Choose a deployment model

Compare deployment models

Automation orchestrator is a component of the Red Hat Ansible Automation Platform ecosystem. It runs on OpenShift Container Platform 4.14 and later and supports both x86_64 and ARM64 architectures.

You choose the deployment model at installation time. The model determines where automation orchestrator runs and how it connects to external services. Ansible Automation Platform co-location is a separate, day-2 configuration that you can add after installation. Automation orchestrator supports zero or more Ansible Automation Platform co-locations, each connecting to an automation gateway instance on port 443 for OpenID Connect (OIDC) authentication and job dispatch to automation controller.

Co-located

Automation orchestrator runs on an existing OpenShift cluster alongside other workloads. Choose this model if your OpenShift cluster meets the minimum resource requirements for automation orchestrator independently of any other workloads running on the cluster.

Independent

Automation orchestrator runs on its own dedicated OpenShift cluster with its own external PostgreSQL database host and optional S3-compatible storage. Choose this model if you need workload isolation or require independent lifecycle management.

Air-gapped

Automation orchestrator runs in a disconnected environment with no outbound internet access. You mirror container images to an internal registry by using oc-mirror . Automation orchestrator is delivered through the Red Hat operators catalog provided by OpenShift Container Platform. Choose this model if your environment has no outbound internet access due to security restrictions, regulatory requirements, or classified network policies.

Identify external dependencies

All deployment models share the following external dependencies.

PostgreSQL 15 database host

Required. You provide a database host where the automation orchestrator databases run. Automation orchestrator requires three databases: orchestrator , temporal , and temporal_visibility . These databases are separate from any Ansible Automation Platform databases.

Ansible Automation Platform

Optional. Automation orchestrator can connect to one or more Ansible Automation Platform deployments for OIDC authentication and job dispatch to automation controller. Each co-location connects to an automation gateway instance on port 443. Ansible Automation Platform can be any supported deployment type (VM-based, containerized, or OpenShift-based) as long as automation gateway is network-accessible. You configure Ansible Automation Platform co-locations as a day-2 operation after installation. Without an Ansible Automation Platform co-location, automation orchestrator functions but OIDC authentication and automation controller job dispatch are unavailable.

S3-compatible storage

Optional. Provides persistent storage for workflow artifacts and context files used by agent task nodes. The S3-compatible storage endpoint can run on-cluster or off-cluster, as long as it is network-accessible to automation orchestrator.

OpenTelemetry Collector endpoint

Optional. Enables telemetry collection. Automation orchestrator sends telemetry data to any standards-compliant OpenTelemetry Protocol (OTLP) endpoint on port 4318. The collector can run on-cluster (for example, using the Red Hat build of OpenTelemetry Operator) or off-cluster, as long as it is network-accessible to automation orchestrator.

LLM provider

Optional. Automation orchestrator supports any OpenAI-compliant API host, whether cloud-hosted or running locally in your environment. Agentic workflow nodes require an LLM provider. Without an LLM provider configured, agentic nodes cannot execute.

Review deployed components

The automation orchestrator operator deploys and manages several application services in your OpenShift namespace. You do not install or configure these services individually.

Communication between automation orchestrator services is secured with mutual TLS (mTLS), with the exception of Redis, which uses password authentication only. The operator generates a self-signed certificate authority (CA) and per-service certificates automatically during installation.