infra.automation_development_office

Automation Development Office (infra.automation_development_office) Ansible collection for building and operating platform automation across Ansible Automation Platform, OpenShift, RHEL, Satellite, identity services, and supporting tooling.

This collection packages reusable roles and modules used by ADO bootstrap and day-2 workflows so teams can install, configure, and operate infrastructure components consistently.

Collection purpose

infra.automation_development_office provides:

• Roles for opinionated platform automation:
  • AAP and bootstrap — install and configure Ansible Automation Platform, build execution environments, and generate bootstrap playbook repositories and controller objects
  • OpenShift platform — operators, namespaces, routes, storage, logging, security, GitOps, virtualization, and related cluster services
  • Identity — Red Hat IdM (FreeIPA), Red Hat build of Keycloak (RHBK), LDAP, and OIDC authentication integrations
  • RHEL and Satellite — repositories, patching, registration, services, mounts, and Satellite install/content-view management
  • Observability and devops tooling — Grafana, Elastic, Kafka, GitLab, Jira, and related helpers
• Modules for focused tasks that do not fit a role, such as copying an AWS AMI between regions without depending on community.aws
• Collection playbooks for portable AWS day-2 work (EC2 instance lifecycle and S3 bucket policy). Bootstrap apps under the aws platform (ec2_instance, s3_bucket_policy, ec2_ami_copy) share vault_aws.yml

Ansible version compatibility

This collection has been tested against the following Ansible versions: >=2.17.0.

Plugins and modules within a collection may be tested with only specific Ansible versions. A collection may contain metadata that identifies these versions. PEP440 is the schema used to describe the versions of Ansible.

Content index

Type	Name	Description
Module	infra.automation_development_office.ec2_ami_copy	Copy an AWS AMI between regions; optionally rename with name or omit it to keep the source name.
Playbooks	playbooks/aws/ec2	EC2 create / delete / modify / info (infra.automation_development_office.aws.ec2.ado_ec2_instance_*).
Playbooks	playbooks/aws/s3	S3 bucket policy set / set-from-file / info (infra.automation_development_office.aws.s3.ado_s3_bucket_policy_*).
Role	See Role documentation	Platform automation roles (AAP, OpenShift, RHEL, identity, and more).

Module documentation

Each module keeps its detailed usage, parameters, and examples under docs/modules/. Use this index as the starting point for operators and automation users.

Module	Description
infra.automation_development_office.ec2_ami_copy	Copy an AWS AMI between regions; optionally rename with name or omit it to keep the source name.

Collection playbooks

Portable AWS playbooks live under playbooks/aws/ and are addressable by collection FQCN after ansible-galaxy collection install. Details, variables, and examples stay in each directory README:

Path	FQCN prefix	Purpose
playbooks/aws/ec2	infra.automation_development_office.aws.ec2.ado_ec2_instance_*	EC2 instance create, delete, modify, and info
playbooks/aws/s3	infra.automation_development_office.aws.s3.ado_s3_bucket_policy_*	Create a bucket if needed and set or read its resource policy

When preflight selects the aws platform apps ec2_instance or s3_bucket_policy, bootstrap seeds Contoller job templates that import_playbook those FQCNs and load shared vault_aws.yml (no per-app AWS vault). s3_bucket_policy also seeds a Jinja sample policy at playbooks/aws/s3/policies/allow_list_and_read.json (override with s3_bucket_policy_file).

Role documentation

Each role keeps its detailed usage, variables, and examples in its own README. Use this index as the starting point for operators and automation users.

Role	Description
infra.automation_development_office.aap_build_ee	Build a custom Ansible Execution Environment (EE) image with ansible-builder.
infra.automation_development_office.aap_configuration	Collect user-provided AAP configuration files and dispatch them to the upstream infra.aap_configuration.dispatch role for processing.
infra.automation_development_office.acs_report	Generate RHACS vulnerability reports from Central and optional CVE enrichment via acs-cve-plugin.
infra.automation_development_office.acs_upload_policies	Upload RHACS policy bundles to Central from role files or custom paths.
infra.automation_development_office.bootstrap_controller	Generate and apply Ansible Automation Platform controller objects for an ADO bootstrap repository.
infra.automation_development_office.bootstrap_flatten_vars	Flatten a named dictionary into top-level Ansible facts for bootstrap playbooks that expect direct variable names.
infra.automation_development_office.bootstrap_framework_defaults	Load shared bootstrap framework defaults before component-specific roles resolve their effective configuration.
infra.automation_development_office.bootstrap_generate_env_vars	Generate environment group variables and vault files used by the ADO bootstrap playbook repository.
infra.automation_development_office.bootstrap_generate_playbook_repo	Create or refresh the generated bootstrap playbook repository structure used by ADO component automation.
infra.automation_development_office.bootstrap_resolve_component	Resolve one bootstrap component into the effective variable set used by its generated playbook.
infra.automation_development_office.bookstack_openshift	Deploy BookStack on OpenShift with MariaDB, Routes, and optional RHBK OIDC.
infra.automation_development_office.elastic	Operational checks and actions for Elasticsearch through a state-driven interface.
infra.automation_development_office.gitlab_install	Install and configure GitLab on OpenShift using the GitLab Operator and Custom Resource (CR).
infra.automation_development_office.grafana_create_datasource	Configure a Grafana Prometheus datasource from the OpenShift Prometheus route and a service-account token.
infra.automation_development_office.grafana_install	Deploy Grafana on OpenShift with the Grafana Operator, storage, credentials, optional OIDC, and a Route.
infra.automation_development_office.grafana_manage_folders	Create and manage Grafana dashboard folders.
infra.automation_development_office.grafana_upload_dashboards	Render and upload Grafana dashboards with OpenShift datasource substitution.
infra.automation_development_office.idm_ad_trust	Establish IdM ↔ Active Directory trust and map AD groups for SSH/sudo.
infra.automation_development_office.idm_client	Register hosts as Red Hat IdM (FreeIPA) clients.
infra.automation_development_office.idm_configure_replica	Install and configure an IdM replica server.
infra.automation_development_office.idm_dns	Manage IdM DNS records via redhat.rhel_idm.
infra.automation_development_office.idm_server	Install and configure a Red Hat Identity Management (IdM/FreeIPA) server.
infra.automation_development_office.install_aap	Install AAP on OpenShift or RHEL via validated infra.aap_utilities (aap_ocp_install / aap_setup_*).
infra.automation_development_office.install_dirsrv	Install and configure 389 Directory Server (DirSrv) on OpenShift.
infra.automation_development_office.install_elastic	Deploy Elastic Cloud on Kubernetes (ECK) operator and Elasticsearch/Kibana on OpenShift.
infra.automation_development_office.install_gitlab	Install standalone GitLab CE/EE on RHEL (Omnibus packages or offline RPM).
infra.automation_development_office.install_postfix	Deploy a Postfix relay on OpenShift with ConfigMap, Secret, and Pod resources.
infra.automation_development_office.install_rhbk	Install or tear down Red Hat build of Keycloak (RHBK) on OpenShift or as a standalone RHEL zip install.
infra.automation_development_office.jira	Create Jira issues and subtasks from track templates for ADO automation workflows.
infra.automation_development_office.jira_stories	Create and manage Jira stories and optional subtasks from selected track templates.
infra.automation_development_office.kafka_install	Install the AMQ Streams / Kafka operator and related resources on OpenShift.
infra.automation_development_office.keycloak_login_events_exporter	Poll Keycloak/RHBK user events and export login success/failure Prometheus gauges that include username.
infra.automation_development_office.netbox_oidc	Wire NetBox login to Keycloak / RHBK OIDC (client netbox).
infra.automation_development_office.ocp_aap_hub_harden	Separate AAP Hub onto dedicated Postgres (optional), then pin replicas/workers and the stability CronJob.
infra.automation_development_office.ocp_absent_cleanup	Safe OpenShift absent cleanup gate for Terminating namespaces, stuck finalizers, and leftover OLM/workloads.
infra.automation_development_office.ocp_acm	Install ACM MultiClusterHub (wait Running, Fleet Management plug-ins); thorough absent cleanup for stuck uninstall leftovers.
infra.automation_development_office.ocp_acs	Install Red Hat Advanced Cluster Security (ACS) Central and related resources on OpenShift.
infra.automation_development_office.ocp_alt_routes	Ensure alternate OpenShift Routes exist from a configured candidate list.
infra.automation_development_office.ocp_awspca	Manage an AWS PCA-backed AWSPCAClusterIssuer and its credentials Secret in OpenShift/Kubernetes.
infra.automation_development_office.ocp_cert_manager	Install and configure cert-manager on OpenShift, with optional AWS PCA intermediate CA material.
infra.automation_development_office.ocp_compliance_install	Validate that Compliance Operator pods are present and at least one pod reaches the Running phase.
infra.automation_development_office.ocp_compliance_profiles	Create or delete a Compliance Operator ComplianceProfile resource.
infra.automation_development_office.ocp_compliance_remediation	Trigger an ACS remediation request by calling the ACS API when remediation is enabled.
infra.automation_development_office.ocp_compliance_scan	Create Compliance Operator scan resources for scheduled or immediate scan execution.
infra.automation_development_office.ocp_component_route	Resolve primary and alternate OpenShift Route hostnames for an ADO component.
infra.automation_development_office.ocp_console_banner	Manage OpenShift console notification banners using ConsoleNotification resources.
infra.automation_development_office.ocp_data_foundation	Create an OpenShift Data Foundation (ODF) StorageCluster.
infra.automation_development_office.ocp_descheduler	Install and configure the Kubernetes Descheduler on OpenShift.
infra.automation_development_office.ocp_devspaces	Install or remove the OpenShift Dev Spaces operator and related resources.
infra.automation_development_office.ocp_devspaces_user_config	Configure per-user OpenShift Dev Spaces resources (certs, bashrc ConfigMap, PVC).
infra.automation_development_office.ocp_dev_hub	Deploy Red Hat Developer Hub (RHDH) on OpenShift via the RHDH operator with optional GitLab catalog and Keycloak OIDC.
infra.automation_development_office.ocp_disconnected_install	Validate an exported disconnected OpenShift agent-install bundle and record a per-run status directory.
infra.automation_development_office.ocp_discover_routes	Discover OpenShift Route hostnames cluster-wide and build alternate-route candidates.
infra.automation_development_office.ocp_efs_csi	Create an AWS EFS CSI StorageClass on OpenShift.
infra.automation_development_office.ocp_egress	Apply OpenShift egress resources (EgressIP, EgressFirewall) on OVN-Kubernetes.
infra.automation_development_office.ocp_gitlab_runner	Deploy GitLab Runner to OpenShift using a Kubernetes deployment.
infra.automation_development_office.ocp_gitops	Deploy and configure an OpenShift GitOps (Argo CD) instance and optional route.
infra.automation_development_office.ocp_htpasswd_admin	Create or remove an htpasswd OAuth identity provider and admin user on OpenShift.
infra.automation_development_office.ocp_image_registry	Optionally enable the OpenShift integrated image registry and validate operational status.
infra.automation_development_office.ocp_iscsi_storage	Install Synology CSI (iSCSI) on OpenShift using kubernetes.core.k8s.
infra.automation_development_office.ocp_ldap_auth	Configure OpenShift LDAP OAuth authentication from vault ldap_config.
infra.automation_development_office.ocp_logging	Configure OpenShift Cluster Log Forwarder (for example Splunk) for cluster logging.
infra.automation_development_office.ocp_loki	Create or delete a LokiStack for OpenShift logging and observability.
infra.automation_development_office.ocp_metallb_install	Install MetalLB and configure IPAddressPools, L2Advertisements, and BGP peering for bare-metal LoadBalancer services.
infra.automation_development_office.ocp_minio	Deploy MinIO object storage on OpenShift with API/console Routes and optional Keycloak OIDC console login.
infra.automation_development_office.ocp_namespace	Create or delete OpenShift/Kubernetes namespaces (absent runs ocp_absent_cleanup).
infra.automation_development_office.ocp_network_policy	Apply NetworkPolicy, MultiNetworkPolicy, AdminNetworkPolicy, BaselineAdminNetworkPolicy, and EgressFirewall resources.
infra.automation_development_office.ocp_networking	Centralized OpenShift networking orchestration — tenant networks (UDN/CUDN), security policies, physical networks, MetalLB, and egress.
infra.automation_development_office.ocp_nfs_storage	Install the NFS CSI driver via Helm and configure NFS-backed storage on OpenShift.
infra.automation_development_office.ocp_nmstate_install	Install the NMState Operator and apply NodeNetworkConfigurationPolicy bridges and bonds for physical node networking.
infra.automation_development_office.ocp_oadp	Configure OpenShift API for Data Protection (OADP) DataProtectionApplication and credentials.
infra.automation_development_office.ocp_mtv	Create ForkliftController for Migration Toolkit for Virtualization after mtv-operator is installed.
infra.automation_development_office.ocp_oidc_auth	Configure OpenShift OIDC OAuth authentication (typically via Keycloak/RHBK).
infra.automation_development_office.ocp_operator_defaults	Resolve OpenShift operator PackageManifest defaults for downstream operator installs.
infra.automation_development_office.ocp_operator_subscription	Create or update OLM OperatorGroups and Subscriptions for OpenShift operators.
infra.automation_development_office.ocp_operatorgroups	Create or delete OperatorGroups used by OpenShift operator installs.
infra.automation_development_office.ocp_print_crd	Discover an operator Subscription in a namespace and print related CRD and operator info.
infra.automation_development_office.ocp_pull_secrets	Manage the cluster pull-secret (registry auth) for OpenShift.
infra.automation_development_office.ocp_quay	Install or remove Red Hat Quay (namespace, PVC or MinIO object storage, operator) on OpenShift.
infra.automation_development_office.ocp_rhbk_client_secrets	Fetch RHBK client secrets and materialize them as OpenShift Secrets for components.
infra.automation_development_office.ocp_routes	List and print OpenShift Route hostnames for one or more namespaces.
infra.automation_development_office.ocp_search_dirsrv	Locate a running DirSrv pod for subsequent directory operations.
infra.automation_development_office.ocp_secret_replicator	Replicate a Kubernetes Secret to namespaces and/or HashiCorp Vault.
infra.automation_development_office.ocp_service_accounts	Create or delete OpenShift/Kubernetes ServiceAccounts across target namespaces.
infra.automation_development_office.ocp_udn	Manage UserDefinedNetwork, ClusterUserDefinedNetwork, and NetworkAttachmentDefinition resources for OVN-Kubernetes.
infra.automation_development_office.ocp_virtualization	Build Virt VM specs (DataSource + Multus) and create the VirtualMachine with kubernetes.core.k8s when it is missing.
infra.automation_development_office.ocp_zabbix	Deploy Zabbix monitoring on OpenShift (dedicated PostgreSQL, Zabbix server, web UI, and Route).
infra.automation_development_office.ocp_wait_operator	Wait until an OLM Operator CSV reaches the installed/succeeded state.
infra.automation_development_office.ocp_wait_pods	Wait until pods in a namespace are running and ready.
infra.automation_development_office.rhbk_client	Manage Red Hat build of Keycloak (RHBK) clients.
infra.automation_development_office.rhbk_client_scope	Manage Red Hat build of Keycloak (RHBK) client scopes.
infra.automation_development_office.rhbk_groups	Manage Red Hat build of Keycloak (RHBK) groups.
infra.automation_development_office.rhbk_manage_federation	Manage Red Hat build of Keycloak (RHBK) user federation (for example LDAP).
infra.automation_development_office.rhbk_manage_idp	Configure and remove identity provider settings for Red Hat build of Keycloak.
infra.automation_development_office.rhbk_realm	Manage Red Hat build of Keycloak (RHBK) realms.
infra.automation_development_office.rhbk_setup_mapper	Manage LDAP group mapper components in Red Hat build of Keycloak.
infra.automation_development_office.rhbk_users	Manage Red Hat build of Keycloak users and user-group membership operations.
infra.automation_development_office.rhel_cron	Manage special cron schedule entries (@hourly, @daily, @weekly, @monthly, @yearly, @annually, @reboot).
infra.automation_development_office.rhel_ext_system_roles	Thin adapter/wrapper to call RHEL System Roles by short keys.
infra.automation_development_office.rhel_facts	Gather extended RHEL host facts (tuned, firewalld, memory, release, time).
infra.automation_development_office.rhel_mount	Mount filesystems (NFS, CIFS, local) with optional auto-detection of filesystem type.
infra.automation_development_office.rhel_patching	Comprehensive patching for Red Hat Enterprise Linux (RHEL) servers.
infra.automation_development_office.rhel_repos	Manage repository enable and disable operations on Red Hat Enterprise Linux systems.
infra.automation_development_office.rhel_sat_reg	Register or unregister RHEL hosts with Red Hat Satellite via subscription-manager.
infra.automation_development_office.rhel_stig_cac	Apply DISA STIG Compliance-as-Code on RHEL 8, 9, and 10 with OpenSCAP.
infra.automation_development_office.rhel_services_management	Manage RHEL system services with version-aware paths for RHEL 8/9/10.
infra.automation_development_office.satellite_config	Configure a Red Hat Satellite server after installation.
infra.automation_development_office.satellite_content_view	Manage Red Hat Satellite Content Views with create, publish, and promote actions.
infra.automation_development_office.satellite_install	Prepare and install a Red Hat Satellite host on supported RHEL systems.
infra.automation_development_office.satellite_oidc	Wire Satellite login to Keycloak / RHBK OIDC (client ado-satellite).
infra.automation_development_office.vm_image_management	Create a qcow2 virtual machine image from an existing base image.

Using this collection

ansible-galaxy collection install infra.automation_development_office

You can also include it in a requirements.yml file and install it via ansible-galaxy collection install -r requirements.yml using the format:

collections:
  - name: infra.automation_development_office

To upgrade the collection to the latest available version, run the following command:

ansible-galaxy collection install infra.automation_development_office --upgrade

You can also install a specific version of the collection, for example, if you need to downgrade when something is broken in the latest version (please report an issue in this repository). Use the following syntax where X.Y.Z can be any available version:

ansible-galaxy collection install infra.automation_development_office:==X.Y.Z

See Ansible Using Collections for more details.

Release notes

See the changelog.

Testing

Molecule scenarios

Collection integration scenarios live under extensions/molecule/ and are executed by the CI workflow.

Run scenarios locally before opening a PR.

From the collection root:

cd /path/to/your/git/checkout/infra.automation_development_office
ansible-galaxy collection install . --force --no-deps -p ~/.ansible/collections
ansible-galaxy collection install ansible.posix --force -p ~/.ansible/collections

Set collection path in your shell:

export ANSIBLE_COLLECTIONS_PATH="$HOME/.ansible/collections:/usr/share/ansible/collections"

For fish shell:

set -gx ANSIBLE_COLLECTIONS_PATH "$HOME/.ansible/collections:/usr/share/ansible/collections"

Run a scenario from extensions/:

cd /path/to/your/git/checkout/infra.automation_development_office/extensions
molecule test -s integration_rhel_cron_full_special

Some AWS scenarios call real AWS SDK APIs against fakecloud. CI starts fakecloud only for names listed in extensions/molecule/fakecloud_scenarios.txt. Local setup and the current list are in extensions/molecule/FAKECLOUD.md. Examples:

• integration_ec2_instance / integration_s3_bucket_policy — functional promote + import_playbook paths against fakecloud
• integration_bootstrap_ec2_instance / integration_bootstrap_s3_bucket_policy — preflight → generated bootstrap content (no fakecloud)

GitHub Actions manual runs

The Ansible Collection CI/CD workflow supports manual execution through workflow_dispatch.

• Each Molecule scenario is exposed as a boolean input in the Run workflow form.
• Run security_checks.py on collection roles runs scripts/security_checks.py and scripts/security_data_exposure_scan.py on roles/.
• Checked scenarios are included in the test matrix.
• Matrix jobs run in parallel.

Pull requests run Molecule for all scenarios under extensions/molecule/ except those listed in extensions/molecule/pr_exclude.txt (currently all ocp_* scenarios, which need a live OpenShift cluster).

To run OpenShift scenarios in CI, use Ansible Collection CI/CD → Run workflow and enable Run all ocp_ Molecule scenarios* (configure K8S_AUTH_HOST, K8S_AUTH_API_KEY, and K8S_AUTH_VERIFY_SSL as repository secrets first).

Pull requests also run the standalone Security Check workflow automatically. Results appear in the workflow job summary and the security-check-report artifact. This check is not enforced in the PR gate yet. You can also re-run it from the Security Check workflow page.

More information

• Ansible collection development forum
• Ansible User guide
• Ansible Developer guide
• Ansible Collections Checklist
• Ansible Community code of conduct
• The Bullhorn (the Ansible Contributor newsletter)
• News for Maintainers

Licensing

GNU General Public License v3.0 or later.

See LICENSE to see the full text.