Understand the air-gapped topology

Review the infrastructure topology

The following diagram shows all automation orchestrator components on a disconnected OpenShift cluster, the image mirroring path from a connected environment, and the customer-managed dependencies within the disconnected network.

Read the diagram

The diagram uses the following conventions.

Disconnected network boundary

The outer boundary that separates the disconnected environment from the internet. No outbound internet access is available from within this boundary.

Automation orchestrator cluster

A disconnected OpenShift cluster containing all automation orchestrator components. Container images are pulled from the internal registry instead of external registries.

Internal container registry

A customer-managed registry within the disconnected network that stores mirrored container images. The OpenShift cluster pulls all images from this registry.

Image mirroring path

The path from a connected workstation through an air gap to the internal registry. You use oc-mirror on a connected workstation to download images, transfer them across the air gap, and push them to the internal registry.

Ansible Automation Platform cluster

A separate cluster within the disconnected network running automation gateway and automation controller. Automation orchestrator connects on port 443 for OpenID Connect (OIDC) authentication and job dispatch.

External dependencies

Customer-managed services within the disconnected network: PostgreSQL 15 database (required), S3-compatible storage (optional), and locally hosted LLM provider (optional).

Review key connections

All connections in this topology are within the disconnected network. No outbound internet access is required after the initial image mirroring.

• Automation orchestrator connects to automation gateway on port 443 for OIDC authentication and job dispatch.
• Automation orchestrator connects to its own external PostgreSQL 15 database on port 5432.
• The OpenShift cluster pulls container images from the internal registry.
• If you configure a locally hosted LLM provider, automation orchestrator backend pods connect to the provider endpoint over HTTPS.

Review automation orchestrator components

The automation orchestrator operator deploys and manages the following components on the disconnected cluster. All internal communication is secured with mutual TLS (mTLS). Container images are pulled from the internal registry.

Identify image mirroring infrastructure

You provision and manage the following infrastructure to deliver container images to the disconnected cluster.

Review external Ansible Automation Platform components

The following Ansible Automation Platform components run on a separate cluster within the disconnected network.

Automation orchestrator does not connect to automation hub or Event-Driven Ansible.

Identify customer-managed external dependencies

You provision and manage the following services within the disconnected network.

Review tested configurations

The following table lists the infrastructure components and versions tested with automation orchestrator in an air-gapped deployment.

Review network ports within the disconnected network

All traffic in this topology stays within the disconnected network. No outbound internet access is required after the initial image mirroring.

Review internal network ports

The following ports handle traffic between automation orchestrator components within the cluster. All internal traffic is secured with mutual TLS (mTLS) using operator-generated certificates.

For the complete list of NetworkPolicy resources that the operator creates for each component, see Automation orchestrator operator-managed NetworkPolicies.

Review the example custom resource

The following example shows an AutomationOrchestrator custom resource (CR) configured for an air-gapped deployment. All referenced services must be within the disconnected network. Edit the values to match your environment before you apply the CR.

apiVersion: aap.ansible.com/v1alpha1
  kind: AutomationOrchestrator
  metadata:
    name: my-orchestrator
    namespace: automation-orchestrator
  spec:
    postgres:
      host: pg.internal.example.com
      port: 5432
      sslMode: verify-full
      backendDatabase:
        secretRef:
          name: orchestrator-pg-credentials
      temporalDatabase:
        secretRef:
          name: temporal-pg-credentials
      temporalVisibilityDatabase:
        secretRef:
          name: temporal-visibility-pg-credentials
      caCertSecretRef:
        name: orchestrator-pg-ca
    ingress:
      host: orchestrator.apps.internal.example.com
    imagePullSecrets:
      - name: internal-registry-pull-secret
    backend:
      replicas: 2
    ui:
      replicas: 2
    worker:
      replicas: 2

Configure required fields

Configure the following fields for every air-gapped deployment.

postgres

Connection details for your external PostgreSQL 15 database host within the disconnected network. You must provide separate credential secrets for three databases: orchestrator (backend), temporal , and temporal_visibility . Use verify-full SSL mode with a CA certificate to secure the database connection. Automation orchestrator does not share Ansible Automation Platform databases.

ingress.host

The hostname for the OpenShift Route. Set this to a DNS name that resolves within the disconnected network.

imagePullSecrets

A reference to a Kubernetes secret containing credentials for your internal container registry. Required if the registry requires authentication.

Create the registry pull secret

Create a Kubernetes secret for the internal registry credentials before you apply the CR.

oc create secret docker-registry internal-registry-pull-secret
    --namespace automation-orchestrator
    --docker-server=registry.internal.example.com
    --docker-username=REPLACE_WITH_USERNAME
    --docker-password=REPLACE_WITH_PASSWORD

Configure optional fields

Uncomment and configure the following fields based on your requirements. In an air-gapped deployment, all optional services must be within the disconnected network.

fileStorage

S3-compatible object storage for workflow artifacts and context files used by agent task nodes. Must be within the disconnected network. If you omit this section, file upload operations return an error.

otel

OpenTelemetry export configuration for sending audit events to a collector. Requires a network-accessible OpenTelemetry Collector endpoint on port 4318 within the disconnected network.

secrets

References to pre-created secrets for JWT signing keys, the credential encryption key, the Redis password, and the initial admin password. The operator auto-generates these secrets if you do not provide them.

tls

References to customer-provided internal TLS certificates. The operator generates a self-signed CA and per-service certificates if you do not provide them.