Ansible Private Hub & Controller

Introduction

Private Automation Hub is Red Hat's on-premise registry for Ansible collections and Execution Environments (EEs). Integrating it with Automation Controller gives your organization a single source of truth for curated, tested automation content — collections from Red Hat Certified, community, and your own custom content. This guide covers the complete integration: API tokens, credential configuration, collection sync, EE registry setup, and troubleshooting.

Architecture Overview

┌─────────────────────────┐         ┌──────────────────────────┐
│  Automation Controller  │         │  Private Automation Hub  │
│                         │  HTTPS  │                          │
│  • Job Templates        │◄───────►│  • Certified Collections │
│  • Projects             │  Token  │  • Custom Collections    │
│  • Inventories          │         │  • Execution Environments│
│  • Execution            │         │  • Container Registry    │
│    Environments         │         │                          │
└─────────────────────────┘         └──────────────────────────┘

Prerequisites

• Red Hat Ansible Automation Platform 2.4+ installed
• Private Automation Hub instance running and accessible
• Automation Controller instance running
• Network connectivity between Controller and Hub (HTTPS)
• Admin access to both systems

Step 1: Generate API Token from Private Automation Hub

1. Log in to your Private Automation Hub at https://ah.example.com
2. Navigate to Collections → API token management
3. Click Load token to generate a new token
4. Click Copy to clipboard
5. Store the token securely (you'll need it for credentials)

Token: abcdef1234567890abcdef1234567890abcdef12

Important: The token is shown only once. If lost, generate a new one.

Step 2: Create Credentials in Automation Controller

You need three credentials for full integration:

2a. Published Collections Credential

2b. Red Hat Certified Collections Credential

2c. Container Registry Credential (for EEs)

Step 3: Attach Credentials to Organization

1. Navigate to Organizations → Default (or your organization)
2. Click Edit
3. Under Galaxy Credentials, add both collection credentials:
   • Private Automation Hub — Published
   • Private Automation Hub — RH Certified
4. Order matters — place your preferred source first
5. Click Save

Credential Priority

The order of Galaxy Credentials determines which source is checked first:

1. Private Automation Hub — Published     ← Checked first
2. Private Automation Hub — RH Certified  ← Checked second
3. Ansible Galaxy                          ← Fallback (if configured)

Step 4: Configure Execution Environments

Add Hub Registry to Controller

1. Navigate to Administration → Execution Environments
2. Click Add
3. Configure:

Verify EE Pull

# Test from Controller command line
podman login ah.example.com
podman pull ah.example.com/custom-ee:latest

Step 5: Sync Collections to Hub

Before Controller can use collections, they must exist in Hub:

Sync Red Hat Certified Content

1. In Hub: Collections → Repositories → rh-certified
2. Click Sync to pull latest certified collections from Red Hat CDN

Upload Custom Collections

# Build your collection
ansible-galaxy collection build

# Upload to Hub
ansible-galaxy collection publish \
  my_namespace-my_collection-1.0.0.tar.gz \
  --server https://ah.example.com/api/galaxy/content/published/ \
  --token abcdef1234567890abcdef1234567890abcdef12

Approve Collections

1. In Hub: Collections → Approval
2. Review and approve uploaded collections
3. Approved collections appear in the published repository

Step 6: Verify Integration

Test Collection Resolution

1. Create a Project in Controller that uses a collections/requirements.yml:

# collections/requirements.yml
collections:
  - name: ansible.netcommon
    version: ">=5.0.0"
  - name: my_namespace.my_collection
    version: "1.0.0"

2. Sync the project — Controller should resolve collections from Hub

Test Job Execution

1. Create a Job Template using:
   • The project above
   • Your custom Execution Environment
2. Launch the job
3. Verify collections are loaded from Hub in the job output

Step 7: Optional — Disable SSL Verification

For lab environments with self-signed certificates:

1. In Controller: Settings → Jobs
2. Set Galaxy SSL Verify to false

Warning: Only for development/testing. Always use valid certificates in production.

Collection Sync Schedule

Automate collection sync in Hub:

1. Navigate to Collections → Repositories → rh-certified
2. Click Configure sync schedule
3. Set to sync daily or weekly

Schedule: Weekly, Sunday 02:00 UTC

Troubleshooting

"401 Unauthorized" on Collection Sync

• Token expired — generate a new one in Hub
• Wrong Galaxy Server URL — check the trailing path matches (/content/published/ vs /content/rh-certified/)

"Could not find collection" in Controller

• Collection not yet synced or approved in Hub
• Check Hub: Collections → Published to verify it's available
• Verify credential order in Organization settings

EE Pull Fails

Error: unable to retrieve auth token: 401 Unauthorized

• Check Container Registry credential username/password
• Verify the image exists in Hub: Execution Environments → Images
• Test manually: podman login ah.example.com

SSL Certificate Errors

SSL: CERTIFICATE_VERIFY_FAILED

• Add Hub's CA certificate to Controller's trust store:

cp hub-ca.crt /etc/pki/ca-trust/source/anchors/
update-ca-trust

Collection Version Conflicts

# Pin specific versions in requirements.yml
collections:
  - name: community.general
    version: "8.0.0"    # Exact version
  - name: ansible.netcommon
    version: ">=5.0.0,<6.0.0"  # Range

Best Practices

1. Use Hub as single source of truth — don't mix Galaxy and Hub for the same collections
2. Pin collection versions — avoid surprises from automatic updates
3. Approve before publishing — use Hub's approval workflow for quality control
4. Automate sync schedules — keep certified content up to date
5. Custom EEs over pip installs — build all Python dependencies into EEs
6. Separate credentials per repository — published vs rh-certified vs community
7. Monitor disk space on Hub — large collections and EE images add up
8. Back up Hub regularly — it contains your curated content

Related Articles

• Ansible Automation Platform Guide
• Ansible Collections Guide
• Ansible Execution Environments
• Containerized Ansible Automation Platform

Conclusion

Integrating Private Automation Hub with Automation Controller creates a secure, centralized automation supply chain — curated collections, approved content, and custom Execution Environments all served from your on-premise Hub. The key steps are: generate an API token, create three credentials (published collections, certified collections, container registry), attach them to your organization, and verify with a test job. Use collection approval workflows and sync schedules to keep content current and controlled.