AAP 2.6 OpenShift deployment verification and documentation improvements

.claude/skills

@@ -0,0 +1 @@
+../.cursor/skills

aap-deploy/README.md

@@ -83,9 +83,14 @@ Solid lines denote active production paths on Site 1. The dashed link is the sta
 
 Create an opaque `Secret` in the **AAP namespace** with keys expected by the AAP Operator for **unmanaged** PostgreSQL. See [`openshift/postgres-configuration-secret.example.yaml`](openshift/postgres-configuration-secret.example.yaml) for a structural template (replace all placeholders; do not commit real credentials).
 
-Reference the secret from the **`AutomationController`** (and any other component that uses Postgres, e.g. **Automation Hub**) via:
+Reference the secrets from the **`AnsibleAutomationPlatform`** parent CR:
 
-`spec.postgres_configuration_secret: <secret-name>`
+- Gateway: `spec.database.database_secret: <gateway-secret-name>`
+- Controller: `spec.controller.postgres_configuration_secret: <controller-secret-name>`
+- Hub: `spec.hub.postgres_configuration_secret: <hub-secret-name>`
+- EDA: `spec.eda.database.database_secret: <eda-secret-name>`
+
+See `openshift/ansibleautomationplatform.yaml` for the complete example.
 
 Exact CRD field names can vary slightly by AAP release; confirm in your version’s “Installing on OpenShift” / customization guide.
 

aap-deploy/openshift/postgres-configuration-secret.example.yaml

@@ -1,5 +1,10 @@
 # Example structure for an external (unmanaged) PostgreSQL secret used by the
-# Ansible Automation Platform operator (AutomationController / related CRs).
+# Ansible Automation Platform operator (AnsibleAutomationPlatform parent CR).
+# In AAP 2.6, secrets are referenced through the parent CR's spec fields:
+# - spec.database.database_secret (Gateway)
+# - spec.controller.postgres_configuration_secret (Controller)
+# - spec.hub.postgres_configuration_secret (Hub)
+# - spec.eda.database.database_secret (EDA)
 #
 # - Replace all REPLACE_* values; do not commit real credentials.
 # - Confirm key names and allowed sslmode values in Red Hat documentation for your AAP version.
@@ -19,6 +24,5 @@ stringData:
   username: aap_db_user
   password: aap_db_password
   sslmode: prefer
-  # Use read-write targeting when pointing at a primary; adjust if your topology requires it.
-  target_session_attrs: read-write
+  target_session_attrs: read-write  # Ensures connection to primary (not replica)
   type: unmanaged

aap-deploy/openshift/scripts/generate-postgres-secrets.sh

@@ -34,7 +34,7 @@ stringData:
   username: $PGUSER
   password: $PASS
   sslmode: $SSLMODE
-  target_session_attrs: read-write
+  target_session_attrs: read-write  # Ensures connection to primary (not replica)
   type: unmanaged
 ---
 EOF