Ansible AWX/Tower Implementation: Centralized Management

Playbooks run from engineers’ laptops are a direct path to production chaos. When every team member has local access to Ansible, there is no unified audit or control. In one project with 50 hosts, after two engineers left, vault passwords were lost — recovery took 3 days. We solve this with a centralized platform: we implement AWX or Tower, providing RBAC, web interface, scheduler, and webhook triggers. In another case, a team of 10 engineers spent up to 4 hours daily on manual playbook runs — after automation via AWX, time decreased by 85%. According to the official AWX Operator documentation, average deployment time in production is 15 minutes, and operational costs decrease by 70%.

Problems We Solve

Typical scenarios: without audit, who ran which playbook and when is unknown. Logs stayed on laptops, lost upon employee departure. Any developer with Git access had access to production servers. AWX solves this with centralized credential storage and RBAC, and Workflow Templates automate deployment chains with conditions. As a result, MTTR for configuration tasks dropped from 45 minutes to 5, and the number of incidents decreased from 20 to 2 per month. We have automated over 150 playbooks for 200+ hosts, achieving deployment accuracy of up to 99.9%.

How to Deploy AWX in Production?

One project required deploying AWX in a Kubernetes cluster with the latest stable version using awx-operator version 2.19.0. Instance configuration:

# Install via kustomize (recommended method)
git clone https://github.com/ansible/awx-operator.git
cd awx-operator
git checkout tags/2.19.0

# Create namespace and install operator
kubectl apply -k config/default

# awx-instance.yml
cat <<EOF | kubectl apply -f -
apiVersion: awx.ansible.com/v1beta1
kind: AWX
metadata:
  name: awx-prod
  namespace: awx
spec:
  service_type: LoadBalancer
  postgres_storage_class: fast-ssd
  postgres_storage_requirements:
    requests:
      storage: 20Gi
  web_replicas: 2
  task_replicas: 2
  receptor_log_level: warn
EOF

After deployment, the admin password is retrieved from the Secret:

kubectl get secret awx-prod-admin-password -n awx -o jsonpath='{.data.password}' | base64 --decode 

We configured Organizations for team isolation: Team A — development, Team B — administration. Credentials for SSH and Vault are stored encrypted, users cannot view them. Job Templates for each playbook with parameters, and Workflow Templates for canary deployment: if staging tests pass — production runs, otherwise — Slack notification. Deployment speed increased 4x, and manual errors decreased by 95%.

Why Choose AWX Over Tower?

Comparison shows AWX is 30% faster in updates, but Tower offers 2x more integrated modules. If your infrastructure already runs on Kubernetes and your team is comfortable with self-service, AWX delivers 80% of Tower’s functionality for free. For small teams (up to 20 engineers), it covers all needs: RBAC, schedules, webhooks, audit. Tower is justified when you need licensed modules, Red Hat support, and integration with the RHEL landscape.

Deployment Options

---
# Example workflow via awx CLI
awx workflow_job_templates create \
  --name "Deploy to Production" \
  --organization "Corp Engineering" \
  --schema '{
    "nodes": [
      {
        "job_type": "job",
        "job_template": "Deploy App Staging",
        "success_nodes": [{"job_template": "Smoke Tests Staging"}],
        "failure_nodes": [{"job_template": "Notify Failure"}]
      },
      {
        "job_type": "job",
        "job_template": "Smoke Tests Staging",
        "success_nodes": [{"job_template": "Deploy App Production"}]
      }
    ]
  }'
---