Latest release V2.1.0

Minor Changes

• ado-preflight-ui - OpenShift GitLab form shows Root password field (default redhat123) like Grafana/Quay admin password.
• bootstrap - Wire EC2 instance create/delete/modify/info under the aws
  component (ec2_instance). Seed playbooks import collection FQCNs
  infra.ado.aws.ec2.ado_ec2_instance_*, share vault_aws.yml, and
  generate Contoller job templates. Collection playbook files use
  underscores so FQCNs are addressable (dashes are invalid in collection
  playbook names).
• bootstrap - Wire S3 bucket policy set / set-from-file / info under the
  aws component (s3_bucket_policy). Seed playbooks import collection
  FQCNs infra.ado.aws.s3.ado_s3_bucket_policy_*, share vault_aws.yml,
  seed a Jinja sample policy (policies/allow_list_and_read.json), and
  generate Contoller job templates.
• bootstrap_controller - When the operator explicitly selects both MinIO and Quay, run Quay after MinIO so the bucket and API exist before Quay starts.
• bootstrap_controller - ADO | RHEL Patch Host now prompts for inventory, credential, and limit on launch (same as Register Host to Satellite).
• bootstrap_generate_env_vars - Added openshift_networking to preflight UI OpenShift apps and component vars template.
• bootstrap_generate_env_vars - Honor preflight component_options.quay minio by setting Quay object-storage vars and copying existing MinIO credentials. The option does not add the MinIO component.
• bootstrap_generate_env_vars - OpenShift apps domain and route hostnames still autofill from the base domain, but a typed override is kept via apps_domain_manual / hostname_manual instead of being overwritten.
• bootstrap_generate_env_vars - Optional additional_environments_create_group_vars copies the generated group_vars/all/<environment> tree into each other selected additional environment. Job template survey choices stay the same when the flag is off.
• bootstrap_generate_env_vars - Overlay GitLab and Zabbix database_provision / Postgres storage fields from preflight JSON.
• bootstrap_generate_env_vars - Quay MinIO object-storage vars inherit component_config.minio when the Quay S3 fields are empty.
• bootstrap_generate_env_vars - Treat component_apps.satellite as a first-class target-platform group so Satellite-only preflight JSON expands the same way as OpenShift, RHEL, and Patching.
• bootstrap_resolve_component - Added component defaults for openshift_networking, kubernetes_nmstate, and metallb.
• grafana - OpenShift Keycloak dashboard now includes a Successful logins by username table next to the existing Failed logins table.
• grafana_manage_folders - Default Grafana folders are Applications, Security, and Infrastucture. Each dashboards path defaults to dashboards/<folder name> and stays editable. Alert paths are no longer part of those folder rows. The shipped OpenShift dashboards upload into Infrastucture and the RHACS dashboard into Security when grafana_include_builtin_dashboards is true. Extra dashboard sources use one of those folder names. Alert upload starts from a separate Alerts folder at alerts/Alerts. When Keycloak is selected and populated, the Grafana OIDC issuer URL is filled from the Keycloak hostname and realm. Pre-canned dashboards can be chosen one by one. The copied files are the lab dashboards under dashboards/<folder name>. builtin_dashboards limits which of those files upload. Default OpenShift alert rules ship in alerts/Alerts for node readiness, node CPU, CrashLoopBackOff, a namespace whose Service has no endpoints, node or pod memory, and network drops or errors.
• grafana_upload_alerts - Keep a paused per-node rule for a kubelet that stops reporting, so it no longer disappears inside the NotReady count. The rule stays paused until it is turned on.
• grafana_upload_alerts - Upload each OpenShift alert rule to every selected Prometheus datasource and route ado=openshift-default alerts to an optional email contact point.
• grafana_upload_dashboards - Add pod and container filesystem and PVC usage to the Openshift Pod/Namespace Health dashboard. Container filesystem usage is red from 1 GiB. The PVC table lists every claim by requested size. Fill percent is red from 80 and is omitted when the kubelet reports the shared NFS export instead of the claim.
• grafana_upload_dashboards - Rename seeded OpenShift dashboard titles so the Grafana folder list describes what each board shows (health, capacity, API, certs, Keycloak) instead of leftover community names.
• grafana_upload_dashboards - Renamed the API server dashboard to Openshift API Server and removed the unused terraform and oncall annotation toggles.
• grafana_upload_dashboards - Renamed the cluster detail dashboard to Openshift Node Workloads.
• grafana_upload_dashboards - Renamed the etcd dashboard to Openshift etcd and replaced the empty cluster dropdown with a node selector.
• grafana_upload_dashboards - Renamed the node capacity dashboard to Openshift Node and Cluster Health, show Ready, NotReady, or Unknown for every node, add a cluster summary across the top, and add per-node storage and network charts. The node table uses readable headers, drops the extra label columns, highlights a node that is not Ready, and colors filesystem, memory, and CPU percent. A node name opens Openshift Node and Cluster Drilldown Health for that node. The storage and network section includes current bandwidth and packet drops for the selected node. Cluster operators, API, etcd, ingress, kubelet latency, and firing alerts are on this dashboard too. The pod memory table uses short column names and wider headers so Node, Namespace, Container, Pod, CPU, and memory fit. Memory request and limit show on each pod container, and the percent stays blank when there is no limit. The container-name rollup was the same numbers summed together, so it is removed. Container runtime latency uses the current CRI-O summary metric. Pod restart counts are the total since the container started, shown as a whole number. The namespace dropdown can be typed to search, and the pod table has one row per container. Upstream Update and GitHub links are removed, and translated panel titles use American English. The pod table drops the Namespace column, leads with Pod, and puts every metric for a container on one row. Column titles are Pod, Container, Node, CPU percent, CPU used, CPU request, CPU limit, Memory percent, Memory used, RSS percent, RSS, Memory request, Memory limit, Disk, and Restarts. Filter the Pod header to search. The Cluster dropdown lists datasource names from grafana_datasource and grafana_datasources instead of assuming Openshift-Prod and Openshift-Dev. Leave both empty to list every Prometheus datasource.
• grafana_upload_dashboards - Renamed the node pod dashboard to Openshift Pod/Namespace Health, added namespace and pod search, and linked each node pod count to the pods on that node. Namespace and pod search no longer blank the charts, and the cluster dropdown is gone. Namespace pod headlines now live on that same dashboard.
• grafana_upload_dashboards - Renamed the projects dashboard to Openshift Project Quota and made the namespace list searchable.
• infra.ado.gitlab_install - Provision Grafana-style dedicated RHEL PostgreSQL 15 for OpenShift GitLab (reuse gitlab-db-secret, leave an existing alpine StatefulSet in place).
• infra.ado.ocp_aap_hub_harden - Can create dedicated Hub Postgres, migrate automationhub off shared Controller PG, then pin workers and the aap-hub-stability CronJob. Discovers AAP/Hub CR names when unset. Preflight AAP tools option dedicated_hub_postgres generates the playbook and Controller job template without selecting OpenShift.
• infra.ado.ocp_zabbix - Default new OpenShift Zabbix installs to dedicated PostgreSQL; keep MariaDB when that stack already exists or zabbix_database_type=mysql.
• install_aap - Leave OpenShift AAP install unlicensed by default (aap_ocp_install_license_mode: none). Attach a manifest or RHN subscription later with aap_ocp_install_license_only or the AAP wizard.
• install_aap - Standalone RHEL install can override the bundle directory, use a local tarball, SSH to the VM with a user and password or private key, and pass gateway_tls_cert / gateway_tls_key paths into the installer inventory.
• install_aap / preflight - Install AAP can target OpenShift (operator + platform CR) or standalone RHEL (aap_setup_*). OpenShift still requires the AAP operator PackageManifest in the cluster catalog.
• keycloak_login_events_exporter - New role deploys a Prometheus exporter that polls the Keycloak/RHBK user-event store for LOGIN and LOGIN_ERROR and publishes gauges with username labels. Native keycloak_user_events_total does not include username. Bootstrap ships the playbook, Controller job template, and RHBK workflow node.
• molecule - Add integration_ec2_instance fakecloud scenario that runs
  create/info/modify/delete through the bootstrap promote +
  import_playbook path (same entry Contoller uses after seed generation).
• molecule - Add integration_s3_bucket_policy fakecloud scenario that
  runs set / set-from-file / info through the bootstrap promote +
  import_playbook path, plus integration_bootstrap_s3_bucket_policy
  for preflight → generated content.
• ocp_acm - Before MultiClusterHub converge, detect leftover ACM hub state (stuck uninstall, stale validating webhooks), print a clear ADO prep message, and clean up so ACM hub resources and later OpenShift app installs are not poisoned. Optional ocp_acm_observability_reset_mco deletes prior MultiClusterObservability.
• ocp_devspaces - Added exporter-only playbook playbooks/devspaces/ado-devspaces-status-exporter.yml and status_exporter tag so a script refresh does not rerun the full Dev Spaces install.
• ocp_disconnected_install - V...

First official release to Red Hat Validated namespace

Minor Changes

• ado-preflight-ui - Admin HTPasswd form includes Login button name (IdP) wired through bootstrap vars and Contoller JT survey.
• ado-preflight-ui - Move Credentials and Git under AAP Configuration tabs; RHBK OpenShift form adds TLS mode (edge / cert-manager / own cert upload).
• bootstrap_controller - Add ADO | Satellite Capsule Install job template wired to infra.ado.capsule_install.
• bootstrap_controller - Include selected Pega playbooks and job templates in generated bootstrap output.
• bootstrap_controller - Nest cert-manager under ADO | Cert Manager Workflow (deploy, optional IdM ACME / AWS PCA, optional default ingress), referenced from ADO | OpenShift Workflow like RHBK and Grafana.
• bootstrap_generate_env_vars - Map Pega disconnected inputs and remove obsolete lab-specific generated defaults.
• bootstrap_generate_env_vars - Map delivery and policy inputs.
• bootstrap_generate_env_vars - Write capsule_install_* variables into vars_satellite.yml / vault_satellite.yml and seed a dedicated Capsule AAP inventory.
• bootstrap_generate_playbook_repo - Generate GitOps and policy files.
• bootstrap_generate_playbook_repo - Generate playbooks/satellite/ado-install-capsule-bootstrap.yml for the satellite_capsule_install app.
• bootstrap_generate_playbook_repo - Generate a local component execution plan and CLI runner from selected playbooks and existing workflow ordering. Validate selections and required survey inputs, preview commands, and stop execution on the first failed playbook without requiring Controller.
• bootstrap_generate_playbook_repo - Local no-AAP component runner accepts per-playbook step_options (typed vars, optional state, and freeform extra_args) so Preview/Run can override Common extra vars for a single step.
• bootstrap_generate_playbook_repo - Local no-AAP component runner no longer re-prompts Contoller survey fields; generated group_vars from the form are the source of truth.
• bootstrap_generate_playbook_repo - Replace the Pega failure placeholder with the ocp_pega role.
• bootstrap_resolve_component - Prefer RHBK operator channel stable-v26.2 so login-event metrics are available after upgrade.
• capsule_install - Added HAProxy template and integration_capsule_install Molecule scenario.
• capsule_install - Added firewall, DNS, and custom Capsule certificate generation tasks after package installation.
• capsule_install - Added package installation after storage configuration when satellite-capsule is not already installed.
• capsule_install - Ensure firewalld is installed before enabling the RH-Satellite-6-capsule service and opening load-balancer ports.
• capsule_install - Install packages from capsule_install_packages instead of satellite_install_packages.
• capsule_install - Renamed OAuth consumer facts to capsule_install_foreman_proxy_oauth_consumer_key and capsule_install_foreman_proxy_oauth_consumer_secret.
• capsule_install - Renamed numbered task files to install_capsule, post_config, sync_capsule, and haproxy; wired full install flow in main.yml.
• capsule_install - Skip load-balancer firewall delegation when capsule_install_loadbalancer_fqdn is unset so non-HAProxy runs do not fail firewall configuration.
• cert_manager - Preflight issuer selection uses clearable options (IdM ACME, AWS PCA, Custom); unchecking all keeps operator-only deploy (mode=cert). Contoller workflow follows cert-manager plus optional issuer and/or Default Ingress Cert.
• ci - Add the Red Hat partner certification checker workflow and Dependabot updates for GitHub Actions.
• galaxy.yml - Add the infrastructure tag required by Automation Hub import checks.
• grafana - Added standalone content playbooks under playbooks/grafana/ (datasources, folders, dashboards, alerts, combined) for manual Contoller JT wiring without bootstrap install.
• grafana - Keycloak metrics dashboard adds login success/fail panels and failed-login table/rate by Keycloak error (bad password / unknown user).
• grafana_install - Add optional PostgreSQL backend for new OpenShift Grafana installs (grafana_database_type: sqlite|postgres). When postgres and grafana_database_provision=true (default), create Secret/PVC/Deployment/Service grafana-postgres and configure the Grafana CR database section. External Postgres is supported with grafana_database_provision=false plus host/user/ password. SQLite remains the default; SQLite→Postgres data migration is not automatic (separate follow-up workflow).
• grafana_install - Gate operator/CR install on grafana_install_scope=install so OIDC/email configure JTs no longer re-apply the full install path.
• grafana_upload_dashboards - Allow recurse: false on folder sources.
• install_rhbk - Add event_metrics_user_enabled / install_rhbk_event_metrics_user_enabled (default false until RHBK 26.2+) plus ServiceMonitor for management /metrics.
• ocp_absent_cleanup - New role: safe OpenShift absent cleanup gate for Terminating namespaces, stuck finalizers, leftover CSVs/InstallPlans, and Deployments/pods (explicit namespace allowlist; refuses kube-* / platform NS).
• ocp_acm - Optional Multicluster Observability (ocp_acm_observability_enabled) creates the observability namespace, thanos-object-storage secret, and MultiClusterObservability CR so Fleet Virtualization Overview can show metrics. Requires S3-compatible object storage (MinIO supported). Preflight ACM tab checkbox + S3 fields.
• ocp_acm_policy - Generate namespace-label policies with explicit placement.
• ocp_devspaces - Default ocp_devspaces_status_exporter_enabled / preflight status_exporter_enabled to true so Grafana Dev Spaces dashboards get phase and VS Code extension metrics out of the box.
• ocp_devspaces - Optional DevWorkspace status metrics exporter (status_exporter_enabled) for Grafana; portable dw_* labels in the Dev Spaces operator namespace.
• ocp_devspaces - Share CheCluster rendering for direct and GitOps generation.
• ocp_devspaces - Status exporter can scrape VS Code extensions from Running workspace pods (devworkspace_vscode_extension metric; needs pods/exec RBAC).
• ocp_devspaces / preflight - Add custom getting-started sample fields (display name, git/devfile URL, bundled ADO icon or upload) so Dev Spaces can replace stock samples with an ADO-branded card.
• ocp_gitops_application - Generate Applications and resource bundles.
• ocp_htpasswd_admin / bootstrap_generate_env_vars - Preflight openshift.htpasswd_idp_name sets the OpenShift console login button (OAuth IdP name); secret defaults to <idp>-secret.
• ocp_image_registry - Add optional OpenShift integrated image registry enablement with merge-only Config patch, operational PASS/FAIL reporting, Contoller JT/workflow wiring, bootstrap prep, and preflight option integrated_image_registry.
• ocp_mtv - New role plus bootstrap playbook / Contoller JT / OpenShift workflow node for Migration Toolkit for Virtualization (mtv-operator + ForkliftController). Preflight OpenShift app mtv.
• ocp_namespace - state=absent now runs ocp_absent_cleanup before and after delete so every OpenShift namespace uninstall gets the same stuck-cleanup behavior.
• ocp_nfs_storage - Bundle csi-driver-nfs Helm chart files/charts/csi-driver-nfs-4.11.0.tgz (~12 KiB) and install from that path by default so bootstrap / Contoller runs do not need GitHub helm repo add. Set ocp_nfs_storage_use_bundled_chart=false to use the upstream charts URL, or ocp_nfs_storage_chart_path for a custom archive. Container images referenced by the chart are unchanged.
• ocp_operator_subscription - state=absent runs ocp_absent_cleanup with CSV name match (workloads off by default for shared namespaces).
• ocp_pega - Add local-chart Helm deployment with offline image validation and optional OpenSearch and Backing Services.
• ocp_virtualization_install - Honor ocp_virtualization_install_enable_kube_secondary_dns by setting HyperConverged featureGates.deployKubeSecondaryDNS when creating the CR.
• preflight - RHBK checkbox for user-event metrics (enable after upgrading off stable-v26.0).

Bugfixes

• acm playbook - Stop passing a self-referential operatorgroup: "{{ operatorgroup | default(...) }}" into ocp_operatorgroups. That recursion aborts absent after hub cleanup already succeeded; use the value from bootstrap_resolve_component.
• acm playbook - Uninstall MultiClusterHub/subscription before OperatorGroup and namespace so hub controllers cannot recreate the OG mid-absent run.
• ado-preflight-ui - Typing Additional ansible-playbook options no longer swaps the playbook preview pane back to the bootstrap scaffolding command; click Preview commands to refresh.
• bookstack_openshift - OIDC-only scope reads existing bookstack-app Secret for APP_KEY before redeploy (fixes undefined bookstack_openshift_app_key_effective).
• bookstack_openshift - Remove invalid validate_certs from kubernetes.core.k8s* OIDC tasks (conflicting action statements).
• bootstrap_controller - Add missing Alt Routes Workflow nested node so OpenShift workflow success edges to alternate routes resolve when that sub-workflow is generated.
• bootstrap_controller - Hub Pulp URI auth no longer sets headers to omit under basic-auth (empty OAuth/Hub token), which left bootstrap_controller_hub_uri_headers undefined and crashed collection publish on hub-only / standalone runs.
• bootstrap_controller - Hub publish finds prebuilt infra-ado-*.tar.gz under /opt/ado-collections as well as /workspace, so force updates stage the exact preflight tarball instead of silently rebuilding from ado-source.
• bootstrap_controller - Hub-only collection/EE publish no longer skipped after a prior license-attach left aap_ocp_install_license_only...

Releasing the latest version 1.4.0

Minor Changes

• Preflight bootstrap (ado-preflight-ui) — Replace the single git overwrite checkbox with a Git overrides section: optional group_vars/all/<env>, job/workflow templates, or full re-clone wipe. Default (all unchecked) keeps the pod clone and only commits incremental bootstrap changes.
• ado-preflight-ui - Hub Collections multi-select for additional playbook collections; Galaxy credentials shown as tabs.
• ado-preflight-ui / bootstrap_controller - Restored Hub checkbox Install additional collections that are requirements for playbooks (aap.hub_publish_preflight_collections). Publishes baked preflight tarballs other than infra.ado into Hub validated content (kubernetes.core, redhat.openshift, community.general, community.grafana, grafana.grafana, ansible.controller, awx.awx, infra.controller_configuration, infra.aap_configuration, ansible.platform, ansible.hub, and containers.podman when present).
• bootstrap_generate_env_vars / bootstrap_generate_playbook_repo - ansible_dispatch_ignore_galaxy_cert defaults to false; preflight Galaxy tab checkbox opts in to GALAXY_IGNORE_CERTS and [galaxy] ignore_certs for lab self-signed Hub TLS.
• bootstrap_generate_playbook_repo - Add amazon.aws to Hub preflight publish catalog (infra.ado declares it in galaxy.yml; Contoller sync fails without it on Hub).
• bootstrap_generate_playbook_repo - Add ansible.posix, community.hashi_vault, and freeipa.ansible_freeipa to Hub publish manifest (preflight tarball + Contoller requirements when selected).
• bootstrap_generate_playbook_repo - Expand Hub preflight publish catalog with RH certified (redhat.satellite, redhat.rhel_idm, redhat.rhel_system_roles) and runtime deps (infra.aap_utilities, infra.rhacs_configuration, ansible.utils, community.kubernetes) so Private Hub can be seeded when remotes are empty.
• galaxy.yml - Declare public Galaxy runtime collection dependencies (kubernetes.core, community.general, and others) with PEP 440 version ranges; document Automation Hub-only collections (including ansible.controller and hashicorp.vault) excluded from dependencies per Red Hat collection publishing practice.
• install_rhbk - Standalone RHBK zip may come from HTTP/Satellite URL, git repo (cloned on the Keycloak host), or bootstrap files/ upload; unpack always runs on the host.

Bugfixes

• Accept HTTP 401 or 403 from the unauthenticated Automation Hub published-API probe in verify-automation-hub.sh. Red Hat Hub normally returns 401 without a token (auth required); 403 is tolerated because upstream proxies or API gateways sometimes classify missing credentials as Forbidden instead of Unauthorized. Either status still confirms the URL is reachable and not anonymously open, while 200 would indicate a misconfiguration and 5xx still fails the check. Galaxy remains 200-only; authenticated ansible.platform install remains the definitive Hub token test.
• Add ansible-galaxy install retries and a shared Molecule collections cache job to reduce Galaxy 504/resolver flakes in CI (matrix runs fully parallel; cache replaces throttling via max-parallel).
• Fix bindep platform profiles and always install libsystemd-dev and libkrb5-dev before ade pip requirements (avoids empty bindep match skipping the apt fallback; gssapi from ansible.eda needs krb5-config).
• Forward Automation Hub Galaxy server env vars through tox-ansible so sanity and unit jobs resolve certified collection dependencies from console.redhat.com.
• Install native build dependencies before tox ade install so sanity and unit jobs can resolve Hub collection Python requirements such as systemd-python.
• Preflight bootstrap (ado-preflight-ui) — Superseded by git.overrides (see git-overrides-preflight fragment). Incremental mode reuses the pod clone, preserves existing files unless a Git override scope is selected, and passes generate_env_vars_force=false by default.
• Remove unused variable from verify-automation-hub.sh so ansible-test shellcheck sanity passes.
• Retry ade install up to three times in tox commands_pre to absorb transient Galaxy dependency resolution failures under parallel CI matrix load.
• Use POSIX sh for ansible-galaxy-with-retry.sh so the ansible-lint container job can run collection install (Alpine image has no bash).
• ado-preflight-ui - Git Configuration collects Bitbucket username and validates it before bootstrap when Controller apply is enabled.
• bootstrap_controller - After ansible.hub staging upload succeeds, Pulp URI calls now use Authorization: Token with the same Hub/OAuth token that authenticated ah_namespace/ah_collection (or admin basic). Bearer Contoller OAuth was ignored on some gateways (Authentication credentials were not provided) when resolving pulp hrefs after upload.
• bootstrap_controller - Always force a Controller project sync during full bootstrap so preflight picks up git changes; only treat sync as fatal when the project had no prior successful update and git revision did not advance.
• bootstrap_controller - Empty Hub preflight collection name list publishes none (not every candidate).
• bootstrap_controller - Fix NameError: name 'false' is not defined when generating job templates. The force-overwrite flag is now emitted as Python True/False instead of JSON true/false.
• bootstrap_controller - Fix project sync failure collection when loop results omit the skipped attribute.
• bootstrap_controller - Fix project sync failure collection when loop results omit the skipped attribute.
• bootstrap_controller - Fix pulp repository lookup URL for preflight Hub publish (YAML >- inserted a space before ?name=).
• bootstrap_controller - Fix undefined bootstrap_controller_hub_uri_oauth when publishing Hub collections (set_fact/block vars cannot reference sibling keys in the same task).
• bootstrap_controller - Hub Pulp ansible.builtin.uri calls use Authorization: Token (matching ansible.hub ah_token) instead of Bearer, and omit admin user/password when a Hub API token is set.
• bootstrap_controller - Hub namespace/publish now probes ansible.hub auth modes in order (Hub / Galaxy API token, Contoller OAuth, admin basic). ansible.hub hardcodes Authorization: Token, so Contoller Gateway OAuth that only works as Bearer no longer hard-fails ah_namespace on AAP 2.6 gateways. Raw Pulp URI calls continue to use Contoller OAuth Bearer (or basic).
• bootstrap_controller - Hub publish/namespaces on gateway AAP now use Contoller OAuth (falling back to Hub API token only when OAuth is unset). The Hub User Access / Galaxy API token cannot authorize /api/galaxy/v3/namespaces/ or collection upload on unified Gateway, which caused HTTP 401 during hub-only runs.
• bootstrap_controller - On hub-only runs, ensure the General Controller organization exists before Hub publish when Galaxy credentials or Hub EE Controller objects are enabled.
• bootstrap_controller - Project sync failure message no longer references hardcoded CKTEST-project; uses the actual failing project name(s).
• bootstrap_controller - Put Hub pulp/content lookup URLs on one line so YAML >- does not insert spaces before ?/& (breaks every preflight collection publish, not just repo lookup).
• bootstrap_controller - Skip Galaxy credential create/attach when Hub token is missing.
• bootstrap_controller - Skip infra.ado Hub publish when the version already exists in validated unless force is set; never force additional preflight collections; tolerate pulp promote 500 when version is already validated.
• bootstrap_controller - Split project sync tasks out of apply_aap_25_plus.yml to satisfy ansible-lint max-tasks and fix Hub publish URL line-length failures.
• bootstrap_controller - Stop falling back to Controller OAuth for Hub publish; require vault_galaxy_hub_token.
• bootstrap_controller - Wait for collection versions to appear in Hub staging before pulp move; retry move and fall back to copy when Hub returns HTTP 500 (e.g. community.grafana promote race).
• bootstrap_controller — Honor bootstrap_controller_generate_aap_configs_force_job_workflows when generating configs/job_templates and configs/workflows (skip overwrite, prune, and in-place workflow rewrites when false).
• bootstrap_generate_env_vars - Admin HTPasswd preflight values now also land in vault_htpass_admin.yml / vars_htpass_admin.yml, not only vault_openshift.yml.
• bootstrap_generate_env_vars - Controller Source Control credentials for Bitbucket use git.username plus git.token instead of hardcoded oauth2, which Bitbucket Server rejects during project sync.
• bootstrap_generate_env_vars - Galaxy credential URLs use Hub hostname; container registry credential can be created for EE push without enabling full Galaxy setup.
• bootstrap_generate_env_vars - Galaxy/Hub API credentials and org attachments are emitted only when galaxy_setup_enabled is true and galaxy_hub_token is non-empty; hub-only publish no longer pushes lab Galaxy creds.
• bootstrap_generate_env_vars - Stop mapping unused RHN org/activation key into standalone RHBK vars; prefer explicit standalone_zip_source.
• bootstrap_generate_env_vars - Write vault_galaxy_hub_token from preflight only; Galaxy creds no longer default to Controller OAuth/password.
• bootstrap_generate_playbook_repo - HTPasswd bootstrap playbook loads OpenShift vault/vars so htpasswd_users and htpasswd_action are available to the JT.
• bootstrap_generate_playbook_repo - Stop listing infra.aap_utilities and infra.rhacs_configuration in Contoller collections/requirements.yml (Private Hub cannot resolve them and project sync fails). Bundle on the EE or publish to Hub when those JTs need them.
• bootstrap_generate_playbook_repo — Default bootstrap_generate_playbook_repo_force to f...

1.3.0

Major Changes

• install_aap - Stop creating a standalone AutomationController CR. Delegate present to infra.ado.aap_ocp_install (vendored infra.aap_utilities.aap_ocp_install, same path as Contoller bootstrap) and absent to that role's reset_stale_database tasks. Callers must supply aap_ocp_install_* vars instead of the old ocp_aap26_* / AutomationController interface.

Minor Changes

• Add ado-aap-rhel-install-bootstrap.yml for non-OpenShift AAP installs.
• Remove vendored infra.ado.aap_ocp_install and aap_ocp_install_upstream; Contoller/playbooks call infra.ado.install_aap instead.
• Restore archived kube descheduler role tasks with install/remove KubeDescheduler CR support after operator subscription.
• Wire OpenShift Descheduler (infra.ado.ocp_descheduler) into bootstrap workflow, preflight configuration (instance name, interval, profiles), and env var generation.
• acs_report - Fetch Central export with ansible.builtin.get_url (no curl). Parser runs via python3 on the downloaded NDJSON so ee-supported-rhel9 does not need extra OS packages.
• acs_report - Optional CVE enrichment via acs-cve-plugin (acs-cve enrich-rows) on RHACS scrubbed CSVs.
• acs_upload_policies - Apply policy JSON via infra.rhacs_configuration.rhacs_policy (export bundles via rhacs_policy_import); report configs still use Central REST.
• ado-preflight-ui - ACS config panel toggles for acs-cve-plugin enrichment when acs_report is selected.
• ado-preflight-ui - Apply OpenShift apps_domain to zabbix, dev_hub, bookstack, and netbox hostnames when components are selected.
• ado-preflight-ui - Copy Hub tarball to /workspace/infra-ado-*.tar.gz preserving the galaxy artifact name.
• ado-preflight-ui - Default Grafana OIDC on when Grafana and RHBK are both selected.
• ado-preflight-ui - Dev Hub form with GitLab token field; auto-populates from Git bootstrap token.
• ado-preflight-ui - Fix dev_hub route prefix (backstage-{instance}-rhdh) and define STALE_APP_HOSTNAME_DEFAULTS for lab hostname rewrites.
• bootstrap - Add rhel_system_roles meta-component that expands selected system roles into Contoller playbooks/JTs calling redhat.rhel_system_roles.* directly (no new infra.ado wrappers).
• bootstrap / preflight-ui - Register MinIO in component map, env generation, Controller JT, and preflight form (OIDC + console/API hostnames).
• bootstrap_controller - Add ADO | RHBK Workflow and ADO | Grafana Workflow sub-workflows; OpenShift workflow calls them instead of inline JT chains.
• bootstrap_controller - Added ADO Alt Routes Workflow and split route JTs/playbooks; OpenShift workflow ends with Print ADO Routes and optional Alt Routes Workflow.
• bootstrap_controller - Component sub-workflows (install then optional OIDC/SAML JT) for Quay, MinIO, Dev Hub, BookStack, NetBox, and Zabbix; OpenShift workflow uses workflow nodes instead of single deploy JTs.
• bootstrap_controller - Extend RHEL STIG job template survey with engine, RHEL 10 profile, and CaC remediate toggle.
• bootstrap_controller - Gate Grafana datasource/folder/dashboard/alternate-route job templates on preflight component_options.grafana.
• bootstrap_controller - Gate RHBK LDAP group mapper JT on group_mapper / client_mappers options.
• bootstrap_controller - Grafana workflow adds optional JTs for OIDC, email/SMTP, datasource, folders, dashboards, and alternate route (preflight-gated).
• bootstrap_controller - Job template and workflow node ADO | ACS RHACS Report (CVE Enriched).
• bootstrap_generate_env_vars - Add rhdh_client Keycloak preset for Developer Hub OIDC bootstrap.
• bootstrap_generate_env_vars - Emit stig_engine and rhel_stig_cac_remediate in generated vars_stig.yml.
• bootstrap_generate_env_vars - Export dev_hub keycloak realm/client/instance and MinIO OIDC/storage vars from preflight JSON.
• bootstrap_generate_env_vars - Gate discover-routes print on checkbox; overlay writes vars_routes.yml from preflight route settings.
• bootstrap_generate_env_vars - Gate quay_oidc, minio_oidc, dev_hub_oidc, bookstack_oidc, netbox_oidc, and zabbix_saml on component_options selections.
• bootstrap_generate_env_vars - Wire ACS Central route hostname to ocp_acs_hostname; OpenShift OAuth/LDAP IdP names from preflight openshift.oauth_rhbk / openshift.ldap_auth.
• bootstrap_generate_playbook_repo - STIG hardening playbook branches on stig_engine (cac vs system_role).
• bootstrap_generate_playbook_repo - Split Grafana OpenShift playbooks into install, datasource, folders, and dashboards steps.
• bootstrap_resolve_component - Default ACS report CVE enrichment flags in components_defaults.
• capsule_install - Added storage configuration by reusing infra.ado.satellite_install storage_config with Capsule LVM variables.
• grafana / components_defaults - Enable Grafana Keycloak OIDC by default (grafana-client).
• grafana_install - Split install vs OIDC vs email configure scopes; patch existing Grafana CR for optional steps.
• infra.ado.ocp_alt_routes - Support default route labels, custom alternate route names, and ingress-controller router labels.
• infra.ado.ocp_quay, ocp_minio, ocp_dev_hub, bookstack_openshift, ocp_zabbix - Split install vs auth configure paths using install_scope flags.
• install_aap - Dispatch OpenShift installs to infra.aap_utilities.aap_ocp_install and RHEL installs to aap_setup_download / prepare / install; keep ADO Fernet reset and license attach helpers.
• install_elastic / components_defaults - Create lab Kibana/ES user (kibana / eck_lab_password) after cluster Ready.
• ocp_acs - Best-effort OpenShift OAuth auth provider after Central install.
• ocp_dev_hub - Mount rhdh-app-config via Backstage appConfig.configMaps and inject rhdh-secrets through extraEnvs.secrets (v1alpha5) so Keycloak OIDC actually loads. Omit empty GitLab integration / catalog URL blocks.
• ocp_minio - New MinIO OpenShift component (Deployment, PVC, API/console Routes, Keycloak OIDC console login with policy claim mapper).
• ocp_virtualization - Delegate VirtualMachine create to infra.openshift_virtualization_ops.vm_provision; keep Multus NAD and DataSource dataVolumeTemplates build in ADO.
• preflight / bootstrap_generate_env_vars - RHBK OpenShift TLS mode is selectable (edge default, cert-manager opt-in, or copy default ingress). cert-manager is never the default; issuer kind/name fields appear when cert-manager is chosen.
• preflight-ui - Alternate Routes tab with Print Alternate Routes, Add Alternate Route, and Add Ingress with Route sub-options; Discover Routes tab supports all routes, namespace list, or selected-app namespaces.
• preflight-ui - Expose RHEL System Roles under RHEL components with nested role checkboxes as config options.
• preflight-ui - Quay, MinIO, Dev Hub, BookStack, NetBox, and Zabbix get Grafana-style optional OIDC/SAML checkboxes; auto-enabled when RHBK is selected.
• rhel_stig_cac - Add DISA STIG Compliance-as-Code role for RHEL 8, 9, and 10 using OpenSCAP and scap-security-guide.

Bugfixes

• Controller projects always use Hub for collections — git keeps only collections/requirements.yml (Hub names); vendored collection trees are never written to git and overwrite clears collections/ansible_collections.
• Fix OpenShift bootstrap playbooks for ACM and cert-manager so they
  create the namespace, OperatorGroup, and Subscription (and wait for the
  operator) before applying operands. Deploy cert-manager previously
  only ran ocp_routes, which left IdM ACME ClusterIssuer failing on a
  missing webhook service; Deploy ACM previously applied MultiClusterHub
  without creating open-cluster-management.
• Manifest maps preflight-ui/collections tarballs to Galaxy names for Hub publish and Controller requirements.
• OpenShift workflow - Cert/ingress then RHBK then OIDC then apps; wire DevSpaces and Web Terminal; converge to route print.
• Playbooks (quay, minio, grafana) - Remove duplicate RHBK secret fetch pre_tasks; roles own OIDC secret resolution. Add vars_rhbk.yml to Quay.
• Quay Keycloak login uses Database internal auth plus KEYCLOAK_LOGIN_CONFIG (AUTHENTICATION_TYPE OIDC crashes migration). RHBK realms default to enabled=true in rhbk_realm, components_defaults, env-var generation, and preflight UI so OIDC apps do not hit Realm not enabled.
• Quay Keycloak redirect URIs corrected to /oauth2/keycloak/callback paths and Quay config sets PREFERRED_URL_SCHEME=https plus EXTERNAL_TLS_TERMINATION so login no longer sends http redirect_uri (Invalid parameter redirect_uri).
• Quay supports Keycloak OIDC via KEYCLOAK_LOGIN_CONFIG; client secrets are fetched with ocp_rhbk_client_secrets. MinIO playbook pre-fetches secrets. OpenShift workflow adds BookStack, MinIO, and NetBox OIDC. RHBK client presets expanded (Quay, Dev Hub, Zabbix, Kibana, Kafka). Dev realm defaults to enabled; Dev Hub skips TLS verify for lab Keycloak; Zabbix admin password defaults to redhat123.
• RHBK API playbooks (realm, client, mapper, scopes, EntraID) — shared ado-rhbk-api-pre_tasks.yml drops OpenShift K8S_AUTH_* env, resolves standalone VM hostname/URL (http://host:8080 or HTTPS), and asserts admin API creds only.
• Update ACM default operator channel from release-2.14 to
  release-2.17. Current redhat-operators catalogs no longer publish
  2.14, which left the ACM Subscription in ResolutionFailed and
  ocp_wait_operator spinning on a missing CSV.
• aap_ocp_install - Force aap_ocp_install_reset_database=true in the bootstrap playbook (Contoller vars left it false so Fernet reset skipped).
• aap_ocp_install - Resolve component defaults in the AAP playbook so aap_ocp_install_reset_database=true actually runs; fail fast when gateway pods never become Ready (Fernet InvalidToken / 503).
• aap_ocp_install_upstream - Platform/Controller/EDA/Hub route readiness waits no lo...

New Roles 1.2.0

Major Changes

• Grafana datasources: Openshift-Prod defaults to thanos-querier
  (platform + user-workload metrics). Openshift-Dev uses a remote
  Prometheus URL with bearer_token / bearer_token_secret.
  ocp_cert_manager now creates ServiceMonitors with honorLabels
  so certificate expiry dashboards see real Certificate namespaces.

Minor Changes

• Add OpenShift Grafana dashboards for Keycloak metrics (community 10441), K8S overview (community 15661), and cert-manager certificate expiry with main ADO cert coverage for prod and dev under templates/Openshift/dashboards/.
• BookStack OIDC trusts lab CA via ConfigMap + initContainer (fixes cURL error 60).
• BookStack admin password reset and OIDC (Keycloak RHLAB) env wiring in bookstack_openshift.
• Default AAP OpenShift install version is now 2.7.
• Grafana seed templates - add OpenShift Prod and Dev cluster resource overview dashboards (node CPU/memory ratios, namespace pod table, network, storage, summary stats) under templates/Openshift/dashboards/.
• Grafana: deploy OpenshiftProd and OpenshiftDev folders (pinned datasources) plus
  optional shared Openshift folder with a K8S Prod/Dev dropdown
  (grafana_group_cluster_dashboards). Datasources Openshift-Prod/Dev use thanos-querier.
• Hub EE push accepts Contoller OAuth token (unused+token) for local podman without admin password.
• NetBox OIDC role + Contoller JT to wire Helm NetBox to Keycloak RHLAB.
• OpenShift Dev: document/enable cert-manager Operator + ServiceMonitors for
  Grafana expiry dashboards; Openshift-Dev datasource should use Dev
  thanos-querier (not prometheus-k8s alone) so user-workload metrics appear.
  Dev Keycloak dashboard points at Prod RHBK Micrometer metrics (shared IdP).
• Process rule: prefer ADO roles + bootstrap Contoller JTs before ad-hoc API scripts.
• RHBK manage-client bootstrap passes standard OIDC client fields from rhbk_clients.
• RHBK standalone Contoller JT + playbook seed; preflight option standalone.
• Release infra.ado 1.1.1 for preflight (hub-only always creates General Contoller org; Hub EE attaches Container Registry credential).
• Release infra.ado 1.1.2 for preflight overlays and collection tarball.
• grafana_create_datasource now creates a list of Prometheus datasources (default Openshift-Prod / Openshift-Dev), ensures the monitoring SA token Secret, and the dashboards playbook also runs datasource + folder create. Folder/dashboard upload uses community.grafana with admin basic-auth fallback so Deploy Grafana works without a pre-made API key.
• aap_ocp_install - Accept AAP 2.7 operator channels (stable-2.7 / stable-2.7-cluster-scoped) in addition to 2.5 and 2.6.
• aap_ocp_install - Support optional aap_ocp_install_rhn_subscription_id and service-account client_id/client_secret for license attach; auto-select an Ansible Automation Platform pool when subscription id is omitted.
• aap_ocp_install / bootstrap_controller - Support aap_ocp_install_license_only to skip operator install and only run activate_license.yml.
• acs_report - New role to generate RHACS vulnerability reports from Central workload export (raw / rhsource / age / all), with --all / --rhsre / --sev / --component scope options and companion summary JSON.
• acs_report - Ship a Grafana posture dashboard with Red Hat-source and raw component bar charts, unique CVE / Critical / Important totals, daily discovery inflow, and cumulative backlog growth.
• acs_report - Ship sample Grafana dashboard files/grafana/rhacs-vulnerability-overview.json seeded from scrubbed prod Critical+Important+Fixable component counts.
• ado-preflight-ui - Add AAP 2.7 to the version selector and pass it through to bootstrap.
• ado-preflight-ui - Checking Hub collection publish, Push EE, or Run Hub updates only also enables Galaxy/registry credential setup so org + pull auth are ready for Contoller.
• ado-preflight-ui - Test AAP connection (controller ping) before bootstrap
  ansible when configuring an existing Contoller.
• bookstack_openshift - New role to deploy BookStack + MariaDB on OpenShift (PVC, Route, Contoller JT).
• bootstrap - Add AWS platform umbrella selection via preflight
  components, component_apps.aws, and component_options.aws.
  ec2_ami_copy remains the first app with shared vault_aws.yml and
  vars_aws.yml credentials. Legacy standalone ec2_ami_copy preflight
  selection remains supported.
• bootstrap - Add ado-copy-ami-bootstrap playbook, job template, and
  vars_ec2_ami_copy generation for infra.ado.ec2_ami_copy cross-region
  AMI copies.
• bootstrap - Add shared vault_aws.yml / vars_aws.yml credentials for
  all AWS bootstrap consumers (ec2_ami_copy, cert-manager AWS PCA, and
  future modules).
• bootstrap - Seed playbook playbooks/acs/ado-acs-report.yml and Controller JT ADO | ACS RHACS Vulnerability Report.
• bootstrap_controller - Accept aap_version: 27 and use the AAP 2.5+ gateway apply path.
• bootstrap_controller - Add RHACS report job templates (survey, rhsource, raw, age) and ADO | ACS RHACS Report Workflow when the acs_report option is selected.
• bootstrap_controller - Add ADO | IdM Manage AD Trust job template for idm_ad_trust_install.
• bootstrap_controller - Add ADO | Satellite Keycloak OIDC job template for satellite_oidc.
• bootstrap_generate_env_vars - Allow Patching to reuse an existing AAP inventory via component_config.patching.inventory_mode: existing and inventory_name instead of creating <org>-RHEL-Inventory.
• bootstrap_generate_env_vars - Also imply the compliance component from component_options.rhel the same way stig is implied.
• bootstrap_generate_env_vars - Expand ACS component_options into playbook/JT selectors (same pattern as Satellite/IdM).
• bootstrap_generate_env_vars - Honor Galaxy credential order (1 = first in org Galaxy search list); emit optional non-admin Contoller user from Galaxy tab.
• bootstrap_generate_env_vars - Honor pre_installs.install_aap and map component replicas (including AAP controller replicas) from preflight form values.
• bootstrap_generate_env_vars - Honor preflight AAP version 2.7 / 27 for generated aap_version, operator channel, and EE image.
• bootstrap_generate_env_vars - Honor preflight component_config.aap.operator_scope (all_namespaces or namespaced) when choosing the AAP operator channel; explicit operator_channel still wins.
• bootstrap_generate_env_vars - Overlay IdM AD trust vars/vault secrets from preflight and create IdM inventory when AD Trust is selected.
• bootstrap_generate_env_vars - Stage a selected RHBK standalone zip into
  files/ and set rhbk_standalone_zip to the playbook-relative path
  so AAP can copy it from the controller/EE.
• bootstrap_generate_env_vars - When preflight Galaxy setup is enabled, emit Galaxy/Hub API Token and Container Registry credentials (and org galaxy_credentials attach) using General Contoller admin/OAuth fallbacks when tokens are empty — same pattern as Hub EE push.
• bootstrap_generate_env_vars / preflight - Pass hostname, vaulted RHN password, optional subscription id, and admin credentials through to license activation.
• bootstrap_generate_playbook_repo - AD trust bootstrap playbook loads vars_idm.yml/vault_idm.yml and targets the IdM inventory.
• bootstrap_generate_playbook_repo - Add Satellite Keycloak OIDC bootstrap playbook.
• bootstrap_generate_playbook_repo - Added community.grafana and grafana.grafana to generated collection requirements.
• bootstrap_generate_playbook_repo - Default generated collections/requirements.yml pin for infra.ado is 1.0.3.
• bootstrap_generate_playbook_repo - Seed Grafana dashboard templates under
  playbook_repo_seed/templates/ for copy-out: Openshift *.json.j2
  dashboards and the RHACS vulnerability overview sample
  (templates/RHACS/dashboards/rhacs-vulnerability-overview.json).
• bootstrap_generate_playbook_repo / bootstrap_controller - Wire BookStack playbook and JT seed; selectable as bookstack OpenShift app.
• bootstrap_resolve_component - Register bookstack component defaults.
• bootstrap_resolve_component / preflight - Default grafana_folders now points at templates/Openshift and templates/RHACS.
• capsule_install - Added RHSM subscription tasks to register Capsule hosts with Satellite and enable required repositories.
• capsule_install - Added capsule_install_setup_insights (default false) to control Insights setup during Capsule registration.
• capsule_install - Added skeleton role structure for Red Hat Satellite Capsule installation.
• capsule_install - Updated role defaults and main task flow to support preliminary check and RHSM registration.
• ci - Start fakecloud in the Molecule pipeline for scenarios listed in
  extensions/molecule/fakecloud_scenarios.txt so AWS API integration
  tests (integration_ec2_ami_copy and
  integration_ec2_ami_copy_keep_name for infra.ado.ec2_ami_copy)
  run without real cloud credentials.
• collections - Declare redhat.rhel_idm in collection requirements and playbook repo seed/template so IdM server/client/replica jobs can install the certified collection from Automation Hub.
• docs - Expanded Hub recovery/permanence runbook for shared-Postgres LWLock failures.
• idm_ad_trust - Replaced ipa CLI / ansible.builtin shell wrappers with redhat.rhel_idm modules (ipatrust, ipadnsforwardzone, ipaidrange, ipagroup, ipasudorule). Service start/restart (smb, named, sssd) now uses infra.ado.rhel_services_management. OS-level steps (packages, firewalld, crypto policy, ipa-adtrust-install) remain builtin where no collection role exists.
• infra.ado - Preflight/bootstrap support for ...

Adding ec2 copy module and some minor bug and documentations fixes

Minor Changes

• infra.ado.ec2_ami_copy - Added module to copy an AWS AMI between regions with wait, encryption, optional source-tag copy, and tag-based idempotency.

Breaking Changes / Porting Guide

• Dropped Ansible 2.16 support (EOL). meta/runtime.yml requires_ansible is now >=2.17.0, matching CI and the amazon.aws dependency.

Bugfixes

• ci - Install galaxy.yml collection dependencies before antsibull-changelog release so modules that extend external doc fragments (for example amazon.aws) can be parsed during release builds.
• ci - Install the local collection with --no-deps in Molecule jobs so galaxy.yml runtime dependencies are not resolved from Galaxy during role scenario runs.
• ci - Skip Ansible 2.16 and py3.12-milestone tox-ansible sanity/unit matrix entries; amazon.aws requires Ansible >=2.17 and current ansible-core milestone requires Python >=3.13.
• infra.ado.ec2_ami_copy - Declare amazon.aws as a collection dependency and fix module documentation metadata so ansible-test validate-modules passes.

Documentation Changes

• README - Added collection purpose overview and a complete role index with one-line descriptions and links to each role README.
• README - Documented modules alongside roles; detailed module usage lives under docs/modules/.
• README / docs - Ansible version compatibility updated to >=2.17.0.

New Modules

• infra.ado.ec2_ami_copy - Copy an AMI between AWS regions.

Lates release to add the missing satellite extra variables to form

Minor Changes

• Bootstrap can materialize OpenShift auth from an uploaded kubeconfig
  (or host+token), then optionally install Admin HTPasswd and NFS CSI
  storage in the preflight pod before AAP install.
• OpenShift Virt network defaults - drop preflight static IP seeding; add optional ip_range guidance for the survey help text while keeping gateway, DNS, and prefix_length as optional survey defaults.
• Wire the iscsi_csi OpenShift option to ocp_iscsi_storage
  (bundled Synology CSI manifests via kubernetes.core, client-info
  secret from DSM credentials, StorageClass, optional snapshotter)
  with bootstrap prep, playbook, and job template support.
• Wire the nfs_csi OpenShift option to ocp_nfs_storage (Helm
  csi-driver-nfs 4.11.0, privileged SCC RoleBindings, StorageClass)
  with playbook and job template support.
• aap_ocp_install - add an ADO wrapper around the vendored infra.aap_utilities 3.5.0 aap_ocp_install role for AAP 2.5 and 2.6 operator/platform deployments on OpenShift.
• bootstrap AAP on OpenShift install - add component_config.aap.minimal_footprint to disable Hub, EDA, and Lightspeed for CPU-constrained clusters (Controller + Gateway only).
• bootstrap AAP on OpenShift install - support component_config.aap.admin_username / admin_password (vault: aap_admin_password). Bootstrap creates the {instance}-admin-password Secret and sets spec.admin_password_secret on the AnsibleAutomationPlatform CR.
• bootstrap roles - generate native aap_ocp_install variables and a single AAP-on-OpenShift playbook/job template instead of the incomplete copied AAP 2.4 placeholders.
• bootstrap_controller / preflight - add component_config.aap.install_during_bootstrap. When true, bootstrap writes install vars, runs infra.ado.aap_ocp_install in the preflight pod, and skips playbook/AAP config generation, Controller connectivity/smoke/apply, and the Install AAP job template. Rerun bootstrap once AAP is up to configure the Controller. When false (default), selecting the OpenShift aap app still generates that job template and OpenShift workflow node for later use.
• bootstrap_generate_env_vars - write Satellite manifest uploads as satellite_config_manifest_file (with derived src/path and upload flag) for the Satellite configure playbook.
• bootstrap_generate_env_vars / OpenShift Virt - accept optional preflight static_ip, prefix_length, gateway, and dns_servers values, write them to generated vars (including openshift_virt_network_defaults), and seed the Provision OpenShift Virt VM survey defaults from those values.
• bootstrap_generate_env_vars / bootstrap_controller - configure AAP 2.5+ Automation Gateway authenticators from preflight aap.auth (Keycloak OIDC, LDAP, Keycloak SAML). Writes vault_gateway_auth.yml and applies gateway_authenticators / gateway_authenticator_maps through infra.aap_configuration.dispatch during bootstrap.
• bootstrap_generate_env_vars / satellite_config - emit and default satellite_config_rhn_connected to true; UI/CLI preflight can override with component_config.satellite.rhn_connected.
• bootstrap_generate_playbook_repo - include kubernetes.core and redhat.openshift in generated project collection requirements.

Bugfixes

• CI collections/requirements.yml - drop redhat.openshift. It is not published on public Galaxy (Automation Hub only), which broke ansible-galaxy install in GitHub Actions. Token-auth OpenShift paths use kubernetes.core; username/password login still needs redhat.openshift from Automation Hub at runtime.
• aap_ocp_install, aap_ocp_install_upstream, ocp_iscsi_storage - align role README headings with the collection README format template so README verification passes.
• aap_ocp_install_upstream - do not resolve redhat.openshift.openshift_auth when an OpenShift API token is already provided. Username/password login and token revoke live in separate task files so token-auth installs work with only kubernetes.core (as used by preflight bootstrap).
• bootstrap_controller - fix OpenShift Virt VM survey apply failure where provision_openshift_virt_prefix_length default was emitted as the string "24" instead of integer 24 (quoted placeholder substitution order).
• bootstrap_controller - normalize string and dictionary AAP labels before creating them so generated organization labels do not fail AAP 2.5+ bootstrap runs.
• bootstrap_generate_env_vars / OpenShift Virt playbook - inherit OpenShift skip_tls_verify (and API host/token when blank) for VM provisioning, and fall back to generated OpenShift TLS vars so the job no longer fails when provision_openshift_virt_skip_tls_verify is unset.
• bootstrap_generate_playbook_repo - configure generated AAP projects to sync on launch and wait for project creation so job runs pick up current collection requirements from the generated repository.
• bootstrap_generate_playbook_repo - generate infra.ado collection requirements with only the collection name and version so AAP resolves the source through its configured content repositories.
• bootstrap_resolve_component - normalize app_domain from the generated apps_domain value (or derive apps. for legacy vars) before rendering component defaults, and register openshift_virt so VM provisioning no longer fails during common variable resolution.
• ci - remove unsupported user platform key from integration_rhel_patching and integration_rhel_repos_default Molecule configs so podman driver schema validation passes.
• ocp_iscsi_storage - wrap multi-document CSI manifests as Kubernetes List resources and clear executable bits so ansible-test yamllint and shebang sanity checks pass.

Release containing the latest Satellite additions

Minor Changes

• Add OpenShift Virtualization VM launch survey options for image preference, instance type, custom CPU and memory, disk size, static networking, password setup, and optional root SSH.
• Add Satellite install sizing, storage mount, deployment version, RHN organization, location, admin password, and activation key defaults to the bootstrap env var generator so UI and CLI preflight runs can populate the Satellite install role.
• Add default Satellite install tuning tiers and storage mount definitions to the Satellite install role.
• Add optional OpenShift Virtualization VM provisioning to bootstrap generation, including component vars, generated playbook repo content, and an AAP job template for CLI and UI preflight runs.
• Limit OpenShift Virtualization preflight-derived values to the OpenShift API endpoint, API token, TLS verification setting, and SSH public key so VM sizing and guest customization are controlled from the AAP launch survey.
• bootstrap_controller - Publishes the generated infra.ado collection to AAP Hub on AAP 2.5+ runs when the Hub publish option is enabled.
• bootstrap_controller - Stops after the AAP Hub publish step when the collection-only update flag is enabled.
• bootstrap_generate_env_vars - Added a collection-only Hub update flag so callers can update infra.ado in AAP Hub without generating component bootstrap content.
• bootstrap_generate_env_vars - Added a generated force-update toggle for publishing the bundled infra.ado collection to validated content in AAP Hub.
• collection - Fill out galaxy metadata with ADO project links, tags, and runtime collection dependencies.
• collection - Standardize the collection and role Ansible requirement metadata on ansible-core 2.16.
• roles - Flatten task entrypoints that only imported a single task file.

Bugfixes

• Apply generated AAP inventory sources directly with ansible.controller so Satellite dynamic inventory sources are created when enabled from either the UI preflight JSON or CLI variables.
• Generated env var YAML now suppresses YAML anchors and preserves machine credential SSH private keys with a trailing newline instead of extra spaces.
• Keep Automation Hub and optional runtime collections out of galaxy.yml hard dependencies so installing the built infra.ado artifact does not fail when public Galaxy cannot resolve Red Hat or local-only collections.
• Normalize generated AAP survey choices so list values remain separate options instead of collapsing into a single dropdown entry.
• Remove remaining install-time galaxy.yml dependency resolution so pod and offline installs of infra.ado use container-provided collection tarballs.
• Satellite RHN organization IDs and activation keys are written as vault-backed values, with activation keys preserved when supplied by the UI.
• Satellite bootstrap playbooks now load generated env vars from the project root when running under AAP and enable become where host changes require it.
• Satellite install VG name is now generated from preflight/CLI input and raw installer-only fields are no longer duplicated under generic component config.
• Satellite install role defaults and task references now consistently use satellite_install_rhn_*, satellite_install_size*, satellite_install_min_*, and other non-duplicated install variable names.
• Satellite storage install variables now use the names consumed by the storage tasks, including satellite_install_vg_name, satellite_install_req_dirs, and satellite_install_data_*.
• Stop silently removing checked Satellite dynamic inventory sources during AAP credential-type preflight unless the compatibility skip flag is explicitly enabled.
• bootstrap_controller - Corrects AAP controller auth preflight messages to reference the generated aap_vault.yml file.
• bootstrap_controller - Loads generated AAP config variables and enables the AAP apply path for collection-only Hub update runs so the Hub publish step is not skipped.
• bootstrap_controller - Passes the generated AAP Hub repository target when publishing infra.ado so collection updates land in validated content instead of the published repository.
• bootstrap_controller - Stops waiting indefinitely on AAP Hub collection import processing after the upload is submitted so UI runs can return the final recap.
• bootstrap_generate_env_vars - Handles empty component and platform lists when running in AAP Hub collection-only update mode.
• bootstrap_generate_env_vars - Treats an empty Satellite deployment version as missing and writes the default 6.19 value.
• bootstrap_generate_env_vars - point the generated AAP execution environment at the supported AAP 2.6 RHEL 9 execution environment image instead of the generic AWX EE image so Satellite inventory syncs can load redhat.satellite.foreman.
• bootstrap_generate_env_vars - render the Satellite TLS validation setting into dynamic inventory source vars so AAP Satellite inventory syncs honor the UI and CLI skip TLS setting.
• bootstrap_generate_playbook_repo - Generates project collection requirements with an infra.ado version pin and AAP Hub source URL so AAP project syncs install the collection version containing newly generated roles such as ocp_virtualization.
• satellite_config - Defaults the Satellite deployment version to 6.19 for repository label generation.
• satellite_install - Defaults the Satellite deployment version to 6.19 so installs do not fail preliminary validation when generated vars omit the version.

First official release. It is ready to be published to validated

Minor Changes

• Add RHEL patching survey prompts for reboot behavior, package selection, package state, exclusions, disabled repositories, cache refresh, kernel cleanup, and skip-broken handling.
• Add Satellite service account inputs to generated environment vars so Satellite configuration can connect using UI or CLI-provided credentials.
• Add optional Satellite 6 dynamic inventory source generation for AAP, including a Satellite credential and inventory source settings for UI and CLI preflight runs.
• Added ACM bootstrap playbook and job template coverage so selected ACM components produce AAP content.
• Added OpenShift htpasswd, console banner, and cert-manager configuration variables for generated UI and CLI preflight runs.
• Added an OpenShift bootstrap workflow that includes selected admin htpasswd, cert-manager, console banner, RHBK, Grafana, GitLab, Pega, Kafka, AAP, ECK, GitOps, 389ds, OADP, Quay, ACS, and ACM job templates when those templates are generated.
• Bootstrap generation now removes playbook, environment variable, vault, and AAP job template artifacts for components that are no longer selected.
• Check AAP controller API connectivity before applying bootstrap controller objects and run a configurable demo job template smoke test.
• Correct the Satellite registration job template survey definition to use survey_spec and the standard bootstrap controller variables.
• Normalize RHEL patching list inputs so AAP survey text answers can be used as package, exclude, and disabled repository lists.
• Sync generated bootstrap playbook repositories with the remote branch before pushing so repeated UI or CLI generation runs can rebase on origin first.
• aap_build_ee - Added optional aap_build_ee_ansible_core and aap_build_ee_ansible_runner variables for minimal base image builds.
• aap_build_ee - Normalized aap_build_ee_collections input to support dict, list, and flat object formats when rendering requirements.yml.
• aap_build_ee - Updated aap_build_ee_collections to accept a mapping of collection name to version constraint for generated requirements.yml.
• ado-preflight-ui - Add Satellite field help, consistent skip-TLS wording, IDM configuration controls, immediate SSH key paste support, and an end-of-run ADO bootstrap recap.
• bootstrap_controller - add an AAP job template for RHEL STIG hardening with surveys for environment, compliance profile, and STIG profile.
• bootstrap_controller - attach the organization label to generated AAP job templates and workflow templates so each bootstrap run has an org-based top-level filter label in addition to component labels.
• bootstrap_controller - prefix generated job and workflow template names with the configured AAP organization.
• bootstrap_controller - verify the organization label exists in AAP after label creation so missing domain/filter labels fail visibly during bootstrap.
• bootstrap_generate_env_vars - Added generated AAP Machine credential support for RHEL, Satellite, and patching workflows, including vault_machine_cred.yml for SSH key material.
• bootstrap_generate_env_vars - Prefer component app selections over stale selected_component_apps values when importing older preflight JSON files.
• bootstrap_generate_env_vars - Preserve UI and CLI IDM configuration fields for DNS, replica, certificate, custom certificate, and auto-forwarder settings while removing the obsolete IDM storage value.
• bootstrap_generate_env_vars - add AAP additional credential inputs, org-based AAP object naming, and hub collection toggle vars for UI and CLI preflight flows.
• bootstrap_generate_env_vars - allow UI and CLI preflight JSON RHEL STIG options to generate the STIG component artifacts and profile vars.
• bootstrap_generate_env_vars - map OpenShift LDAP, OAuth/RHBK, route discovery, and pull secret checkboxes to distinct component app keys so UI and CLI payloads can select them independently.
• bootstrap_generate_playbook_repo - add a RHEL STIG hardening bootstrap playbook and optional generated repository STIG requirements for redhat.rhel_system_roles without making it a hard dependency of infra.ado installation.
• ci - Add changelog preview for dev pre-releases, including release notes and a downloadable CHANGELOG-preview.rst asset built from accumulated fragments.
• ci - Added ADO collection roles to mock_roles and excluded generated bootstrap seed payloads from source lint checks.
• ci - Added automatic collection build and GitHub Release asset attachment for dev tag pre-releases and published releases. Ansible Galaxy publish is now manual via the Release infra.ado workflow_dispatch job.
• ci - Generate CHANGELOG.rst from accumulated changelog fragments automatically when a GitHub Release is published, commit the result to main, and include the changelog in the release collection tarball.
• docs - Add a role documentation index to the collection README with links to each role README.
• ocp_console_banner - accept add/update/delete state aliases while keeping present/new/absent compatibility.
• rhel_ext_system_roles - add support for invoking the upstream STIG RHEL system role through the existing wrapper.
• rhel_repos - Added Podman Molecule integration scenario on UBI 8 and UBI 9.
• satellite_config - Added a condition so third-party products and repositories are created on Satellite only when satellite_products is defined and non-empty.
• satellite_config - Added a condition to create third-party products and repositories on Satellite only when satellite_products is defined and non-empty.
• satellite_config - Added condition to create 3rd party products and repositories on Satellite only when satellite_products is defined and non-empty.

Breaking Changes / Porting Guide

• rhel_repos - Renamed role from platform_repos; use infra.ado.rhel_repos and rhel_repos_* variables instead of platform_repos_*.

Removed Features (previously deprecated)

• platform_ec2 - Removed role.

Bugfixes

• Add generated RHEL compliance and Satellite install/config/content-view playbooks and job templates, plus RHEL and Satellite workflow templates that target the matching generated component inventories.
• Attach the plain organization label to generated job templates and workflows so AAP domain/filter views can show the organization grouping.
• Create an organization label/domain such as ADO and keep generated job-template and workflow labels organization-prefixed.
• Generate both a focused patching workflow and a full RHEL workflow with simplified workflow nodes so AAP creates workflow templates reliably.
• Generate component-specific AAP inventories so the default inventory contains only localhost, RHEL managed hosts use the RHEL inventory, IDM hosts use the IDM inventory, and Satellite server jobs use the Satellite server inventory.
• Generate workflow template labels as top-level label lists instead of related label strings so infra.aap_configuration can create workflow templates without failing on missing label object names.
• Ignore stale component app selections from inactive groups so an OpenShift run with old RHEL/Satellite JSON state does not enable Satellite dynamic inventory or require Satellite service account fields.
• Keep optional OpenShift configuration jobs, such as Console Banner and Admin HTPasswd, as independent workflow start branches so they are added to AAP workflows even when other optional OpenShift jobs are not selected.
• Load OpenShift htpasswd and console banner jobs from vars_openshift and vault_openshift so selected OpenShift runs do not depend on ungenerated vars_htpasswd or vars_common files.
• Load generated AAP and component vault files before rendering controller config files so Satellite dynamic inventory credentials can reference generated vault variables.
• Map generated workflow config files to the controller_workflows dispatcher variable so AAP workflow templates are applied, not only written to Git.
• Normalize additional AAP credential names and Satellite dynamic inventory object names to the organization-prefixed naming pattern.
• Normalize generated AAP project names to the organization-prefixed naming pattern so UI and CLI inputs such as test-project become RH-test-project when the organization is RH.
• Normalize generated primary AAP Vault and Machine credential names to the organization-prefixed naming pattern so UI and CLI inputs such as test-vault and test-machine become RH-test-vault and RH-test-machine when the organization is RH.
• Normalize generated primary AAP inventory names to the organization-prefixed naming pattern so inputs such as test-inventory become RH-test-inventory when the organization is RH.
• Preflight the optional Satellite 6 dynamic inventory credential type before applying AAP credentials, and skip only the Satellite inventory source when that credential type is unavailable.
• Preserve vault variable references in generated controller credential config files instead of resolving secrets during config generation.
• Prune generated workflow nodes that reference unselected job templates so partial OpenShift app selections do not create invalid AAP workflows.
• Refresh generated AAP config and vault files on preflight JSON runs so UI reruns do not keep stale controller object definitions.
• Reload generated controller config files before applying AAP objects so split inventories, hosts, inventory sources, labels, job templates, and workflow templates are created from the current UI or CLI run.
• Render additional AAP credentials with credential-type-specific inputs, so Vault credentials use vault_password instead of machine credential fields.
• Render generated Console Banner survey choices as AAP-compatible newline-separated options so the default update action is accepted and OpenShift workflow creation is not blocked during AAP dispatch....