diff --git a/downstream/assemblies/platform/assembly-aap-through-a-proxy.adoc b/downstream/assemblies/platform/assembly-aap-through-a-proxy.adoc new file mode 100644 index 0000000000..e7fc964d75 --- /dev/null +++ b/downstream/assemblies/platform/assembly-aap-through-a-proxy.adoc @@ -0,0 +1,29 @@ +[id="assembly-aap-through-a-proxy"] + +ifdef::context[:parent-context: {context}] +:context: planning-mesh + += Configure {PlatformNameShort} to use egress proxy + +You can deploy {PlatformNameShort} so that egress from the platform functions properly through proxy servers. + +The procedure prepares infrastructure, installs {PlatformNameShort}, and runs tests on the topology with a proxy on the control plane. + +Several steps are involved: + +* Deploying {PlatformNameShort} either using RPM or containerized installers +* Configuring the {RHEL} host proxy settings to point to a proxy server to which outbound traffic is routed. +* Launch an {PlatformNameShort} job that automates a remote resource either through HTTP/HTTPS or SSH. + +After which the automation traffic routes through the proxy server and completes successfully. + +include::platform/con-overview-egress-proxy.adoc[leveloffset=+1] +include::platform/con-proxy-backends.adoc[leveloffset=+1] +include::platform/ref-system-proxy-configuration.adoc[leveloffset=+1] +include::platform/ref-supported-cloud-providers.adoc[leveloffset=+1] +include::platform/proc-proxy-controller-settings.adoc[leveloffset=+1] +include::hub/hub/proc-configure-proxy-remote.adoc[leveloffset=+1] +include::platform/proc-eda-proxy-settings.adoc[leveloffset=+1] +include::platform/ref-automation-mesh-settings.adoc[leveloffset=+1] +include::platform/ref-environment-proxy-settings.adoc[leveloffset=+2] + diff --git a/downstream/images/eda_proxy_field.png b/downstream/images/eda_proxy_field.png new file mode 100644 index 0000000000..1da547489a Binary files /dev/null and b/downstream/images/eda_proxy_field.png differ diff --git a/downstream/images/extra_variables.png b/downstream/images/extra_variables.png new file mode 100644 index 0000000000..b9be31be22 Binary files /dev/null and b/downstream/images/extra_variables.png differ diff --git a/downstream/images/proxy_architecture.png b/downstream/images/proxy_architecture.png new file mode 100644 index 0000000000..c0d1af8319 Binary files /dev/null and b/downstream/images/proxy_architecture.png differ diff --git a/downstream/modules/hub/proc-configure-proxy-remote.adoc b/downstream/modules/hub/proc-configure-proxy-remote.adoc index 74313edbbb..fbb982fef0 100644 --- a/downstream/modules/hub/proc-configure-proxy-remote.adoc +++ b/downstream/modules/hub/proc-configure-proxy-remote.adoc @@ -3,7 +3,12 @@ :_mod-docs-content-type: PROCEDURE [id="configure-proxy-remote_{context}"] +ifdef::manage-hub[] = Configuring proxy settings +endif::[] +ifndef::manage-hub[] += Configuring proxy settings on {HubName} +endif::[] [role="_abstract"] If your {PrivateHubName} is behind a network proxy, you can configure proxy settings on the remote to sync content located outside of your local network. diff --git a/downstream/modules/platform/con-overview-egress-proxy.adoc b/downstream/modules/platform/con-overview-egress-proxy.adoc new file mode 100644 index 0000000000..909573b8fc --- /dev/null +++ b/downstream/modules/platform/con-overview-egress-proxy.adoc @@ -0,0 +1,11 @@ +[id="con-overview-egress-proxy"] + += Overview +The approach uses cloud provider security groups to limit the external outbound traffic of the control nodes. +All the control plane _Virtual Machines_ (VMs) also have system proxy configured which enable the required outbound traffic to flow over the proxy VMs. + +All local traffic within the restricted security group is allowed. + +The following diagram is an overview of the infrastructure architecture: + +image:proxy_architecture.png[Generalized AAP architecture communicating via a proxy with the internet gateway] diff --git a/downstream/modules/platform/con-proxy-backends.adoc b/downstream/modules/platform/con-proxy-backends.adoc new file mode 100644 index 0000000000..a639b4a94d --- /dev/null +++ b/downstream/modules/platform/con-proxy-backends.adoc @@ -0,0 +1,9 @@ +[id="con-proxy-backends"] + += Proxy Backends + +For HTTP and HTTPS proxies you can use a squid server. +Squid is a forward proxy for the Web supporting HTTP, HTTPS, and FTP, reducing bandwidth and improving response times by caching and reusing frequently-requested web pages. +It is licensed under the GNU GPL. +Forward proxies are systems that intercept network traffic going to another network (typically the internet) and send it on the behalf of the internal systems. +The squid proxy enables all required communication to pass through it. diff --git a/downstream/modules/platform/proc-eda-proxy-settings.adoc b/downstream/modules/platform/proc-eda-proxy-settings.adoc new file mode 100644 index 0000000000..139f73ef9d --- /dev/null +++ b/downstream/modules/platform/proc-eda-proxy-settings.adoc @@ -0,0 +1,12 @@ +[id="proc-eda-proxy-settings"] + += {EDAName} settings +For {EDAName}, there are no global settings to set a proxy. +You must specify the proxy for every project. + +.Procedure +. From the navigation panel, select {MenuADProjects}. +. Click *Create project* +. Use the Proxy field. ++ +image:eda_proxy_field.png[EDA create project page] diff --git a/downstream/modules/platform/proc-proxy-controller-settings.adoc b/downstream/modules/platform/proc-proxy-controller-settings.adoc new file mode 100644 index 0000000000..1812961237 --- /dev/null +++ b/downstream/modules/platform/proc-proxy-controller-settings.adoc @@ -0,0 +1,60 @@ +[id="proc-proxy-controller-settings"] + += Controller settings + +After using the RPM installer, you must configure {ControllerName} to use outbound proxy. + +[NOTE] +==== +This is not required for containerized installers because podman uses system configured proxy and redirects all the container traffic to the proxy. For automation controller you must set the `AWX_TASK_ENV` variable in `/api/v2/settings/`. +==== + +To do this through the UI use the following procedure: + +.Procedure + +. From the navigation pane, select {MenuSetJob}. +. Click Edit. +. Add the variables to the Extra Environment Variables field ++ +image:extra_variables.png[extra variables field] ++ +set: +---- +"AWX_TASK_ENV": { +"http_proxy": "http://external-proxy_0:3128", +"https_proxy": "http://external-proxy_0:3128", +"no_proxy": "localhost,127.0.0.0/8" + } +---- +The control plane must open all outbound ports to the proxy. + +The {PlatformNameShort} specific ports are as follows: +---- +acl Safe_ports port 81 +acl Safe_ports port 82 +acl Safe_ports port 389 +acl Safe_ports port 444 +acl Safe_ports port 445 +acl SSL_ports port 22 +---- +The following ports are for containerized installations: +---- +acl SSL_ports port 444 +acl SSL_ports port 445 +acl SSL_ports port 8443 +acl SSL_ports port 8444 +acl SSL_ports port 8445 +acl SSL_ports port 8446 +acl SSL_ports port 44321 +acl SSL_ports port 44322 + +http_access deny !Safe_ports +http_access deny CONNECT !SSL_ports +---- +Set the following environment variables on all nodes (ideally in the `/etc/environment` file): +---- +http_proxy=“http://proxy_host:proxy_port” +https_proxy=“http://proxy_host:proxy_port” +no_proxy=“localhost,127.0.0.0/8,10.0.0.0/8” +---- diff --git a/downstream/modules/platform/ref-automation-mesh-settings.adoc b/downstream/modules/platform/ref-automation-mesh-settings.adoc new file mode 100644 index 0000000000..60603d95ae --- /dev/null +++ b/downstream/modules/platform/ref-automation-mesh-settings.adoc @@ -0,0 +1,20 @@ +[id="ref-automation-mesh-settings"] + += Automation mesh settings + +You can route outbound communication from the receptor on an automation mesh node through a proxy server. +If your proxy does not strip out TLS certificates then an installation of {PlatformName} automatically supports the use of a proxy server. + +Every node on the mesh must have a Certifying Authority that the installer creates on your behalf. + +The default install location for the Certifying Authority is: + +`/etc/receptor/tls/ca/mesh-CA.crt` + +The certificates and keys created on your behalf use the nodeID for their names: + +For the certificate: +`/etc/receptor/tls/NODEID.crt` + +For the key: +`/etc/receptor/tls/NODEID.key' diff --git a/downstream/modules/platform/ref-environment-proxy-settings.adoc b/downstream/modules/platform/ref-environment-proxy-settings.adoc new file mode 100644 index 0000000000..b34fb9b1ec --- /dev/null +++ b/downstream/modules/platform/ref-environment-proxy-settings.adoc @@ -0,0 +1,11 @@ +[id="ref-environment-proxy-settings"] + += Environment proxy settings for an individual inventory sync that uses the AWS inventory plugin +Manually edit `/usr/lib/systemd/system/receptor.service.d/override.conf` and add the following `http_proxy` environment variables there: + +---- +http_proxy +https_proxy +proxy_username +proxy_password +---- diff --git a/downstream/modules/platform/ref-supported-cloud-providers.adoc b/downstream/modules/platform/ref-supported-cloud-providers.adoc new file mode 100644 index 0000000000..bcf7266036 --- /dev/null +++ b/downstream/modules/platform/ref-supported-cloud-providers.adoc @@ -0,0 +1,14 @@ +[id="ref-supported-cloud-providers"] + += Supported cloud providers + +To support proxy testing the cloud provider must have: + +* A concept of security groups to limit traffic for the nodes within the same subnet. +* All the static security groups configured + +At present the following cloud provider is supported to run proxy test scenarios: + +* AWS (ec2) + +Proxy settings must be configured for each {PlatformNameShort} component. diff --git a/downstream/modules/platform/ref-system-proxy-configuration.adoc b/downstream/modules/platform/ref-system-proxy-configuration.adoc new file mode 100644 index 0000000000..9d0059450e --- /dev/null +++ b/downstream/modules/platform/ref-system-proxy-configuration.adoc @@ -0,0 +1,14 @@ +[id="ref-system-proxy-configuration"] + += System proxy configuration + +The outbound proxy is configured on the system level for all the nodes in the restricted security group. + +The following environment variables must be set: +---- +http_proxy=“http://{{ groups[‘external_proxy’][0] }}:3128” +https_proxy=“http://{{ groups[‘external_proxy’][0] }}:3128” +no_proxy=“localhost,127.0.0.0/8,10.0.0.0/8” +---- + +The installer ensures that all external communication during the installation goes through the proxy. diff --git a/downstream/titles/automation-mesh/master.adoc b/downstream/titles/automation-mesh/master.adoc index b037bc6122..ced843a325 100644 --- a/downstream/titles/automation-mesh/master.adoc +++ b/downstream/titles/automation-mesh/master.adoc @@ -26,3 +26,6 @@ include::platform/assembly-setting-up-automation-mesh.adoc[leveloffset=+1] include::platform/assembly-mesh-design-patterns.adoc[leveloffset=+1] include::platform/assembly-deprovisioning-mesh.adoc[leveloffset=+1] + +include::platform/assembly-aap-through-a-proxy.adoc[leveloffset=+1] + diff --git a/downstream/titles/hub/managing-content/master.adoc b/downstream/titles/hub/managing-content/master.adoc index ccc26c42c3..f118240b39 100644 --- a/downstream/titles/hub/managing-content/master.adoc +++ b/downstream/titles/hub/managing-content/master.adoc @@ -2,6 +2,7 @@ :numbered: :toclevels: 1 :experimental: +:manage-hub: include::attributes/attributes.adoc[] = Managing automation content