Add AAP Starter Kit

content/patterns/aap-starter-kit/_index.adoc

@@ -0,0 +1,131 @@
+---
+title: AAP Starter Kit
+date: 2026-10-16
+tier: sandbox
+summary: Install Red Hat Ansible Automation Platform on OpenShift with Config as Code, including optional automation hub, Lightspeed, and Automation Orchestrator variants.
+rh_products:
+- Red Hat OpenShift Container Platform
+- Red Hat Ansible Automation Platform
+- Red Hat OpenShift Data Foundation
+- Red Hat OpenShift GitOps
+industries:
+- General
+focus_areas:
+- Automation
+- GitOps
+- DevSecOps
+aliases: /aap-starter-kit/
+pattern_logo: ansible-edge.png
+links:
+  github: https://github.com/validatedpatterns/aap-starter-kit/
+  install: getting-started
+  bugs: https://github.com/validatedpatterns/aap-starter-kit/issues
+  feedback: https://docs.google.com/forms/d/e/1FAIpQLScI76b6tD1WyPu2-d_9CCVDr3Fu5jYERthqLKJDUGwqBg7Vcg/viewform
+---
+
+:toc:
+:imagesdir: /images
+:_content-type: ASSEMBLY
+include::modules/comm-attributes.adoc[]
+
+== AAP Starter Kit
+
+This pattern installs and configures {rh-ansible} on {ocp} by using a Config as Code (CaC) and GitOps approach.
+It uses the same concepts (and charts) as the link:/patterns/ansible-edge-gitops/[Ansible Edge GitOps] pattern,
+focusing on Ansible Automation Platform (AAP) itself rather than edge virtualization workloads.
+
+The pattern deploys a single-cluster hub layout with {rh-gitops-short} (single Argo CD), HashiCorp Vault, the External Secrets Operator, an AAP instance, and AAP configuration loaded from a CaC repository.
+Install variants add automation hub (with {ocp-data-short} for RWX storage), Ansible Lightspeed, CloudNativePG, and Automation Orchestrator.
+
+You might fork the repository to customize chart overrides under `overrides/` or to select a non-default install variant.
+The link:/patterns/aap-starter-kit/getting-started/[Getting started] page describes variant selection, required secrets, and verification steps.
+
+[id="install-variants"]
+=== Install variants
+
+The pattern ships four install variants under `variants/` in the repository.
+Set `main.variant` in
+link:https://github.com/validatedpatterns/aap-starter-kit/blob/main/values-global.yaml[`values-global.yaml`]
+before install.
+The default is `minimal-aap`.
+
+[cols="1,1,3",options="header"]
+|===
+| Variant | `main.variant` | Purpose
+
+| `minimal-aap`
+| `minimal-aap` (default)
+| {ansible} 2.7 with controller and minimal CaC.
+Automation hub and Lightspeed are disabled.
+
+| `aap-with-hub`
+| `aap-with-hub`
+| `minimal-aap` plus {ocp-data-short} and automation hub (RWX storage required).
+
+| `aap-with-ao`
+| `aap-with-ao`
+| `minimal-aap` plus CloudNativePG (`vp-cloudnative-pg-cluster`) and Automation Orchestrator.
+
+| `complete-aap-ao`
+| `complete-aap-ao`
+| Automation hub, Lightspeed, and Automation Orchestrator (includes {ocp-data-short} and CloudNativePG).
+|===
+
+Variant values live under `variants/<name>/values-<name>.yaml`.
+The pattern enables `global.singleArgoCD: true` and `global.vpNewFolderDir: true`.
+Keep variant and cluster group names short so GitOps server DNS labels stay within 63 characters (the complete variant is named `complete-aap-ao` for that reason).
+
+[NOTE]
+====
+Automation hub variants need RWX storage from the Validated Patterns {ocp-data-short} chart.
+Automation Orchestrator variants install the CloudNativePG operator from `certified-operators`.
+Red Hat does not support CloudNativePG for Automation Orchestrator databases.
+Use an externally supported PostgreSQL 15 instance when a supported database is required for your environment.
+====
+
+See link:/patterns/aap-starter-kit/installation-details/#variant-installation-differences[Installation details] for what each variant deploys.
+For component schematics by variant, see link:/patterns/aap-starter-kit/architecture/[Architecture].
+
+=== Background
+
+Teams that adopt Ansible on OpenShift often need a repeatable starting point that installs the operator and instance, wires secrets through Vault and External Secrets, and loads controller configuration from Git.
+This pattern provides that baseline and offers install variants so you can add automation hub, Lightspeed, or Automation Orchestrator without rebuilding the pattern from scratch.
+
+==== Solution elements
+
+* Deploy {ansible} on {ocp} with GitOps
+* Load AAP configuration from a CaC repository
+* Optionally enable automation hub, Lightspeed, and Automation Orchestrator
+
+==== Red Hat technologies
+
+* {rh-ocp}
+* {rh-ansible}
+* {rh-gitops}
+* {rh-ocp-data-first} (hub and complete variants)
+
+==== Other technologies this pattern uses
+
+* HashiCorp Vault (Community Edition)
+* External Secrets Operator
+* CloudNativePG (Automation Orchestrator variants; not supported by Red Hat for AO databases)
+
+=== Architecture overview
+
+All variants run on a single OpenShift cluster (hub cluster group).
+The default `minimal-aap` variant deploys Vault, External Secrets, the AAP operator and instance (controller; hub and Lightspeed disabled), and the `aap-config` CaC application.
+
+.aap-architecture-diagram
+image::/images/aap-starter-kit/aap-architecture-minimal-aap.png[aap-starter-kit-architecture,title="AAP Starter Kit architecture (minimal-aap)"]
+
+draw.io source: link:/images/aap-starter-kit/aap-architecture-minimal-aap.drawio[`aap-architecture-minimal-aap.drawio`]
+
+Other variants add {ocp-data-short}, automation hub, Lightspeed, CloudNativePG, and Automation Orchestrator.
+See link:/patterns/aap-starter-kit/architecture/[Architecture] for per-variant schematics and draw.io sources.
+
+=== Next steps
+
+* link:/patterns/aap-starter-kit/architecture/[Architecture] — Component schematics and draw.io sources by variant
+* link:/patterns/aap-starter-kit/getting-started/[Getting started] — Prerequisites, variant selection, and deployment
+* link:/patterns/aap-starter-kit/installation-details/[Installation details] — Install sequence and expected installations
+* link:/patterns/aap-starter-kit/cluster-sizing/[Cluster sizing] — Resource requirements

content/patterns/aap-starter-kit/architecture.adoc

@@ -0,0 +1,239 @@
+---
+title: Architecture
+weight: 5
+aliases: /aap-starter-kit/architecture/
+---
+
+:toc:
+:imagesdir: /images
+:_content-type: ASSEMBLY
+include::modules/comm-attributes.adoc[]
+
+[id="aap-starter-kit-architecture"]
+= Architecture
+
+This page describes component schematics for each install variant.
+For what each variant installs on the cluster and which overrides apply, see link:/patterns/aap-starter-kit/installation-details/[Installation details].
+
+[id="architecture-common"]
+== Common components
+
+Every variant deploys these components on the single hub cluster:
+
+[cols="2,3",options="header"]
+|===
+| Component | Role
+
+| Validated Patterns Operator and {rh-gitops-short}
+| Installs and syncs the pattern through a single Argo CD instance (`global.singleArgoCD: true`)
+
+| HashiCorp Vault
+| Stores secrets loaded from your secrets file
+
+| External Secrets Operator
+| Projects Vault secrets into Kubernetes Secrets for AAP and related charts
+
+| ansible-automation-platform-operator
+| Operator channel `stable-2.7` in the `ansible-automation-platform` namespace
+
+| ansible-automation-platform-instance chart
+| Deploys the AAP instance; release and feature flags come from per-variant overrides
+
+| aap-config chart
+| Loads CaC from the configured repository (default: `agof_null_config`)
+|===
+
+Related charts:
+
+* link:https://github.com/validatedpatterns/aap-instance-chart[ansible-automation-platform-instance]
+* link:https://github.com/validatedpatterns/openshift-data-foundations-chart[openshift-data-foundations]
+* link:https://github.com/validatedpatterns/vp-cloudnative-pg-cluster-chart[vp-cloudnative-pg-cluster]
+* link:https://github.com/validatedpatterns/automation-orchestrator-instance-chart[automation-orchestrator-instance]
+
+[id="architecture-diagrams"]
+== Architecture diagrams
+
+Each install variant has a hub-cluster schematic as PNG with matching draw.io source.
+PNG and draw.io files live in `static/images/aap-starter-kit/`.
+
+[cols="2,1,2,2",options="header"]
+|===
+| Diagram | Variant | PNG | draw.io source
+
+| `aap-architecture-minimal-aap`
+| `minimal-aap`
+| link:/images/aap-starter-kit/aap-architecture-minimal-aap.png[`aap-architecture-minimal-aap.png`]
+| link:/images/aap-starter-kit/aap-architecture-minimal-aap.drawio[`aap-architecture-minimal-aap.drawio`]
+
+| `aap-architecture-aap-with-hub`
+| `aap-with-hub`
+| link:/images/aap-starter-kit/aap-architecture-aap-with-hub.png[`aap-architecture-aap-with-hub.png`]
+| link:/images/aap-starter-kit/aap-architecture-aap-with-hub.drawio[`aap-architecture-aap-with-hub.drawio`]
+
+| `aap-architecture-aap-with-ao`
+| `aap-with-ao`
+| link:/images/aap-starter-kit/aap-architecture-aap-with-ao.png[`aap-architecture-aap-with-ao.png`]
+| link:/images/aap-starter-kit/aap-architecture-aap-with-ao.drawio[`aap-architecture-aap-with-ao.drawio`]
+
+| `aap-architecture-complete-aap-ao`
+| `complete-aap-ao`
+| link:/images/aap-starter-kit/aap-architecture-complete-aap-ao.png[`aap-architecture-complete-aap-ao.png`]
+| link:/images/aap-starter-kit/aap-architecture-complete-aap-ao.drawio[`aap-architecture-complete-aap-ao.drawio`]
+|===
+
+[id="architecture-minimal-aap"]
+=== `minimal-aap` schematic
+
+Default variant.
+Deploys AAP 2.7 with controller and minimal CaC.
+Automation hub and Lightspeed are disabled through
+link:https://github.com/validatedpatterns/aap-starter-kit/blob/main/overrides/values-aap-instance-minimal.yaml[`overrides/values-aap-instance-minimal.yaml`].
+
+.aap-architecture-minimal-aap
+image::/images/aap-starter-kit/aap-architecture-minimal-aap.png[AAP Starter Kit architecture for the minimal-aap variant,title="AAP Starter Kit architecture (minimal-aap)"]
+
+draw.io source: link:/images/aap-starter-kit/aap-architecture-minimal-aap.drawio[`aap-architecture-minimal-aap.drawio`]
+
+[cols="2,3",options="header"]
+|===
+| Layer | What runs
+
+| Storage
+| Cluster default storage classes only (no {ocp-data-short} chart)
+
+| AAP features
+| Controller; automation hub off; Lightspeed off
+
+| Orchestration
+| None
+|===
+
+[id="architecture-aap-with-hub"]
+=== `aap-with-hub` schematic
+
+Adds {ocp-data-short} for RWX storage and enables automation hub.
+Lightspeed remains disabled.
+Instance flags come from
+link:https://github.com/validatedpatterns/aap-starter-kit/blob/main/overrides/values-aap-instance-with-hub.yaml[`overrides/values-aap-instance-with-hub.yaml`].
+ODF object storage is disabled in
+link:https://github.com/validatedpatterns/aap-starter-kit/blob/main/overrides/values-odf-chart.yaml[`overrides/values-odf-chart.yaml`].
+
+.aap-architecture-aap-with-hub
+image::/images/aap-starter-kit/aap-architecture-aap-with-hub.png[AAP Starter Kit architecture for the aap-with-hub variant,title="AAP Starter Kit architecture (aap-with-hub)"]
+
+draw.io source: link:/images/aap-starter-kit/aap-architecture-aap-with-hub.drawio[`aap-architecture-aap-with-hub.drawio`]
+
+[cols="2,3",options="header"]
+|===
+| Layer | What runs
+
+| Storage
+| {ocp-data-short} StorageSystem (inventory; object storage disabled)
+
+| AAP features
+| Controller and automation hub; Lightspeed off
+
+| Orchestration
+| None
+|===
+
+[id="architecture-aap-with-ao"]
+=== `aap-with-ao` schematic
+
+Adds CloudNativePG and Automation Orchestrator on top of the minimal AAP instance (hub and Lightspeed still disabled).
+PostgreSQL 15 for Orchestrator and Temporal databases is provided by the `vp-cloudnative-pg-cluster` chart with overrides in
+link:https://github.com/validatedpatterns/aap-starter-kit/blob/main/overrides/values-vp-cloudnative-pg-ao.yaml[`overrides/values-vp-cloudnative-pg-ao.yaml`].
+
+.aap-architecture-aap-with-ao
+image::/images/aap-starter-kit/aap-architecture-aap-with-ao.png[AAP Starter Kit architecture for the aap-with-ao variant,title="AAP Starter Kit architecture (aap-with-ao)"]
+
+draw.io source: link:/images/aap-starter-kit/aap-architecture-aap-with-ao.drawio[`aap-architecture-aap-with-ao.drawio`]
+
+[cols="2,3",options="header"]
+|===
+| Layer | What runs
+
+| Storage
+| Cluster default storage for CNPG volumes (no {ocp-data-short})
+
+| AAP features
+| Controller; automation hub off; Lightspeed off
+
+| Database
+| CloudNativePG PostgreSQL 15 (`orchestrator`, `temporal`, `temporal_visibility`)
+
+| Orchestration
+| Automation Orchestrator operator and instance chart
+|===
+
+[WARNING]
+====
+Red Hat does not support CloudNativePG for Automation Orchestrator databases.
+Prefer an externally supported PostgreSQL 15 instance when a supported database is required.
+====
+
+[id="architecture-complete-aap-ao"]
+=== `complete-aap-ao` schematic
+
+Full stack: automation hub, Lightspeed, {ocp-data-short}, CloudNativePG, and Automation Orchestrator.
+Instance flags come from
+link:https://github.com/validatedpatterns/aap-starter-kit/blob/main/overrides/values-aap-instance-complete.yaml[`overrides/values-aap-instance-complete.yaml`].
+
+.aap-architecture-complete-aap-ao
+image::/images/aap-starter-kit/aap-architecture-complete-aap-ao.png[AAP Starter Kit architecture for the complete-aap-ao variant,title="AAP Starter Kit architecture (complete-aap-ao)"]
+
+draw.io source: link:/images/aap-starter-kit/aap-architecture-complete-aap-ao.drawio[`aap-architecture-complete-aap-ao.drawio`]
+
+[cols="2,3",options="header"]
+|===
+| Layer | What runs
+
+| Storage
+| {ocp-data-short} StorageSystem (RWX for automation hub)
+
+| AAP features
+| Controller, automation hub, and Lightspeed
+
+| Database
+| CloudNativePG PostgreSQL 15 for Automation Orchestrator
+
+| Orchestration
+| Automation Orchestrator operator and instance chart
+|===
+
+[id="architecture-secrets-and-ca"]
+== Secrets and credentials
+
+Certificate and secret handling uses Vault and External Secrets rather than local policy YAML in the pattern repository.
+
+[cols="2,3",options="header"]
+|===
+| Secret / policy | Used by
+
+| `aap-manifest`
+| AAP entitlement (all variants)
+
+| `automation-hub-token`
+| Certified and validated content retrieval
+
+| `agof-vault-file`
+| Optional CaC secret overlay for `aap-config`
+
+| `orchestrator-postgres-secret`, `temporal-postgres-secret`, `temporal-visibility-postgres-secret`
+| `aap-with-ao` and `complete-aap-ao` (CNPG / AO)
+
+| `postgresPasswordPolicy`
+| Alphanumeric generated passwords so URL-encoded characters do not break AO Alembic or configparser
+|===
+
+Helper scripts in the pattern repository:
+
+* `scripts/ansible_get_credentials.sh` — retrieves AAP admin credentials
+* `scripts/ao_get_credentials.sh` — retrieves Automation Orchestrator admin credentials
+
+[id="related-pages"]
+== Related pages
+
+* link:/patterns/aap-starter-kit/installation-details/[Installation details] — Variant installation differences and install sequence
+* link:/patterns/aap-starter-kit/getting-started/[Getting started] — Variant selection, secrets, and deployment
+* link:/patterns/aap-starter-kit/[AAP Starter Kit overview] — Install variants summary