AAP 2.6 Upgrade Guide: RHEL 8 to 9 and RPM to Containerized Migration

# Check AAP version
automation-controller-service version

# Check RHEL version
cat /etc/redhat-release

# Check disk space — need at least 2x DB size free
df -h /var /tmp

# List active job templates (for inventory before clean-rebuild)
awx job_templates list --all -f human

# Check database size
sudo -u postgres psql -c "\l+"

---
- name: Export AAP configuration as code
  hosts: localhost
  connection: local
  vars:
    controller_hostname: "https://aap.example.com"
    controller_username: "admin"
    controller_password: "{{ vault_admin_password }}"
    controller_validate_certs: true
  tasks:
    - name: Export all objects
      ansible.builtin.include_role:
        name: infra.controller_configuration.export
      vars:
        controller_export_all: true
        controller_export_dir: "./aap-config-backup/"

# On the source AAP host, stop services first
sudo systemctl stop automation-controller
sudo systemctl stop automation-hub
sudo systemctl stop automation-eda

# Dump the AAP database
sudo -u postgres pg_dumpall --clean > /backup/aap-full-$(date +%Y%m%d).sql

# Capture SECRET_KEY (needed for credential decryption on restore)
sudo cat /etc/tower/SECRET_KEY > /backup/SECRET_KEY.bak

# Backup configuration files
sudo tar czf /backup/aap-configs-$(date +%Y%m%d).tar.gz \
  /etc/tower/ \
  /etc/ansible-automation-platform/ \
  /var/lib/awx/

# Verify backup is not empty
ls -lh /backup/

# On the new RHEL 9 target — register with Red Hat
sudo subscription-manager register --auto-attach

# Enable AAP 2.6 repositories
sudo subscription-manager repos \
  --enable ansible-automation-platform-2.6-for-rhel-9-x86_64-rpms

# For containerized AAP — install the setup bundle prerequisites
sudo dnf install -y podman python3-pip

# Download the AAP 2.6 setup bundle
# (obtain URL from Red Hat Customer Portal)
tar xvf ansible-automation-platform-setup-bundle-2.6*.tar.gz
cd ansible-automation-platform-setup-bundle-2.6*/

# Configure inventory — point to the new host
# Key setting: use_internal_db=false if restoring external DB
cp inventory inventory.bak
vi inventory

# Run the installer (first pass — creates empty DB)
sudo ./setup.sh

# Stop AAP services on the target before restoring
sudo systemctl stop automation-controller
sudo systemctl stop automation-hub

# Restore database from backup
sudo -u postgres psql < /backup/aap-full-20260519.sql

# Restore SECRET_KEY (must match source or credentials won't decrypt)
sudo cp /backup/SECRET_KEY.bak /etc/tower/SECRET_KEY
sudo chmod 0600 /etc/tower/SECRET_KEY

# Run the installer again — applies schema migrations to restored DB
sudo ./setup.sh

---
- name: Verify AAP 2.6 migration
  hosts: localhost
  connection: local
  tasks:
    - name: Check controller version
      ansible.builtin.uri:
        url: "https://aap-new.example.com/api/v2/ping/"
        user: "{{ vault_aap_admin }}"
        password: "{{ vault_aap_password }}"
        force_basic_auth: true
        validate_certs: true
      register: ping_result

    - name: Assert correct version
      ansible.builtin.assert:
        that: "'2.6' in ping_result.json.version"
        success_msg: "AAP 2.6 confirmed: {{ ping_result.json.version }}"

    - name: Verify credential count matches source
      ansible.builtin.uri:
        url: "https://aap-new.example.com/api/v2/credentials/?page_size=1"
        user: "{{ vault_aap_admin }}"
        password: "{{ vault_aap_password }}"
        force_basic_auth: true
      register: cred_count

    - name: Display credential count
      ansible.builtin.debug:
        msg: "Credentials migrated: {{ cred_count.json.count }}"

---
- name: Export AAP configuration for clean-rebuild
  hosts: localhost
  vars:
    controller_hostname: "https://aap-old.example.com"
    controller_username: "admin"
    controller_password: "{{ vault_admin_password }}"
  tasks:
    - name: Export organizations
      ansible.builtin.include_role:
        name: infra.controller_configuration.export
      vars:
        controller_export_all: true
        controller_export_dir: "./aap-cac-export/"

    - name: List exported files
      ansible.builtin.find:
        paths: "./aap-cac-export/"
        patterns: "*.yaml"
      register: exported
    
    - name: Show export summary
      ansible.builtin.debug:
        msg: "Exported {{ exported.matched }} configuration files"

---
- name: Import AAP configuration to AAP 2.6
  hosts: localhost
  vars:
    controller_hostname: "https://aap-new.example.com"
    controller_username: "admin"
    controller_password: "{{ vault_admin_password }}"
  tasks:
    - name: Import organizations
      ansible.builtin.include_role:
        name: infra.controller_configuration.dispatch
      vars:
        controller_configuration_dir: "./aap-cac-export/"

---
- name: Import credentials from HashiCorp Vault
  hosts: localhost
  tasks:
    - name: Read credentials from Vault
      community.hashi_vault.vault_kv2_get:
        path: "secret/data/aap/credentials"
        url: "{{ vault_url }}"
        token: "{{ vault_token }}"
      register: vault_creds

    - name: Create machine credentials in AAP
      ansible.controller.credential:
        name: "{{ item.name }}"
        credential_type: Machine
        organization: "{{ item.organization }}"
        inputs:
          username: "{{ item.username }}"
          password: "{{ item.password }}"
        controller_host: "https://aap-new.example.com"
        controller_username: admin
        controller_password: "{{ vault_admin_password }}"
      loop: "{{ vault_creds.data.data.machine_creds }}"
      no_log: true