.
2. Configure Network Peering with the Ansible Automation Platform Subnet. See Configuring Network Peering with the Ansible Automation Platform Subnet.

3. Update the route tables:

   1. Configure route tables from your existing networks to send traffic to the managed application CIDR. You must add routes to the routing tables of every network requesting Ansible Automation Platform user interfaces and of every network that will have automation performed against its resources. See Routing to Ansible Automation Platform on Microsoft Azure.
   2. Configure routing to your VNets for each spoke network that you would like Ansible Automation Platform to communicate with, for automation or for accessing the user interfaces. See Routing to your VNets.

Procedure

1. Navigate to the Virtual Network Connections page for the VWAN that you want to peer with your Ansible Automation Platform instance.

2. To create a connection between the VWAN hub and your Ansible Automation Platform instance, use the following settings:

   • Connection Name: <Ansible_Automation_Platform_connection_name>
   • Hubs: Select one or more VWAN hub networks that the managed application VNet will peer with.
   • Subscription: Select the subscription where Ansible Automation Platform on Microsoft Azure has been deployed.
   • Resource group: The managed resource group of the managed application. It is typically prefixed with “mrg-”.
   • Virtual network: The VNet of the managed application. There is only one VNet in the managed resource group.
   • Propagate to none: No
   • Associate Route Table: Select the default route table or the appropriate route table that your organization has configured for VWAN.
   • Propagate to Route Tables: Select one or more default route tables or the appropriate route table that your organization has configured for VWAN.
   • Propagate to labels: Select labels if your organization uses them.
   • Static routes: Do not complete this field.

1. Update your local hosts file so that the Ansible Automation Platform URLs route traffic to your local machine rather than the private IP that DNS records are configured with. Add the following line to your hosts file:

   127.0.0.1 controller.<your_AAPonAzure_instance>.az.ansiblecloud.com

   The following example shows the line in a hosts file:

   ##
   # Host Database
   #
   # localhost is used to configure the loopback interface
   # when the system is booting. Do not change this entry.
   #
   127.0.0.1       localhost
   255.255.255.255 broadcasthost
   ::1             localhost
   
   127.0.0.1 controller.<your_AAPonAzure_instance>.az.ansiblecloud.com

2. As a user with root privileges, run the ssh command to establish an SSH tunnel.

   In the example below, SSH_server_IP represents the IP address of the SSH server in your DMZ.

   sudo ssh azureuser@<SSH_server_IP> -i ~/.ssh/id_ssh_key -N -f -L 443:controller.<your_AAPonAzure_instance>.az.ansiblecloud.com:443

   The -L flag makes your local system route traffic for the automation controller URL over port 443 (HTTPs).

   Note

   You must use port 443 on both sides of the routing path. Using a different port on the local machine causes some Ansible Automation Platform features to not function properly.