Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
The diff you're trying to view is too large. We only load the first 3000 changed files.
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"url": "https://docs.redhat.com/en/documentation/ansible_on_clouds/2.x/html-single/red_hat_ansible_automation_platform_on_microsoft_azure_guide/index#azure_virtual_appliance_routing_with_ansible_automation_platform_on_microsoft_azure",
"path": "/documentation/en-us/ansible_on_clouds/2.x/html-single/red_hat_ansible_automation_platform_on_microsoft_azure_guide/index",
"title": "Azure Virtual Appliance Routing with Ansible Automation Platform on Microsoft Azure"
"title": "Azure Virtual Appliance routing with Ansible Automation Platform on Microsoft Azure"
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
{
"url": "https://docs.redhat.com/en/documentation/ansible_on_clouds/2.x/html-single/red_hat_ansible_automation_platform_on_microsoft_azure_guide/index#idm140497595277568",
"path": "/documentation/en-us/ansible_on_clouds/2.x/html-single/red_hat_ansible_automation_platform_on_microsoft_azure_guide/index",
"title": "Legal Notice"
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
{
"url": "https://docs.redhat.com/en/documentation/ansible_on_clouds/2.x/html-single/red_hat_ansible_automation_platform_on_microsoft_azure_guide/index#policy_remediation_timeline_and_enforcement",
"path": "/documentation/en-us/ansible_on_clouds/2.x/html-single/red_hat_ansible_automation_platform_on_microsoft_azure_guide/index",
"title": "Policy remediation timeline and enforcement"
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
{
"url": "https://docs.redhat.com/en/documentation/ansible_on_clouds/2.x/html-single/red_hat_ansible_automation_platform_on_microsoft_azure_guide/index#primary_and_business_continuity_regions",
"path": "/documentation/en-us/ansible_on_clouds/2.x/html-single/red_hat_ansible_automation_platform_on_microsoft_azure_guide/index",
"title": "Primary and business continuity regions"
}
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"url": "https://docs.redhat.com/en/documentation/ansible_on_clouds/2.x/html-single/red_hat_ansible_automation_platform_on_microsoft_azure_guide/index#private_dns_zones",
"path": "/documentation/en-us/ansible_on_clouds/2.x/html-single/red_hat_ansible_automation_platform_on_microsoft_azure_guide/index",
"title": "Private DNS Zones"
"title": "Private DNS zones"
}
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@

Red Hat Customer Content Services

[Legal Notice](https://docs.redhat.com/en/documentation/ansible_on_clouds/2.x/html-single/red_hat_ansible_automation_platform_on_microsoft_azure_guide/index#idm140266772989776)
[Legal Notice](https://docs.redhat.com/en/documentation/ansible_on_clouds/2.x/html-single/red_hat_ansible_automation_platform_on_microsoft_azure_guide/index#idm140497595277568)
**Abstract**

Ansible Automation Platform helps teams manage complex multi-tier deployments by adding control, knowledge, and delegation to Ansible-powered environments. This guide helps you to understand the installation and use of Ansible Automation Platform on Microsoft Azure. This document has been updated to include information for the latest release of Ansible Automation Platform on Microsoft Azure.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,11 +4,11 @@



You can gracefully cancel a Ansible Automation Platform on Microsoft Azure deployment.
You can gracefully cancel an Ansible Automation Platform on Microsoft Azure deployment.

**Procedure**

1. Login to the deployment engine to display the progress of the deployment steps in the **Ansible Automation Platform Deployment Engine** page. Refer to [Monitoring deployments on the Ansible Automation Platform Deployment Engine](https://docs.redhat.com/en/documentation/ansible_on_clouds/2.x/html-single/red_hat_ansible_automation_platform_on_microsoft_azure_guide/index#azure-monitor-deployment-engine_azure-deploy) for information on accessing and logging into the **Ansible Automation Platform Deployment Engine** page.
1. Log in to the deployment engine to display the progress of the deployment steps in the **Ansible Automation Platform Deployment Engine** page. Refer to [Monitoring deployments on the Ansible Automation Platform Deployment Engine](https://docs.redhat.com/en/documentation/ansible_on_clouds/2.x/html-single/red_hat_ansible_automation_platform_on_microsoft_azure_guide/index#azure-monitor-deployment-engine_azure-deploy) for information on accessing and logging into the **Ansible Automation Platform Deployment Engine** page.
1. To cancel the deployment, clickCancel Deploymentand confirm.


Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,9 @@ Within the Azure console, the Azure virtual network is known as _this virtual ne

In the **Virtual Networks** page in the Azure portal, use the following settings to configure the Azure network and the VNet that you want to peer with the Ansible Automation Platform on Microsoft Azure app:

- Under **Remote virtual network** , select the settings for the virtual network that you want to peer with Azure:
**Procedure**

1. Under **Remote virtual network** , select the settings for the virtual network that you want to peer with Azure:


- **Summary** :
Expand All @@ -38,7 +40,7 @@ In the **Virtual Networks** page in the Azure portal, use the following settings
- **Virtual network gateway or Route Server** : _Use the remote virtual network’s gateway or Route server_


- Under **Local virtual network** , select the settings the Ansible Automation Platform on Microsoft Azure virtual network:
1. Under **Local virtual network** , select the settings the Ansible Automation Platform on Microsoft Azure virtual network:


- **Summary** :
Expand All @@ -47,14 +49,15 @@ In the **Virtual Networks** page in the Azure portal, use the following settings
- **Peering link name** : _<hub_to_aap_peering_link_name>_
- **Traffic to remote virtual network** : _Allow_
- **Traffic forwarded from remote virtual network** : _Allow_
- **Enable this virtual network to use peered vnet’s remote gateway or Route Sever** : _Enabled_
- **Enable this virtual network to use peered VNet’s remote gateway or Route Sever** : _Enabled_


1. After you have configured direct network peering, traffic routes between Ansible Automation Platform on Microsoft Azure and private hosts and IPs on your VNet.


After you have configured direct network peering, traffic routes between Ansible Automation Platform on Microsoft Azure and private hosts and IPs on your Vnet.
**Additional resources**

For more detailed instructions for configuring peering, refer to [Create a peering](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering#create-a-peering) in the Microsoft Azure _Virtual network_ guide.
- [Create a peering](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering#create-a-peering)
- [Virtual network peering](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview)

For further information on direct peering, refer to [Virtual network peering](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview) in the Microsoft Azure _Virtual network_ guide.

Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ Understand the necessary preparation and three core steps for enabling private n

- You have deployed Ansible Automation Platform on Microsoft Azure.
- You have configured and tested an Azure VNet hub-and-spoke implementation in your Azure tenant. This prerequisite requires many Azure resources to be configured, including a Virtual Network Gateway.
- You have configured transit routing between your spoke networks, including your VPNs. Refer to [Configure VPN gateway transit for virtual network peering](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit) in the Microsoft Azure documentation for instructions.
- You have configured transit routing between your spoke networks, including your VPNs. Refer to [Configure VPN gateway transit for virtual network peering](https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit) in the Microsoft Azure documentation for instructions.
- You have identified the following:


Expand Down Expand Up @@ -68,7 +68,7 @@ The CIDR block of the cluster is displayed in the **Address Space** .

**Additional resources**

- [View virtual networks and settings](https://docs.microsoft.com/en-us/azure/virtual-network/manage-virtual-network#view-virtual-networks-and-settings)
- [View virtual networks and settings](https://learn.microsoft.com/en-us/azure/virtual-network/manage-virtual-network#view-virtual-networks-and-settings)


#### 4.1.1.3. Configuring network peering with the Ansible Automation Platform subnet
Expand All @@ -80,29 +80,30 @@ Within the Azure console, the Azure virtual network (VNet) is known as _this vir

In the **Virtual Networks** page in the Azure portal, use the following settings to configure peering between the Azure VNet and the VNet that you want to peer with the Ansible Automation Platform on Microsoft Azure app:

- Under **Remote virtual network** , select the settings for the virtual network that you want to peer with Azure:
**Procedure**

1. Under **Remote virtual network** , select the settings for the virtual network that you want to peer with Azure:


- **Summary** :


- **Peering link name** : _<aap_to_hub_peering_link_name>_

- **Peering settings** :


- **Traffic to remote virtual network** : _Allow_
- **Traffic forwarded from remote virtual network** : _Allow_


- Under **Local virtual network** , select **Settings** the Ansible Automation Platform on Microsoft Azure virtual network:

1. Under **Local virtual network** , select **Settings** the Ansible Automation Platform on Microsoft Azure virtual network:


- **Summary** :


- **Peering link name** : _<hub_to_aap_peering_link_name>_

- **Peering settings** :


Expand All @@ -113,17 +114,23 @@ In the **Virtual Networks** page in the Azure portal, use the following settings




**Additional resources**

- [Create a peering](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering#create-a-peering)
- [Create a peering](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering#create-a-peering)


#### 4.1.1.4. Updating the route tables




Before you update the route tables, confirm that you satisfy the [Prerequisites](https://docs.redhat.com/en/documentation/ansible_on_clouds/2.x/html-single/red_hat_ansible_automation_platform_on_microsoft_azure_guide/index#proc-azure-hub-spoke-peering_azure-hub-spoke-peering) for the hub-and-spoke peering process.
Route tables in the Azure portal are sets of rules, known as routes, that determine how network traffic is directed between subnets, virtual networks (VNets), on-premises networks, and the internet.

**Procedure**

1. Before you update the route tables, confirm that you satisfy the [Prerequisites](https://docs.redhat.com/en/documentation/ansible_on_clouds/2.x/html-single/red_hat_ansible_automation_platform_on_microsoft_azure_guide/index#proc-azure-hub-spoke-peering_azure-hub-spoke-peering) for the hub-and-spoke peering process.


##### 4.1.1.4.1. Routing to Ansible Automation Platform on Microsoft Azure

Expand Down Expand Up @@ -196,17 +203,19 @@ The easiest way to implement this is to create a firewall rule that allows all o

If you choose not to allow all outbound traffic from port 443, you must configure routes.

- For Red Hat to manage and upgrade Ansible Automation Platform on Microsoft Azure and execute security patching, any machine in the Azure Kubernetes service (AKS) cluster must be allowed to submit a request to pull updates for containers used by Ansible Automation Platform.
**Procedure**

1. For Red Hat to manage and upgrade Ansible Automation Platform on Microsoft Azure and execute security patching, any machine in the Azure Kubernetes service (AKS) cluster must be allowed to submit a request to pull updates for containers used by Ansible Automation Platform.


- Add routes in the Ansible Automation Platform route table for outbound traffic from the full CIDR range of the Ansible Automation Platform on Microsoft Azure managed application to the domains listed in the [Azure Virtual Appliance Routing with Ansible Automation Platform on Azure](https://access.redhat.com/articles/6972355) article on the Red Hat Customer Portal.
1. Add routes in the Ansible Automation Platform route table for outbound traffic from the full CIDR range of the Ansible Automation Platform on Microsoft Azure managed application to the domains listed in the [Azure Virtual Appliance Routing with Ansible Automation Platform on Azure](https://access.redhat.com/articles/6972355) article on the Red Hat Customer Portal.

- You must also allow traffic from your firewall to any other external domain or IP address that you want Ansible Automation Platform to run automation jobs against. Otherwise, your firewall blocks connectivity between Ansible Automation Platform and destinations for automation.
- Ansible Automation Platform requires a public DNS zone to provide SSL certificates. This public DNS zone is in the managed resource group of the deployment. The platform must be able to communicate via DNS queries with the servers listed in the DNS zone to complete certificate challenges with our upstream provider. Blocking this communication prevents successful certificate renewal.
1. You must also allow traffic from your firewall to any other external domain or IP address that you want Ansible Automation Platform to run automation jobs against. Otherwise, your firewall blocks connectivity between Ansible Automation Platform and destinations for automation.
1. Ansible Automation Platform requires a public DNS zone to provide SSL certificates. This public DNS zone is in the managed resource group of the deployment. The platform must be able to communicate via DNS queries with the servers listed in the DNS zone to complete certificate challenges with our upstream provider. Blocking this communication prevents successful certificate renewal.


**Additional resources**

- [Create a route](https://docs.microsoft.com/en-us/azure/virtual-network/manage-route-table#create-a-route)
- [Create a route](https://learn.microsoft.com/en-us/azure/virtual-network/manage-route-table#create-a-route)


Original file line number Diff line number Diff line change
@@ -1,10 +1,11 @@
# 6. Support for Red Hat Ansible Automation Platform on Microsoft Azure
## 6.4. Limited support status
## 6.4. Policy remediation timeline and enforcement
### 6.4.1. Limited support status




Customers may implement Azure infrastructure changes or policies that negatively affect the functionality of the service and Red Hat’s ability to monitor and service it. In such scenarios, the deployment can transition into a limited support status. A deployment may move to a limited support status for many reasons, including the following scenarios:


<span id="idm140266772989776"></span>
<span id="idm140497595277568"></span>
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ When you begin deploying Ansible Automation Platform on Microsoft Azure, the Azu
- **Note:** Approximately 10 minutes into the deployment process, the **Outputs** section of the **Parameters and Outputs** page displays a link to the ** ` deploymentEngineUrl` ** .

1. Copy the link and paste it in another browser tab to open the login page for the deployment engine.
1. Login to the deployment using the following credentials:
1. Log in to the deployment using the following credentials:


- **Username** : _admin_
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,9 @@ While every effort has been made to align with Microsoft’s documentation for t
Azure offers different ways to peer private networks. These are typically divided into two categories:

- **Hub-and-spoke peering** : In this topology, there is a centralized hub VNet that other virtual networks peer with. This hub network has mechanisms to route traffic through transit routing. Cloud networks, including VPN/Express Connect connections with on-premises and other cloud networks, can communicate through the hub VNet.
- **Azure Virtual WAN (VWAN)** : Azure Virtual WAN is a networking service that provides simplified hub-and-spoke network modeling across Azure, on-premises, and other VPN/Direct Connect networks. For more about VWAN, refer to Microsoft’s [Virtual WAN documentation](https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about) .
- **Azure Virtual WAN (VWAN)** : Azure Virtual WAN is a networking service that provides simplified hub-and-spoke network modeling across Azure, on-premises, and other VPN/Direct Connect networks. For more about VWAN, refer to Microsoft’s [Virtual WAN documentation](https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about) .
- **Direct peering** : Private networks are individually connected to one another with no routing hops between them. This is a simpler peering model: it is useful when you only want to connect a few networks.


Refer to [Choose between virtual network peering and VPN gateways](https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/vnet-peering) in the Microsoft _Application architecture fundamentals guide_ to determine the correct peering approach for your organization.
Refer to [Choose between virtual network peering and VPN gateways](https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/vnet-peering) in the Microsoft _Application architecture fundamentals guide_ to determine the correct peering approach for your organization.

Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@



You can create user defined routes from the VNET deployed with the managed application to internal network ranges, firewalls, virtual network appliances.
You can create user defined routes from the VNet deployed with the managed application to internal network ranges, firewalls, virtual network appliances.

For information on how to configure user defined routes, see [Ansible on Azure User Defined Routes](https://access.redhat.com/articles/7005411) .

Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ You set the CIDR block for the application in the `Configure virtual networks` s

When you are planning your network configuration, bear the following in mind:

- The managed application requires at least a /24 Vnet that is divided into four subnets. The subnets have minimum address spacing.
- The managed application requires at least a /24 VNet that is divided into four subnets. The subnets have minimum address spacing.

| Networking entity | Minimum CIDR Block |
| --- | --- |
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,6 @@ When network peering completes, traffic routes to and from Ansible Automation Pl

**Additional resources**

- [Connect a virtual network to a Virtual WAN hub - portal](https://docs.microsoft.com/en-us/azure/virtual-wan/howto-connect-vnet-hub)
- [Connect a virtual network to a Virtual WAN hub - portal](https://learn.microsoft.com/en-us/azure/virtual-wan/howto-connect-vnet-hub)


Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@



You can configure the AKS network CIDR blocks. Traffic that originates from the AKS cluster appears to come from the range configured in AKS, not from the VNET.
You can configure the AKS network CIDR blocks. Traffic that originates from the AKS cluster appears to come from the range configured in AKS, not from the VNet.

When you are planning your AKS CIDR block configuration, bear the following in mind:

Expand Down Expand Up @@ -34,7 +34,7 @@ It must not overlap with any Subnet IP ranges. | Requires a /24 block at minimum

This CIDR block must not intersect with the CIDR of the Pod CIDR block.

This CIDR block also must not intersect with the CIDR of the VNET CIDR block. |
This CIDR block also must not intersect with the CIDR of the VNet CIDR block. |
| DNS Service IP | An IP address assigned to the Kubernetes DNS service.

It must be within the Kubernetes service address range specified in `serviceCidr` . | Must be an IP address in the Service CIDR other than the first IP in that range.
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# 6. Support for Red Hat Ansible Automation Platform on Microsoft Azure
## 6.1. Azure Virtual Appliance Routing with Ansible Automation Platform on Microsoft Azure
## 6.1. Azure Virtual Appliance routing with Ansible Automation Platform on Microsoft Azure



Expand Down
Loading
Loading