Installation reference

Use this reference to look up default ports, status conditions, Kubernetes events, and custom resource fields for your automation orchestrator deployment.

Default port reference

Table 1. Default ports
Service Port Protocol
Automation orchestrator Backend (API) 8000 HTTP/HTTPS
Automation orchestrator UI 8080 (container) / 80 (Service) HTTP/HTTPS
Temporal Server 7233 gRPC
PostgreSQL 5432 TCP
Redis (cache service) 6379 TCP

Default resource requirements

The automation orchestrator operator sets the following resource requests and limits for each component. You can override these values per component in the custom resource.

Table 2. Default resource requirements per component
Component CPU request Memory request Memory limit
Backend 250m 256Mi 2Gi
Worker 250m 256Mi 1Gi
Background Worker 250m 256Mi 512Mi
UI 20m 64Mi 128Mi
Temporal Server 500m 512Mi 4Gi
Redis 10m 32Mi 512Mi

CPU limits are not set by default.

Status conditions

The automation orchestrator operator reports deployment state through the following status conditions:

Table 3. Status conditions
Condition Meaning
Ready All components are running and healthy
Progressing A deployment, update, or migration is in progress
Degraded One or more components are unhealthy or a migration failed
ConfigurationValid The custom resource spec passes validation
TLSReady Internal mTLS certificates are provisioned and valid

The status also includes the current version and per-component readiness information.

Kubernetes events

The automation orchestrator operator publishes Kubernetes events for significant lifecycle actions:

  • BackendMigrationStarted, BackendMigrationCompleted, BackendMigrationFailed
  • TemporalMigrationStarted, TemporalMigrationCompleted, TemporalMigrationFailed
  • TemporalNamespaceRegistrationStarted, TemporalNamespaceRegistrationCompleted, TemporalNamespaceRegistrationFailed
  • ComponentDeployed, ComponentUpdated, ComponentScaled
  • ConfigurationInvalid (with details on what failed validation)
  • SecretChanged, ConfigMapChanged (triggering rolling restarts)
  • FileStorageCredentialChanged (file storage credential Secret changed, triggering rolling restart)
  • FileStorageCACertChanged (file storage CA certificate Secret changed, triggering rolling restart)
  • InternalCACertChanged, BackendTLSCertChanged, WorkerTLSCertChanged, BackgroundWorkerTLSCertChanged, TemporalTLSCertChanged, UITLSCertChanged (internal TLS certificate Secret updates)
  • ReconciliationFailed (with error context)
  • SecretGenerationFailed, TLSSecretGenerationFailed (when auto-generation of Secrets fails)

Custom resource definitions

AutomationOrchestrator

The primary resource for managing an automation orchestrator deployment. Each instance represents a complete installation.

  • API group: aap.ansible.com
  • API version: v1alpha1
  • Scope: Namespaced

OpenTelemetry export

Configure spec.otel to send audit events to an external OpenTelemetry (OTEL) collector. When omitted, OpenTelemetry export is disabled.

Table 4. OpenTelemetry export fields
Field Type Default Description
spec.otel.enabled boolean false Enable OpenTelemetry export.
spec.otel.endpoint string -- Required when enabled. OpenTelemetry Protocol (OTLP) HTTP endpoint for logs (for example,https://collector.example.com:4318/v1/logs).
spec.otel.serviceName string -- Optional. Service name for OpenTelemetry (OTEL) resource attributes.
spec.otel.authHeaderName string -- Optional. HTTP header name for API key authentication.
spec.otel.apiKeySecretRef Secret reference -- Optional. Secret containing the API key for endpoint authentication (key:api-key).
spec.otel.caCertSecretRef Secret reference -- Optional. Secret containing the CA certificate for server verification (key:ca.crt).
spec.otel.clientCertSecretRef Secret reference -- Optional. Secret containing client certificate and private key for mTLS with the collector (keys:tls.crt,tls.key).

Database connection pool

Configure spec.postgres pool settings to control the database connection pool size and behavior. Tune these values if you observe connection timeouts or pool exhaustion under high load.

Table 5. Database connection pool fields
Field Type Default Description
spec.postgres.poolSize integer 20 Maximum number of persistent connections in the database connection pool (minimum: 1).
spec.postgres.maxOverflow integer 10 Maximum number of additional connections beyondpoolSize (minimum: 0).
spec.postgres.poolTimeoutSeconds integer 5 Seconds to wait for a connection from the pool before returning an error (minimum: 1).

You can also override these values per database by setting poolSize, maxOverflow, and poolTimeoutSeconds on individual database configurations (spec.postgres.backendDatabase, spec.postgres.temporalDatabase).

Background worker autoscaling

The automation orchestrator operator automatically scales the background worker based on CPU usage. The operator always enables autoscaling for the background worker. You can tune the scaling thresholds, but you cannot disable autoscaling.

Configure spec.backgroundWorker.hpa to adjust the scaling range and CPU target.

Table 6. Background worker autoscaling fields
Field Type Default Description
spec.backgroundWorker.hpa.minReplicas integer 1 Minimum number of background worker replicas. The autoscaler does not scale below this value.
spec.backgroundWorker.hpa.maxReplicas integer 5 Maximum number of background worker replicas (maximum: 100). The autoscaler does not scale above this value.
spec.backgroundWorker.hpa.targetCPUUtilization integer 80 Target average CPU utilization percentage (1-100). When average CPU usage across all background worker replicas exceeds this value, the autoscaler adds replicas.

When you omit these fields, the operator uses the defaults shown above. The replicas field is ignored for the background worker because autoscaling is always enabled.

File storage (S3)

Configure spec.fileStorage to connect automation orchestrator to an S3-compatible object storage endpoint for file uploads. When spec.fileStorage is omitted, the backend returns HTTP 503 for file upload requests.

Table 7. File storage fields
Field Type Default Description
spec.fileStorage.endpointURL string -- Required. S3-compatible endpoint URL (for example,https://s3.example.com).
spec.fileStorage.bucketName string orchestrator-files S3 bucket name for file storage.
spec.fileStorage.region string us-east-1 S3 region.
spec.fileStorage.verifySSL boolean true Enable TLS certificate verification for the S3 endpoint. Disable only for development environments.
spec.fileStorage.usePathStyle boolean true Use path-style S3 addressing. Required for OpenShift Data Foundation, NooBaa, Ceph, and MinIO endpoints.
spec.fileStorage.credentialSecretRef Secret reference -- Optional. Secret containing S3 access credentials (keys:access-key-id,secret-access-key).
spec.fileStorage.caCertSecretRef Secret reference -- Optional. Secret containing the CA certificate for S3 endpoint TLS verification (key:ca.crt).

The automation orchestrator operator validates file storage Secrets during reconciliation. If credentialSecretRef references a Secret that does not exist or is missing the required keys (access-key-id, secret-access-key), the operator sets ConfigurationValid=False. The same validation applies to caCertSecretRef if the referenced Secret does not exist or is missing the ca.crt key.

Setting an empty Secret name (for example, credentialSecretRef: {}) is also a validation error. The operator also emits a ConfigurationInvalid Kubernetes event with the same message.

The automation orchestrator operator applies the file storage configuration to backend and worker deployments only. The automation orchestrator operator monitors the credential and CA certificate Secrets for changes. When it detects a change, it triggers a rolling restart of backend and worker pods.

Internal TLS

Configure spec.tls to provide your own TLS certificates for internal service-to-service mutual TLS (mTLS) communication. When spec.tls is omitted, the operator generates a self-signed CA and per-service certificates automatically. For details on how internal TLS works, see Understand internal TLS. For instructions on providing your own certificates, see Provide your own internal TLS certificates.

Table 8. Internal TLS fields
Field Type Description
spec.tls.caSecretRef Secret reference Secret containing the internal CA certificate (key:ca.crt).
spec.tls.backendCertSecretRef Secret reference kubernetes.io/tls Secret for the backend service (keys:tls.crt,tls.key).
spec.tls.workerCertSecretRef Secret reference kubernetes.io/tls Secret for the worker service (keys:tls.crt,tls.key).
spec.tls.backgroundWorkerCertSecretRef Secret reference kubernetes.io/tls Secret for the background worker service (keys:tls.crt,tls.key).
spec.tls.temporalCertSecretRef Secret reference kubernetes.io/tls Secret for the Temporal service (keys:tls.crt,tls.key).
spec.tls.uiCertSecretRef Secret reference kubernetes.io/tls Secret for the UI service (keys:tls.crt,tls.key).

All certificate Secrets must include both serverAuth and clientAuth extended key usages. You must provide either all fields or none. Partial configuration is a validation error.

Auto-generated Secret names:

When spec.tls is omitted, the operator creates the following Secrets (where {name} is the custom resource name):

Table 9. Auto-generated TLS secrets
Secret name Type Keys
{name}-internal-ca Opaque ca.crt,ca.key
{name}-backend-tls kubernetes.io/tls tls.crt,tls.key
{name}-worker-tls kubernetes.io/tls tls.crt,tls.key
{name}-background-worker-tls kubernetes.io/tls tls.crt,tls.key
{name}-temporal-tls kubernetes.io/tls tls.crt,tls.key
{name}-ui-tls kubernetes.io/tls tls.crt,tls.key

Each service certificate includes DNS SANs for the Kubernetes Service ({name}-{component}.{namespace}.svc.cluster.local, {name}-{component}, localhost) and the IP SAN 127.0.0.1.

Network security

The automation orchestrator operator creates a default-deny ingress NetworkPolicy for the application namespace. Each component receives an allow rule that permits traffic only from the components that need to reach it. The operator also creates a dedicated ServiceAccount for each component. For the complete per-component NetworkPolicy specification, including metrics ingress rules and guidance for restricted network environments, see Automation orchestrator operator-managed NetworkPolicies. If you manage your own NetworkPolicies in the namespace, verify that the operator-managed policies do not conflict with your rules. The operator reconciles its policies on every cycle, so manual changes to operator-managed NetworkPolicy resources are overwritten.

Route changes

When you change the spec.ingress configuration on the custom resource, the operator recreates the Route automatically. You do not need to clean up the old resource manually.

Server-side request forgery (SSRF) allowlist

Configure spec.workflowHttpRequestAllowedHosts to permit workflow HTTP request steps to reach internal services. By default, HTTP request steps reject URLs that resolve to private or internal IP addresses to prevent server-side request forgery (SSRF) attacks. Add hostnames to this list only when workflows must reach specific internal services.

Table 10. SSRF allowlist field
Field Type Default Description
spec.workflowHttpRequestAllowedHosts list of strings empty Lowercase DNS hostnames (maximum 50 entries, 253 characters each).

Prometheus metrics collection

When the Prometheus Operator is installed on your cluster, the automation orchestrator operator automatically creates ServiceMonitor resources for the following components:

Table 11. Prometheus ServiceMonitor targets
Component Metrics port Protocol
Backend 8000 HTTPS
Worker 9090 HTTP
Background worker 9090 HTTP
Temporal server 9090 HTTP

You do not need to create ServiceMonitor resources manually. The operator manages the full lifecycle of these resources, including creation, updates, and deletion. If the Prometheus Operator is not installed, the operator skips ServiceMonitor creation with no effect on automation orchestrator functionality.

Prometheus scrapes each component's /metrics endpoint at a 30-second interval by default. For the complete list of available metrics, see the Prometheus metrics reference.

Labels and annotations

The automation orchestrator operator supports custom labels and annotations at two levels:

  • Global: spec.additionalLabels and spec.additionalAnnotations are applied to all managed resources. Use these for monitoring, service mesh, or cost allocation integration.
  • Per-component: spec.<component>.additionalLabels and spec.<component>.additionalAnnotations allow component-level customization.

Instance limits

One instance per namespace: You can create only one AutomationOrchestrator custom resource per namespace. If you create a second custom resource in the same namespace, the automation orchestrator operator reports a ConfigurationValid=False status and does not deploy it.

Known limitations

  • Bring your own PostgreSQL: The automation orchestrator operator does not provision PostgreSQL. Provide your own PostgreSQL instance. If you do not have an existing PostgreSQL provider, you can use aapctl to provision PostgreSQL with CloudNativePG. Red Hat does not provide support for CloudNativePG deployments. For CloudNativePG support, contact the official support partners at cloudnative-pg.io/support.
  • Downgrades are not supported: To roll back to a previous version, restore from a database backup.
  • One instance per namespace: Only one AutomationOrchestrator custom resource is allowed per namespace. The automation orchestrator operator enforces this at runtime.
  • Delayed validation for some configuration errors: Some configuration errors are not reported until after you apply the custom resource. Check the status conditions for validation errors if the deployment does not progress as expected.
  • Co-deployment managed by aapctl: The co-deployment of Ansible Automation Platform and automation orchestrator is handled by the aapctl install aap-with-ao command, not by the automation orchestrator operator. The automation orchestrator operator manages only the automation orchestrator components.
  • You cannot change container images: The automation orchestrator operator manages its own container images. For air-gapped environments, use platform-level registry mirroring (ImageDigestMirrorSet or ImageContentSourcePolicy) instead of changing image references.