Ansible_awx

Ansible AWX / Automation Platform

Overview

Red Hat Ansible Automation Platform (formerly AWX) provides a web-based UI, REST API, and task engine for Ansible. It enables team collaboration, scheduling, and enterprise-scale automation.

Why AWX?

• Web UI: Visual interface for Ansible operations
• RBAC: Role-based access control for teams
• Scheduling: Schedule playbooks to run automatically
• Inventory Management: Centralized inventory management
• Credential Management: Secure credential storage
• Job History: Audit trail of all executions

Architecture

┌─────────────────────────────────────────────────────────────────┐
│                    AWX Architecture                                    │
│                                                                  │
│   ┌──────────────┐                                               │
│   │   Web UI     │    ┌──────────────┐                         │
│   │   REST API   │───▶│   PostgreSQL  │                        │
│   └──────────────┘    └──────┬───────┘                         │
│                              │                                    │
│   ┌──────────────┐           │                                    │
│   │    Redis     │◀──────────┤                                    │
│   │  (Celery)   │           ▼                                    │
│   └──────────────┘    ┌──────────────┐                         │
│                       │    Task      │                         │
│   ┌──────────────┐   │   Engine    │   ┌──────────────┐     │
│   │   Executor   │◀──│  (Workers)  │───▶│  Ansible     │     │
│   │   Nodes      │   └──────────────┘   │  Nodes       │     │
│   └──────────────┘                       └──────────────┘     │
└─────────────────────────────────────────────────────────────────┘

Installing AWX

Using Operator (Recommended for Kubernetes)

# Create namespace
kubectl create namespace awx

# Install AWX Operator
kubectl apply -f https://raw.githubusercontent.com/ansible/awx-operator/devel/config/samples/awx_v1alpha1_awx.yaml

# Create AWX instance
kubectl apply -f - <<EOF
apiVersion: awx.ansible.com/v1alpha1
kind: AWX
metadata:
  name: awx
  namespace: awx
spec:
  service_type: nodeport
  ingress_type: none
  replicas: 1
EOF

Using Docker Compose

# Clone AWX
git clone https://github.com/ansible/awx.git
cd awx/installer

# Edit inventory
vi inventory

# Run installer
ansible-playbook -i inventory install.yml

AWX Concepts

Projects

Projects connect AWX to your Git repositories containing playbooks:

# Project configuration
name: My Project
description: Playbooks for web application
scm_type: git
scm_url: https://github.com/username/playbooks.git
scm_branch: main
scm_credential: GitHub Credential
update_revision_on_launch: true

Inventories

Inventory sources in AWX:

# Inventory configuration
name: Production Inventory
description: Production servers
organization: Default
variables:
  ansible_user: admin
  ansible_ssh_private_key_file: /tmp/key

Inventories can be sourced from:

• Manual (static)
• AWS EC2
• Azure Resource Manager
• GCP Compute Engine
• VMware vCenter
• Red Hat Satellite
• Custom script

Credentials

Credential types in AWX:

# Machine credentials
- name: Production SSH
  credential_type: Machine
  username: admin
  password: <encrypted>
  ssh_key_data: <private key>

# Vault credentials
- name: Production Vault
  credential_type: Vault
  vault_password: <encrypted>

# Cloud credentials
- name: AWS Production
  credential_type: Amazon Web Services
  access_key: <key>
  secret_key: <secret>

Templates (Job Templates)

Job templates combine projects, inventories, and credentials:

name: Deploy Web App
description: Deploy web application to production
job_type: Run
project: My Project
playbook: deploy.yml
inventory: Production Inventory
credentials:
  - Production SSH
  - Production Vault
execution_environment: Custom EE
forks: 10
verbosity: Normal

Job Templates

Basic Job Template

name: Run Ad-hoc Command
description: Ping all hosts
job_type: Run
inventory: Development
project: My Project
playbook: ping.yml
credential: SSH Key

Survey (Prompt for Variables)

# Enable survey in job template
survey_enabled: true

# Survey specification
survey_spec:
  name: ""
  description: ""
  spec:
    - question: "Environment"
      type: "multiplechoice"
      choices:
        - dev
        - staging
        - prod
      required: true
    - question: "Version"
      type: "text"
      required: true

Schedule

# Job template schedule
schedule:
  name: Daily Deploy
  description: Deploy at midnight
  rrule: "FREQ=DAILY;INTERVAL=1;COUNT=100"
  tz: America/New_York

Workflows

Workflows orchestrate multiple job templates:

┌─────────────────────────────────────────────────────────────────┐
│                      Workflow Template                                │
│                                                                  │
│   ┌──────────┐                                                   │
│   │  Start   │                                                   │
│   └────┬─────┘                                                   │
│        │                                                         │
│        ▼                                                         │
│   ┌──────────┐                                                   │
│   │  Build   │───▶ Success                                       │
│   └────┬─────┘     │                                             │
│        │            │                                             │
│        ▼            ▼                                             │
│   ┌──────────┐  ┌──────────┐                                    │
│   │  Test    │  │  Failed  │                                    │
│   └────┬─────┘  └──────────┘                                    │
│        │                                                         │
│        ▼                                                         │
│   ┌──────────┐                                                   │
│   │ Deploy   │                                                   │
│   └────┬─────┘                                                   │
│        │                                                         │
│        ▼                                                         │
│   ┌──────────┐                                                   │
│   │  Notify  │                                                   │
│   └──────────┘                                                   │
└─────────────────────────────────────────────────────────────────┘

Workflow Template Example

name: CI/CD Pipeline
description: Build, test, and deploy
workflow_nodes:
  - unified_job_template:
      name: Build
      job_type: job
    success_nodes:
      - unified_job_template:
          name: Test
    failure_nodes:
      - unified_job_template:
          name: Notify Failure
  - unified_job_template:
      name: Test
    success_nodes:
      - unified_job_template:
          name: Deploy Staging
    failure_nodes:
      - unified_job_template:
          name: Notify Failure

RBAC (Role-Based Access Control)

Organizations

Organization
├── Teams
│   ├── DevOps
│   │   ├── Users
│   │   └── Roles
│   └── Developers
│       ├── Users
│       └── Roles
├── Inventories
├── Projects
└── Job Templates

Roles

• Admin: Full access
• Execute: Run jobs
• Read: View-only access
• Update: Edit resources
• Use: Use resources in jobs
• Approval: Approve workflow jobs

API Usage

Using the API

# Get token
curl -X POST https://awx.example.com/api/v2/tokens/ \
  -u admin:password \
  -H "Content-Type: application/json"

# List jobs
curl -X GET https://awx.example.com/api/v2/jobs/ \
  -H "Authorization: Bearer <token>"

# Launch job template
curl -X POST https://awx.example.com/api/v2/job_templates/1/launch/ \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"extra_vars": {"env": "prod"}}'

Python API Client

import awxkit

# Connect to AWX
api = awxkit.api.API('http://awx.example.com')
api.login('admin', 'password')

# Get job template
job_template = api.get_job_template(name='Deploy Web App')

# Launch job
job = job_template.launch(
    extra_vars={'env': 'prod', 'version': '1.0.0'}
)

# Wait for completion
job.wait_until_completed()

# Get results
print(job.status)
print(job.result_stdout)

Best Practices

1. Use Execution Environments

execution_environment.yml

version: 3
name: custom-ee
from: registry.example.com/ee-minimal-rhel8:latest

dependencies:
  python:
    - boto3
    - docker
    - kubernetes
  system:
    - git
    - kubectl

additional_build_files:
  - src: files/requirements.txt
    dest: requirements.txt

build_args:
  PYTHON_VERSION: "3.9"

2. Secure Credentials

• Use credential plugins for secrets
• Enable credential masking
• Rotate credentials regularly
• Use Vault for sensitive data

3. Implement RBAC

• Create teams per application
• Use least-privilege access
• Audit access regularly

4. Use Workflows

• Chain related jobs
• Add approval gates
• Implement error handling

Summary

Ansible AWX provides:

• Web UI: Visual management interface
• RBAC: Team-based access control
• Scheduling: Automated job execution
• Workflows: Orchestrate complex processes
• Auditing: Track all operations

Key concepts:

• Projects: Source control for playbooks
• Inventories: Target hosts
• Credentials: Authentication
• Job Templates: Run configurations
• Workflows: Multi-job orchestration