Tower supports integration with Red Hat Insights. Once a host is registered with Insights, it will be continually scanned for vulnerabilities and known configuration conflicts. Each of the found problems may have an associated fix in the form of an Ansible playbook. Insights users create a maintenance plan to group the fixes and, ultimately, create a playbook to mitigate the problems. Tower tracks the maintenance plan playbooks via an Insights project in Tower. Authentication to Insights via Basic Auth, from Tower, is backed by a special Insights Credential, which must first be established in Tower. To ultimately run an Insights Maintenance Plan in Tower, you need an Insights project, an inventory, and a Scan Job template.
To create a new credential for use with Insights:
Enter a valid Insights credential in the Username and Password fields. The Insights credential is the user’s Red Hat Customer Portal account username and password.
To create a new Insights project:
All SCM/Project syncs occur automatically the first time you save a new project. However, if you want them to be updated to what is current in Insights, manually update the SCM-based project by clicking the button under the project’s available Actions.
This process syncs your Tower Insights project with your Insights account solution. Notice that the status dot beside the name of the project updates once the sync has run.
The Insights playbook contains a hosts: line where the value is the hostname that Insights itself knows about, which may be different than the hostname that Tower knows about. Therefore, make sure that the hostnames in the Tower inventory match up with the system in the Red Hat Insights Portal.
To create a new inventory for use with Insights:
Note
Typically, your inventory already contains Insights hosts. Tower just doesn’t know about them yet. The Insights credential allows Tower to get information from Insights about an Insights host. Tower identifying a host as an Insights host can occur without an Insights credential with the help of scan_facts.yml
file. For instructions, refer to the Create a Scan Job Template section.
In order for Tower to utilize Insights Maintenance Plans, it must have visibility to them. Create and run a scan job against the inventory using a stock manual scan playbook.
https://github.com/ansible/awx-facts-playbooks
. This is the location where the scan job template is stored.All SCM/Project syncs occur automatically the first time you save a new project. However, if you want them to be updated to what is current in Insights, manually update the SCM-based project by clicking the button under the project’s available Actions.
Syncing imports into Tower any Maintenance Plans in your Insights account that has a playbook solution. It will use the default Plan resolution. Notice that the status dot beside the name of the project updates once the sync has run.
Create a scan job template that uses the fact scan playbook:
scan_facts.yml
from the drop-down menu list. This is the playbook associated with the Scan project you previously set up.Once complete, the job results display in the Job Details page.
Remediation of an Insights inventory allows Tower to run Insights playbooks with a single click.
Notice the Insights tab is now shown on Hosts page. This indicates that Insights and Tower have reconciled the inventories and is now set up for one-click Insights playbook runs.
The screen below populates with a list of issues and whether or not the issues can be resolved with a playbook is shown.
Upon remediation, the New Job Template window opens. Notice the Inventory and Project fields are pre-populated.
Use this new job template to create a job template that pulls Maintenance Plans from Insights.
Once complete, the job results display in the Job Details page.