Chapter 12. Integrate Ansible Automation Platform with governance

Procedure

1. Log in to your Red Hat Advanced Cluster Management hub cluster.
2. From the navigation menu, select Governance and click the Policies tab.
3. Find the target policy in the table and click Configure in the Automation column.

4. In the Ansible credential section, select your Ansible Automation Platform credential from the list.

   Note: This credential is copied to the same namespace as the policy. The generated AnsibleJob resource uses the Ansible Automation Platform credential to run the automation. Changes to the Ansible Automation Platform credential update automatically.

5. Select an Ansible Automation Platform job template.
6. In the Extra variables section, define parameter values in the extra_vars section of the PolicyAutomation resource.

7. Select the automation frequency:

   • Run once mode
   • Run everyEvent mode
   • Disable automation
8. Save your policy violation automation by selecting Submit. Clicking the View Job link from the Ansible job details side panel, naviagates to the job template on the Search page.

9. Check to see that the automation is in the Automation column.

   Note: When you delete a policy that has an associated policy automation, the policy automation is automatically deleted as part of clean up.

Procedure

1. Log in to your hub cluster. Run the following command:

   oc login <hub_cluster_url>

2. Find the name and namespace of the policy that you want to automate.

3. Create a PolicyAutomation resource. Your YAML file might resemble the following example:

   apiVersion: policy.open-cluster-management.io/v1beta1
   kind: PolicyAutomation
   metadata:
     name: policyname-policy-automation
   spec:
     automationDef:
       extra_vars:
         your_var: your_value
       name: Policy Compliance Template
       secret: ansible-tower
       type: AnsibleJob
     mode: disabled
     policyRef: policyname

4. Update the following fields within your resource definition:

   • spec.automationDef.name: Match your exact Red Hat Ansible Automation Platform job template name.
   • spec.automationDef.extra_vars: Add parameters passed directly to the automation template.
   • spec.mode: Set to once, everyEvent, or disabled.
   • spec.policyRef: Reference the exact target policy name.
5. Create an Ansible Automation Platform credential secret containing the Ansible Tower token in the same namespace as the PolicyAutomation resource.

6. Apply the configuration file the cluster. Run the following command:

   oc apply -f <filename>.yaml

7. To configure an immediate run of the policy automation, add the following annotation to the PolicyAutomation resource:

   metadata:
     annotations:
       policy.open-cluster-management.io/rerun: "true"