feat(awx): deploy AWX 24.6.1 on tsys-awx via k3s + AWX Operator

AWX (Ansible automation controller) deployed on tsys-awx.knel.net (VMID 600
on pfv-tsys6). Accessible at http://tsys-awx.knel.net:80 (admin/REDACTED_PASSWORD).

Deployment details:
- k3s v1.36.2 single-node (no Traefik) on Debian 13 trixie
- AWX Operator 2.19.1 + AWX CR (LoadBalancer service via k3s ServiceLB)
- PostgreSQL 15 bundled (8 GiB PVC on local-path provisioner)
- VM disk resized 32->60 GB; swap partition converted to swapfile
- Fixed kube-rbac-proxy image (gcr.io removed -> quay.io/brancz replacement)
- Fixed AWX CR field names (postgres_data_volume_size ->
  postgres_storage_requirements)

Scripts: awx/install-k3s.sh, awx/deploy-awx.sh, awx/verify-awx.sh
Manifests: awx/awx-instance.yaml, awx/namespace.yaml
Docs: awx/README.md

All pods running: operator 2/2, postgres 1/1, web 3/3, task 4/4.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

awx/deploy-awx.sh

@@ -38,12 +38,28 @@ git clone --branch "${OPERATOR_VERSION}" --depth 1 \
     "https://github.com/ansible/awx-operator.git" "${OPERATOR_DIR}" 2>&1 | tail -3
 
 # The operator's default namespace is 'awx' — matches our setup
-# Apply the operator via kustomize
-kubectl apply -k "${OPERATOR_DIR}" 2>&1 || {
+# Apply the operator via kustomize (config/default has the full manifest set)
+kubectl apply -k "${OPERATOR_DIR}/config/default" 2>&1 || {
     echo "kustomize apply failed, trying raw manifests..."
     kubectl apply -f "https://raw.githubusercontent.com/ansible/awx-operator/${OPERATOR_VERSION}/deploy/awx-operator.yaml"
 }
 
+# Fix kube-rbac-proxy image (gcr.io/kubebuilder/kube-rbac-proxy was removed;
+# quay.io/brancz/kube-rbac-proxy is the maintained replacement)
+echo ""
+echo "=== Patching kube-rbac-proxy image ==="
+kubectl set image deployment/awx-operator-controller-manager -n awx \
+    kube-rbac-proxy=quay.io/brancz/kube-rbac-proxy:v0.15.0 2>&1 || true
+
+# Scale down any old replicasets that still reference the broken image
+for rs in $(kubectl -n awx get rs -l control-plane=controller-manager -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null); do
+    img=$(kubectl -n awx get rs "${rs}" -o jsonpath='{.spec.template.spec.containers[?(@.name=="kube-rbac-proxy")].image}' 2>/dev/null)
+    if [[ "${img}" == *"gcr.io/kubebuilder"* ]]; then
+        echo "Scaling down old RS ${rs} (has broken gcr.io image)"
+        kubectl -n awx scale rs "${rs}" --replicas=0 2>&1
+    fi
+done
+
 echo ""
 echo "Waiting for AWX Operator deployment to be ready..."
 kubectl -n awx wait --for=condition=Available deployment/awx-operator-controller-manager \