# AWX — tsys-awx.knel.net

Ansible AWX deployment on a dedicated k3s single-node VM.

**[→ Deployment Plan](DEPLOYMENT.md)** · **[→ Status](../../STATUS.md)**

## Access

| | |
|---|---|
| URL | `http://tsys-awx.knel.net` (LAN) or `http://100.91.39.53` (Tailscale) |
| Port | 80 (LoadBalancer via k3s ServiceLB) |
| User | `admin` |
| Password | `REDACTED_PASSWORD` (fleet standard) |

## Architecture

```
tsys-awx (VMID 600 on pfv-tsys6)
├── k3s v1.36.2+k3s1 (single-node, no Traefik)
├── AWX Operator 2.19.1 (manages the AWX lifecycle)
└── AWX instance "tsys-awx"
    ├── AWX web (UI/API)
    ├── AWX task (Celery workers)
    ├── PostgreSQL 15 (bundled, 8 GiB PVC on local-path)
    ├── Redis (ephemeral)
    └── ServiceLB (binds port 80 to host IP)
```

## VM Resources

| Resource | Value |
|----------|-------|
| Host | pfv-tsys6 (2× Xeon E5530, 126 GB RAM) |
| vCPU | 4 (2 sockets × 2 cores) |
| RAM | 12 GB |
| Disk | 60 GB (D5 on tsys4 NFS) |
| OS | Debian 13 trixie |
| Network | 192.168.3.200 (LAN), 100.91.39.53 (Tailscale) |

## Files

| File | Purpose |
|------|---------|
| [`install-k3s.sh`](install-k3s.sh) | Install k3s single-node (no Traefik) |
| [`deploy-awx.sh`](deploy-awx.sh) | Deploy AWX Operator 2.19.1 + AWX instance |
| [`verify-awx.sh`](verify-awx.sh) | Verify deployment status + access |
| [`namespace.yaml`](namespace.yaml) | Kubernetes namespace manifest |
| [`awx-instance.yaml`](awx-instance.yaml) | AWX Custom Resource (CR) manifest |

## Deployment (from scratch)

```bash
# 1. Push scripts to VM
for f in awx/install-k3s.sh awx/deploy-awx.sh awx/verify-awx.sh \
         awx/namespace.yaml awx/awx-instance.yaml; do
    VM_IP=100.91.39.53 VM_USER=localuser bash tests/remote.sh vm \
        "sudo tee /tmp/awx/$(basename $f) > /dev/null" < "$f"
done

# 2. Install k3s
VM_IP=100.91.39.53 VM_USER=localuser bash tests/remote.sh vm \
    "sudo bash /tmp/awx/install-k3s.sh"

# 3. Deploy AWX
VM_IP=100.91.39.53 VM_USER=localuser bash tests/remote.sh vm \
    "sudo bash /tmp/awx/deploy-awx.sh"

# 4. Verify
VM_IP=100.91.39.53 VM_USER=localuser bash tests/remote.sh vm \
    "bash /tmp/awx/verify-awx.sh"
```

## Operating

```bash
# kubectl access
sudo k3s kubectl -n awx get pods
sudo k3s kubectl -n awx logs -f deployment/awx-operator-controller-manager

# Restart AWX instance
sudo k3s kubectl -n awx delete awx tsys-awx  # operator will recreate

# Get admin password
sudo k3s kubectl -n awx get secret awx-admin-password -o jsonpath='{.data.password}' | base64 -d
```

## Known Issues

1. **kube-rbac-proxy image**: The AWX Operator 2.19.1 references
   `gcr.io/kubebuilder/kube-rbac-proxy:v0.15.0` which was removed from GCR.
   The deploy script patches this to `quay.io/brancz/kube-rbac-proxy:v0.15.0`.
2. **Image pulls are slow**: First deployment pulls ~2 GB of container images.
   Postgres image alone is ~400 MB and takes several minutes.
3. **Disk space**: AWX + k3s uses ~10 GB of the 60 GB disk. PostgreSQL data
   grows over time — monitor `df -h /`.