Understand the Ansible Automation Platform co-located topology

Review the infrastructure topology

The following diagram shows automation orchestrator components on an OpenShift cluster, including external dependencies and network connections.

Read the diagram

The diagram uses the following conventions.

Enterprise ingress

A firewall or load balancer that sits in front of the OpenShift cluster in a production environment. Automation orchestrator does not require a load balancer, but the diagram shows where one would sit in a typical enterprise deployment.

OpenShift Route

The entry point for all external traffic to automation orchestrator. TLS terminates at the Route, and nginx in the web UI pod reverse-proxies /api and /ws paths to the backend service on port 8000. The automation orchestrator operator creates the Route automatically during installation.

Automation orchestrator components

The backend service, worker, background worker, Temporal workflow engine, web UI, and Redis. The automation orchestrator operator manages these components. Communication between most services is secured with mutual TLS (mTLS) using operator-generated certificates. Redis uses password authentication only and does not use TLS.

Ansible Automation Platform

Automation gateway and automation controller. The diagram shows Ansible Automation Platform as an external co-location. If configured, automation orchestrator connects to automation gateway on port 443 for OIDC authentication and job dispatch. Ansible Automation Platform can run on the same cluster or on any other supported deployment that is network-accessible.

External dependencies

Services that automation orchestrator connects to outside the cluster boundary. These include the PostgreSQL 15 database host (required), S3-compatible storage (optional), OpenTelemetry Collector endpoint (optional), and LLM providers (optional).

Review key connections

Automation orchestrator supports the following external connections.

• If co-located with Ansible Automation Platform, automation orchestrator connects to automation gateway on port 443 over HTTPS for OIDC authentication and job dispatch to automation controller. You can configure zero or more Ansible Automation Platform co-locations.
• Automation orchestrator connects to its own external PostgreSQL 15 database host on port 5432. Automation orchestrator requires three databases ( orchestrator , temporal , and temporal_visibility ), separate from any Ansible Automation Platform databases.
• If you configure S3-compatible storage, automation orchestrator connects to the S3 endpoint over HTTPS for workflow artifacts and agent task node context files.
• If you configure an OpenTelemetry Collector endpoint, automation orchestrator sends telemetry data over OTLP on port 4318.
• If you configure an LLM provider, the worker and background worker pods make outbound HTTPS requests to the provider endpoint.

Review automation orchestrator components

The automation orchestrator operator deploys and manages the following components. Communication between most services is secured with mutual TLS (mTLS). Redis uses password authentication only and does not use TLS.

Review Ansible Automation Platform components

If you co-locate with Ansible Automation Platform, the following components are relevant to automation orchestrator. These components are managed by the Ansible Automation Platform operator.

Identify customer-managed external dependencies

You provision and manage the following services. These can run on-cluster or off-cluster, as long as they are network-accessible to automation orchestrator.

Review tested configurations

The following table lists the infrastructure components and versions tested with automation orchestrator in an Ansible Automation Platform co-located deployment.

Review external network ports

The following ports handle traffic between automation orchestrator and services outside the cluster or outside the automation orchestrator namespace.

Review internal network ports

The following ports handle traffic between automation orchestrator components within the cluster. Communication between most services is secured with mutual TLS (mTLS) using operator-generated certificates. Redis uses password authentication only and does not use TLS.

For the complete list of NetworkPolicy resources that the operator creates for each component, see Automation orchestrator operator-managed NetworkPolicies.

Review internal service communication

Automation orchestrator secures communication between most internal components with mTLS. The operator generates a self-signed certificate authority (CA) and per-service certificates automatically during installation. Redis uses password authentication only and does not use TLS. You do not need to open additional ports or configure TLS certificates for internal traffic unless your organization requires certificates from a specific CA.

Review the example custom resource

The following example shows an AutomationOrchestrator custom resource (CR) configured for an Ansible Automation Platform co-located deployment. Edit the values to match your environment before you apply the CR.

apiVersion: aap.ansible.com/v1alpha1
  kind: AutomationOrchestrator
  metadata:
    name: my-orchestrator
    namespace: automation-orchestrator
  spec:
    postgres:
      host: pg.example.com
      port: 5432
      sslMode: require
      backendDatabase:
        secretRef:
          name: orchestrator-pg-credentials
      temporalDatabase:
        secretRef:
          name: temporal-pg-credentials
      temporalVisibilityDatabase:
        secretRef:
          name: temporal-visibility-pg-credentials
    ingress:
      host: orchestrator.apps.example.com
    backend:
      replicas: 2
    ui:
      replicas: 2
    worker:
      replicas: 2

Configure required fields

Configure the following fields for every Ansible Automation Platform co-located deployment.

postgres

Connection details for your external PostgreSQL 15 database host. You must provide separate credential secrets for three databases: orchestrator (backend), temporal , and temporal_visibility . Automation orchestrator does not share Ansible Automation Platform databases.

ingress.host

The hostname for the OpenShift Route that the operator creates for external access. Set this to a DNS name that resolves to your OpenShift cluster.

Create database credential secrets

Create three Kubernetes secrets for the PostgreSQL database credentials before you apply the CR. Each secret must contain the following keys: database , username , and password .

apiVersion: v1
  kind: Secret
  metadata:
    name: orchestrator-pg-credentials
    namespace: automation-orchestrator
  type: Opaque
  stringData:
    database: orchestrator
    username: orchestrator
    password: REPLACE_WITH_PASSWORD

  apiVersion: v1
  kind: Secret
  metadata:
    name: temporal-pg-credentials
    namespace: automation-orchestrator
  type: Opaque
  stringData:
    database: temporal
    username: temporal
    password: REPLACE_WITH_PASSWORD

  apiVersion: v1
  kind: Secret
  metadata:
    name: temporal-visibility-pg-credentials
    namespace: automation-orchestrator
  type: Opaque
  stringData:
    database: temporal_visibility
    username: temporal_visibility
    password: REPLACE_WITH_PASSWORD

Configure optional fields

Uncomment and configure the following fields based on your requirements.

fileStorage

S3-compatible object storage for workflow artifacts and context files used by agent task nodes. If you omit this section, file upload operations return an error.

otel

OpenTelemetry export configuration for sending audit events to an external collector. Requires a network-accessible OpenTelemetry Collector endpoint on port 4318. The collector does not need to run on the same cluster.

secrets

References to pre-created secrets for JWT signing keys, the credential encryption key, the Redis password, and the initial admin password. The operator auto-generates these secrets if you do not provide them.

tls

References to customer-provided internal TLS certificates. The operator generates a self-signed CA and per-service certificates if you do not provide them.