How to use Minio for Ansible automation hub

August 11, 2025
Kamlendu Shekhar
Related topics:
Automation and management
Related products:
Red Hat Ansible Automation Platform

This article explores how to configure and use MinIO—a high-performance, self-hosted object storage solution—as a backend for Ansible automation hub when deploying Red Hat Ansible Automation Platform. This approach eliminates the need for cloud-native object storage services like AWS S3 or Azure Blob, making it ideal for air-gapped, on-prem, or cost-sensitive environments. You'll learn how to set up Minio, integrate it with AAP, and validate its functionality as a fully compatible S3-like storage backend for hosting custom content collections.

As organizations increasingly adopt Ansible Automation Platform for enterprise-wide automation, the need for flexible and cost-effective storage solutions becomes critical, especially when deploying a private automation hub to host certified or custom content collections. While cloud providers like Amazon Web Services (AWS) and Azure offer S3-compatible storage (S3, Blob), these options may not be feasible in air-gapped, on-premise, or regulated environments.

To address this, we can use Minio, a high-performance, S3-compatible object storage system that can be deployed on a Red Hat OpenShift environment. This enables a fully self-contained, cloud-independent Ansible Automation Platform deployment. 

This article is divided into two parts: 

Part 1: Set up Minio on an OpenShift cluster.

Part 2: How to use Minio to deploy Ansible Automation Platform.

Prerequisites

Before we begin, ensure that you have:

  • Access to Red Hat OpenShift Container Platform (version 4.12 or higher recommended; I have tested it in 4.16).
  • Cluster-admin or equivalent privileges to deploy workloads and configure storage.
  • Registry connectivity for pulling images.

Note:

I am using letsencrypt for the certificates.

As of now, I couldn't make it work with a self-signed certificate or with -tls-verify=false. The automation hub API pod gives "urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1006)." You may see a 500 internal error while pushing the images.

Part 1: Deploy Minio on OpenShift

Follow these steps to deploy Minio on OpenShift (or refer to the Minio guide):

  1. Create a project in OpenShift Container Platform. I created a project called "aap" in OpenShift, where I am going to deploy my Minio pod.
  2. Navigate to Workloads -> Pods for the project and then click the plus sign (+) to import YAML, as shown in Figure 1.
A view of OpenShift Container Platform showing the user navigating to Workloads -> Pods then clicking the plus sign to import YAML.
Figure 1: Navigating to Pods to click the plus sign to import YAML.

  1. Paste the following YAML into the editor:

    ---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: minio-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 20Gi
  volumeMode: Filesystem
---
kind: Secret
apiVersion: v1
metadata:
  name: minio-secret
stringData:
  # change the username and password to your own values.
  # ensure that the user is at least 3 characters long and the password at least 8
  minio_root_user: minio
  minio_root_password: minio123
---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: minio
spec:
  replicas: 1
  selector:
    matchLabels:
      app: minio
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: minio
    spec:
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: minio-pvc
      containers:
        - resources:
            limits:
              cpu: 250m
              memory: 1Gi
            requests:
              cpu: 20m
              memory: 100Mi
          readinessProbe:
            tcpSocket:
              port: 9000
            initialDelaySeconds: 5
            timeoutSeconds: 1
            periodSeconds: 5
            successThreshold: 1
            failureThreshold: 3
          terminationMessagePath: /dev/termination-log
          name: minio
          livenessProbe:
            tcpSocket:
              port: 9000
            initialDelaySeconds: 30
            timeoutSeconds: 1
            periodSeconds: 5
            successThreshold: 1
            failureThreshold: 3
          env:
            - name: MINIO_ROOT_USER
              valueFrom:
                secretKeyRef:
                  name: minio-secret
                  key: minio_root_user
            - name: MINIO_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: minio-secret
                  key: minio_root_password
          ports:
            - containerPort: 9000
              protocol: TCP
            - containerPort: 9090
              protocol: TCP
          imagePullPolicy: IfNotPresent
          volumeMounts:
            - name: data
              mountPath: /data
              subPath: minio
          terminationMessagePolicy: File
          image: >-
            quay.io/minio/minio:latest
          args:
            - server
            - /data
            - --console-address
            - :9090
      restartPolicy: Always
      terminationGracePeriodSeconds: 30
      dnsPolicy: ClusterFirst
      securityContext: {}
      schedulerName: default-scheduler
  strategy:
    type: Recreate
  revisionHistoryLimit: 10
  progressDeadlineSeconds: 600
---
kind: Service
apiVersion: v1
metadata:
  name: minio-service
spec:
  ipFamilies:
    - IPv4
  ports:
    - name: api
      protocol: TCP
      port: 9000
      targetPort: 9000
    - name: ui
      protocol: TCP
      port: 9090
      targetPort: 9090
  internalTrafficPolicy: Cluster
  type: ClusterIP
  ipFamilyPolicy: SingleStack
  sessionAffinity: None
  selector:
    app: minio
---
kind: Route
apiVersion: route.openshift.io/v1
metadata:
  name: minio-api
spec:
  to:
    kind: Service
    name: minio-service
    weight: 100
  port:
    targetPort: api
  wildcardPolicy: None
  tls:
    termination: edge
    insecureEdgeTerminationPolicy: Redirect
---
kind: Route
apiVersion: route.openshift.io/v1
metadata:
  name: minio-ui
spec:
  to:
    kind: Service
    name: minio-service
    weight: 100
  port:
    targetPort: ui
  wildcardPolicy: None
  tls:
    termination: edge
    insecureEdgeTerminationPolicy: Redirect
  2. Change default username/password and size (lines 21, 22, and 11 in the YAML).
  3. Click Create (Figure 2).
Import YAML.
Figure 2: When you have entered the YAML into the editor, click the create button to import YAML.

Now you have created Minio resources like PVC, secret, service, api(route), and ui(route).

  1. Check the pod status, as shown in Figure 3.
Pod list after minio deployment
Figure 3: This is the pod list after the Minio deployment.

Check the Minio routes, as shown in Figure 4.

Minio Routes
Figure 4: The Minio routes are shown here.

Note that -api route is for programmatic access and -ui route is for the UI (Figure 5).

Minio UI Access
Figure 5: Minio UI access.
  1. Click Create Bucket and enter a name to create a bucket (Figure 6).
Minio AAP Bucket
Figure 6: Create Minio Ansible Automation Platform bucket.

We can use this for our automation hub storage.

Part 2: Deploy Ansible Automation Platform

We will now deploy the Ansible Automation Platform operator using the Minio bucket. Learn more...

Follow these steps:

  1. In the OpenShift Container Platform UI, navigate to OperatorHub in the left panel.
  2. Enter "Ansible Automation Platform" in the search bar. Then select and install it with the default options. I am installing Ansible Automation Platform 2.5.

  3. Once you have installed the operator, create a secret to access the Minio bucket:

    oc -n $HUB_NAMESPACE apply -f- <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: 'my-private-hub-s3'
stringData:
  s3-access-key-id: minio
  s3-secret-access-key: minio123
  s3-bucket-name: my-bucket-private-automation-hub
  s3-endpoint: https://minio-api-aap.apps.cluster-hh65q.hh65q.sandbox502.opentlc.com/
EOF
  4. Change the value of access-key, secret, bucket name, and endpoint with your actual values. The s3-endpoint should be the -api route, not the UI. You can find more details here.

  5. Now it's time to deploy the Ansible Automation Platform instance. I am using the following sample YAML for this purpose. Be sure to change the name of the secret.

    oc apply -f - <<EOF
apiVersion: aap.ansible.com/v1alpha1
kind: AnsibleAutomationPlatform
metadata:
  name: my-aap
  namespace: aap
spec:
  # Platform
  image_pull_policy: IfNotPresent
  # Components
  controller:
    disabled: false
  eda:
    disabled: false
  hub:
    disabled: false
    storage_type: S3
    object_storage_s3_secret: my-private-hub-s3
  lightspeed:
    disabled: true
EOF

    It will take 5 to 10 minutes to deploy. Learn more about the YAML. 

  6. Once deployment is complete, log in to the Ansible Automation Platform Gateway and apply the subscription.
  7. Navigate to the Automation Content section (Figure 6).
access automation hub
Figure 6: The Automation Content section is highlighted.

  1. Test the automation hub by pushing an image. Log in to the automation hub, tag an image, then push the image.

    kashekha@kashekha-thinkpadp1gen7:~$ podman login https://my-aap-aap.apps.cluster-hh65q.hh65q.sandbox502.opentlc.com
Username: admin
Password: 
Login Succeeded!
kashekha@kashekha-thinkpadp1gen7:~$ podman tag localhost/ee-supported-rhel9_caac_infra my-aap-aap.apps.cluster-hh65q.hh65q.sandbox502.opentlc.com/ee-supported-rhel9_caac_infra:latest
kashekha@kashekha-thinkpadp1gen7:~$ podman images |grep "my-aap-aap"
my-aap-aap.apps.cluster-hh65q.hh65q.sandbox502.opentlc.com/ee-supported-rhel9_caac_infra  latest      9d6efab8d315  4 weeks ago   1.53 GB
kashekha@kashekha-thinkpadp1gen7:~$ podman push my-aap-aap.apps.cluster-hh65q.hh65q.sandbox502.opentlc.com/ee-supported-rhel9_caac_infra:latest
Getting image source signatures
.
.

  2. Verify the image in the private automation hub.

    Now we'll use the image to create an execution environment (Automation Execution Section of Ansible Automation Platform).

  3. Create credentials for the private automation hub by navigating to Automation Execution -> Infrastructure -> Credentials.
  4. Create the execution environment (Figure 7).
create execution env on automation controller
Figure 7: Create the execution environment.
  1. Finally, run a job template with the execution environment. It will take a few minutes to pull the execution environment at first.

Wrap up

In this article, we explained how you can deploy the Minio object storage system on a Red Hat OpenShift environment to enable a fully self-contained, cloud-independent Ansible Automation Platform deployment.