feat: allow AAP2 manifest injection via internal service URL#148
Open
tonykay wants to merge 1 commit into
Open
feat: allow AAP2 manifest injection via internal service URL#148tonykay wants to merge 1 commit into
tonykay wants to merge 1 commit into
Conversation
Add two new variables to ocp4_workload_ansible_automation_platform: - manifest_inject_host: override controller_host for the license injection task (e.g. "aap.aap.svc.cluster.local" to bypass the external route) - manifest_inject_validate_certs: allow disabling TLS validation when using internal HTTP endpoints When the deployer runs inside the cluster, the external route hostname may be unreachable if ingress is slow to come up or the load balancer is misconfigured. Using the internal service URL makes manifest injection resilient to ingress issues. Fully backward-compatible: defaults are empty (use route hostname) and validate_certs: true, matching current behavior. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
tonykay
requested review from
agonzalezrh,
fridim,
rut31337,
stencell and
wkulhanek
as code owners
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ocp4_workload_ansible_automation_platform_manifest_inject_hostto override the controller host for license injection (e.g.aap.aap.svc.cluster.local)ocp4_workload_ansible_automation_platform_manifest_inject_validate_certsto allow disabling TLS when using internal HTTP endpointstrue, matching current behaviorProblem
When the deployer runs as a pod inside the cluster, manifest injection connects to the AAP controller via its external Route hostname. If the cluster ingress is slow to come up or the load balancer is misconfigured (Connection refused), manifest injection fails even though the controller API is healthy on the internal network.
We've hit this repeatedly on IBM Cloud shared clusters where the ingress VIP is unreachable during provisioning.
Usage
In agnosticv, set:
Test plan
manifest_inject_hostset to internal URL — manifest injection uses internal service, bypasses routeCo-Authored-By: Claude Opus 4.6 noreply@anthropic.com