Upgrade Ansible automation portal

Upgrade the Helm chart and plug-in artifacts for your target release.

Important

If you are upgrading from plug-in version 2.1 to 2.2, you must grant navigation permissions to existing roles. The Templates and History sidebar items now require explicit ansible.templates.view and ansible.history.view permission grants. Without these permissions, non-admin users cannot see the Templates and History navigation items. Administrators and superusers are unaffected.

After upgrading, log in as an administrator, navigate to Administration > RBAC, and add ansible.templates.view and ansible.history.view to each role that requires access. For more information, see Configuring role-based access control for Ansible automation portal.

 Important

Starting with portal release v2.3.0, the Ansible automation portal Helm chart defaults to OCI container delivery (pluginMode: oci). If your existing deployment uses an HTTP plug-in registry or tarball package URLs, you must update your Helm values before you upgrade to a chart release that defaults to OCI. Upgrading without updating your configuration can cause deployment failures. For migration instructions, see Migrate from HTTP plug-in registry to OCI container delivery.

Also, with portal release v2.3.0, the type for Ansible Automation Platform job templates changes from spec.type: service to spec.type: automation-template during catalog synchronization. This change applies to all portal deployments.

If your deployment uses role-based access control (RBAC) conditional policies that filter by spec.type: service, those policies will no longer match synchronized templates after upgrade, resulting in lost access for non-admin users. Before or immediately after upgrading:

  • In the automation portal web interface, navigate to Administration > RBAC, select the affected roles, and update conditional policies to filter on spec.type: automation-template.
  • If you use software templates imported from Git repositories, update spec.type in your template YAML files to automation-template (and optionally add the ansible.com/template-source: scm annotation), or update your catalog location to point to the latest template release.

For more information, see Migrate from single-organization to multi-organization Automation portal deployment.

To upgrade Ansible automation portal:

  1. Prepare versions and values. See Before you upgrade.
  2. Choose your upgrade path. See Choose an upgrade path.
  3. Complete the procedure for that path:
    • OCI container delivery (default and recommended): The Helm chart defaults to pluginMode: oci and pulls plug-ins from registry.redhat.io (or your mirror). See Upgrade Ansible automation portal with OCI container delivery.
    • HTTP plug-in registry (deprecated): To maintain the deprecated tarball delivery flow, you must explicitly set pluginMode: tarball in your Helm values. Alternatively, plan to migrate from tarball to OCI during upgrade.

Before you upgrade

  • Versions: Consult the Ansible automation portal lifecycle page for Helm chart version, imageTagInfo, and Ansible Automation Platform compatibility. Run helm search repo openshift-helm-charts/redhat-rhaap-portal and select the chart version that matches the lifecycle page.
  • Values: Export and preserve your Helm values. Use -f backup-values.yaml on every upgrade (OpenShift console or CLI). Upgrades without this file can reset custom OAuth, RBAC, and certificate settings.
  • OCI delivery: The Helm chart defaults to pluginMode: oci starting with release v2.3.0. Verify that your backup-values.yaml uses pluginMode: oci and that the registry authentication secret exists. If you must remain on the deprecated HTTP plug-in registry, you must explicitly set pluginMode: tarball in backup-values.yaml.
  • Template taxonomy: If you use RBAC conditional policies that filter on spec.type: service, plan to update them to spec.type: automation-template during your upgrade maintenance window.