AnsibleByExample

Ansible Intelligent Assistant Example: Configure OpenAI as the Backend

Beginner
2024-01-014By Luca Berton

Lesson 1 of 15 in Foundations

Ansible Foundations to Production — full curriculum
  1. 1. Introduction to Ansible and Automation
  2. 2. Installing and Configuring Ansible
  3. 3. Running Ad-Hoc Commands
  4. 4. Writing Your First Playbook
  5. 5. Understanding and Using Modules
  6. 6. Variables and Facts
  7. 7. Conditionals and Loops
  8. 8. Handlers and Idempotency
  9. 9. Structuring Projects with Roles
  10. 10. Inventory Management
  11. 11. Using Ansible Vault for Secrets
  12. 12. Debugging and Troubleshooting
  13. 13. Real-World Automation Examples
  14. 14. Final Project: Deploy a Web Server
  15. 15. Bonus - What's Next with Ansible?
View path overview →

The Intelligent Assistant is the chatbot embedded in the Ansible Automation Platform UI, and starting with AAP 2.6 it supports a BYOM (Bring Your Own Model) model, meaning you are not locked into Red Hat AI. OpenAI is one of the supported backends, alongside Azure OpenAI. Below is a minimal example of wiring an OpenAI credential into AAP so the Intelligent Assistant uses it.

# playbook: configure-intelligent-assistant-openai.yml
# Registers an OpenAI credential in AAP and points the
# Intelligent Assistant configuration at it.
---
- name: Configure Intelligent Assistant with OpenAI backend
  hosts: localhost
  gather_facts: false
  vars:
    aap_controller_host: "https://aap.example.com"
    aap_credential_name: "openai-intelligent-assistant"
    aap_organization: "Default"

  tasks:
    - name: Create OpenAI API credential in AAP
      ansible.controller.credential:
        name: "{{ aap_credential_name }}"
        organization: "{{ aap_organization }}"
        credential_type: "OpenAI API Token"
        controller_host: "{{ aap_controller_host }}"
        controller_username: "{{ aap_controller_username }}"
        controller_password: "{{ aap_controller_password }}"
        inputs:
          api_token: "{{ vault_openai_api_key }}"
          model: "gpt-4o"

    - name: Point Intelligent Assistant settings at the OpenAI credential
      ansible.controller.settings:
        controller_host: "{{ aap_controller_host }}"
        controller_username: "{{ aap_controller_username }}"
        controller_password: "{{ aap_controller_password }}"
        settings:
          INTELLIGENT_ASSISTANT_ENABLED: true
          INTELLIGENT_ASSISTANT_PROVIDER: "openai"
          INTELLIGENT_ASSISTANT_CREDENTIAL: "{{ aap_credential_name }}"

What it does and why

The first task creates a credential of type "OpenAI API Token" in AAP's credential store, holding the API key (pulled from an Ansible Vault–encrypted variable, vault_openai_api_key) and the model identifier. The second task updates the platform-wide Intelligent Assistant settings so the chatbot routes its requests through that credential instead of the default Red Hat AI backend. Once applied, users chatting with the Intelligent Assistant inside the AAP UI — asking it to explain a failed job, draft a playbook snippet, or summarize an inventory — have their requests forwarded to OpenAI's API using the configured model.

This BYOM pattern, presented at Red Hat Tech Day Netherlands 2026, is specific to the Intelligent Assistant. The separate Coding Assistant (the Ansible VS Code extension) has a different provider compatibility matrix: OpenAI support there is still listed as "Coming Soon," while IBM watsonx was actually the first external provider it supported, back in AAP 2.5. Don't assume parity between the two AI features just because they share an underlying BYOM concept.

Notes / Gotchas

  • AAP version requirement: OpenAI as an Intelligent Assistant backend requires AAP 2.6 or later. It is not available on 2.5.
  • Not all providers are supported everywhere: IBM watsonx is explicitly not supported for the Intelligent Assistant, and Google Gemini/Vertex is listed as "Coming Soon" for it — don't confuse this with the Coding Assistant matrix, where Gemini/Vertex is already supported from AAP 2.6.
  • Secrets hygiene: never hardcode vault_openai_api_key in plaintext — store it with ansible-vault encrypt_string or a proper secrets backend and reference it as shown.
  • Egress: the AAP controller nodes need outbound HTTPS access to OpenAI's API endpoints; check firewall/proxy rules before troubleshooting "assistant not responding" issues.
  • BYOK is separate from BYOM: Red Hat also announced BYOK ("Bring Your Own Knowledge," Tech Preview) at the same event, which lets you feed internal policies, naming conventions, and compliance runbooks (PCI-DSS, HIPAA, SOC2, etc.) into the Intelligent Assistant's RAG pipeline. Configuring an OpenAI backend does not automatically enable BYOK — it is a distinct, separately enabled preview feature.

Swapping the Intelligent Assistant's backend to OpenAI is a two-step credential-and-settings change, but keep the provider compatibility matrix handy since the Coding Assistant follows different rules entirely.

References

All Tutorials