How to Install Ansible Tower AWX on Ubuntu 20 using Kubernetes(K3s)

 

How To Install Ansible AWX on Ubuntu 20.04|18.04

Welcome to today’s guide on how to install Ansible AWX on Ubuntu 20.04|18.04 with Nginx Reverse Proxy and optional Let’s Encrypt SSL Certificate. Ansible AWX is an open source tool which provides a web-based user interface, REST API, and task engine for easy and collaborative management of Ansible Playbooks and Inventories.

AWX allows you to centrally manage Ansible playbooks, inventories, Secrets, and scheduled jobs from a web interface. It is easy to install AWX on Ubuntu 20.04|18.04 (Bionic Beaver) Linux system. Use the steps shared below to install and configure Ansible AWX on Ubuntu 20.04|18.04 Linux server.

Starting in version 18.0 of AWX, the recommended installation method is via AWX Operator. As the operator installation method requires a Kubernetes Cluster, we will perform a single node Kubernetes installation on Ubuntu Linux using k3s.

Setup minimum requirements

• Ubuntu 20.04|18.04 LTS Server
• At least 8GB of RAM – More is better
• 4vcpus – Pump more if you have
• 10GB free disk storage
• root or user with sudo for ssh

Step 1: Update Ubuntu system

Update and upgrade your system

sudo apt update && sudo apt -y upgrade
sudo reboot

Step 2: Install Single Node k3s Kubernetes

We will deploy a single node kubernetes using k3s lightweight tool. K3s is a certified Kubernetes distribution designed for production workloads in unattended, resource-constrained environments. The good thing with k3s is that you can add more Worker nodes at later stage if need arises.

K3s provides an installation script that is a convenient way to install it as a service on systemd or openrc based systems

Let’s run the following command to install K3s on our Ubuntu system:

curl -sfL https://get.k3s.io | sudo bash -
sudo chmod 644 /etc/rancher/k3s/k3s.yaml

Installation process output:

[INFO]  Finding release for channel stable
[INFO]  Using v1.21.3+k3s1 as release
[INFO]  Downloading hash https://github.com/k3s-io/k3s/releases/download/v1.21.3+k3s1/sha256sum-amd64.txt
[INFO]  Downloading binary https://github.com/k3s-io/k3s/releases/download/v1.21.3+k3s1/k3s
[INFO]  Verifying binary download
[INFO]  Installing k3s to /usr/local/bin/k3s
[INFO]  Creating /usr/local/bin/kubectl symlink to k3s
[INFO]  Creating /usr/local/bin/crictl symlink to k3s
[INFO]  Creating /usr/local/bin/ctr symlink to k3s
[INFO]  Creating killall script /usr/local/bin/k3s-killall.sh
[INFO]  Creating uninstall script /usr/local/bin/k3s-uninstall.sh
[INFO]  env: Creating environment file /etc/systemd/system/k3s.service.env
[INFO]  systemd: Creating service file /etc/systemd/system/k3s.service
[INFO]  systemd: Enabling k3s unit
Created symlink /etc/systemd/system/multi-user.target.wants/k3s.service → /etc/systemd/system/k3s.service.
[INFO]  systemd: Starting k3s

Validate K3s installation:

The next step is to validate our installation of K3s using kubectl command which was installed and configured by installer script.

$ kubectl get nodes
NAME        STATUS   ROLES                  AGE   VERSION
ubuntu-01   Ready    control-plane,master   33s   v1.22.5+k3s1

You can also confirm Kubernetes version deployed using the following command:

$ kubectl version --short
Client Version: v1.22.5+k3s1
Server Version: v1.22.5+k3s1

The K3s service will be configured to automatically restart after node reboots or if the process crashes or is killed.

Step 3: Deploy AWX Operator on Kubernetes

This Kubernetes Operator has to be deployed in your Kubernetes cluster, which in our case is powered by K3s. The operator we’ll deploy can manage one or more AWX instances in any namespace.

Install git and make tools:

sudo apt update
sudo apt install git build-essential

 Install Helm

AWX operator uses Helm ecosystem.

curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

Verify:

helm version

---

✅ STEP 5 — Install AWX Operator

Create namespace:

kubectl create namespace awx

---

Install operator:

kubectl apply -f https://raw.githubusercontent.com/ansible/awx-operator/devel/deploy/awx-operator.yaml -n awx

Check operator:

kubectl get pods -n awx

Wait until:

awx-operator-controller-manager   Running

---

✅ STEP 6 — Deploy AWX Instance

Create config file:

vim awx.yaml

---

AWX Deployment Manifest

apiVersion: awx.ansible.com/v1beta1
kind: AWX
metadata:
  name: awx-demo
  namespace: awx
spec:
  service_type: nodeport

---

Apply deployment:

kubectl apply -f awx.yaml

---

✅ STEP 7 — Wait for Installation

This takes 5–10 minutes.

Monitor:

kubectl get pods -n awx

You should see:

awx-demo-web
awx-demo-task
postgres

All must be:

Running

---

✅ STEP 8 — Get AWX URL

Check service:

kubectl get svc -n awx

Example output:

awx-demo-service NodePort 80:30080

Access:

http://EC2-PUBLIC-IP:30080

🎉 AWX LOGIN PAGE appears.

---

✅ STEP 9 — Get Admin Password

Retrieve password:

kubectl get secret awx-demo-admin-password \
-n awx -o jsonpath="{.data.password}" | base64 --decode

---

Login:

Username: admin
Password: <output>

Ansible AWX web portal is now accessible on http://hostip_or_hostname:32000.

You are presented with the welcome dashboard similar to one below.

The login username is admin

The new AWX interface is beautifully designed with Love. It is a serious redesign with good polishing.

Review Kubernetes Node resources to ensure they are enough to run AWX:

$ kubectl top nodes --use-protocol-buffers
NAME     CPU(cores)   CPU%   MEMORY(bytes)   MEMORY%
ubuntu   102m         1%     2534Mi          15%

See Video installation Below Using

How to Install packages using Ansible Tower(AWX)(On Ubuntu)

 Step 1

We need a user account with sudo previlege. If you are using an ubuntu machine you can use ubuntu

You can also create a new user using https://violetstreamstechnology.blogspot.com/2020/10/how-to-create-new-user-in-ubuntu-18.html

For this lab we will use ubuntu user account. Please launch a target ec2 instance.  ubuntu 16.04

Step 2:

Create a password for ubuntu

i. Login to the target ec2 machine

ii. Switch to root 

sudo su

iii. Create password for ubuntu

passwd ubuntu

When prompted enter admin for the password

iv.  Create password for root user

passwd root

when prompted enter admin for the password

v. Make sure you enable password login Authentication:(skip this step if you have already done it)

See: https://violetstreamstechnology.blogspot.com/2020/11/how-to-enable-ssh-password.html

Step 3 : Create credentials for bitbucket and Target server

Log into your Ansible Tower Account

Create credentials for Bitbucket

Click Credentials ----"+"

Enter a Name(You can use any name of choice): Bitbucket

Enter Organization: Devops
Credential Type: Source Control

UserName: Your Bitbucket username

Password: Your Bitbucket Password

Then Save

Create Credential for Target server

Click Credentials ----"+"

Enter a Name(You can use any name of choice): Ubuntu

Enter Organization: Devops
Credential Type: machine

UserName: (Username to login to the target server) ubuntu

Password: (Password for the target server)admin

(Note: Make sure you create this user/pswd on the target server-see https://violetstreamstechnology.blogspot.com/2020/11/how-to-enable-ssh-password.html

https://violetstreamstechnology.blogspot.com/2020/10/how-to-create-new-user-in-ubuntu-18.html)

Scroll down---- Enter the parameters for Sudo/root user you will escalate to

• sudo
• su
• pbrun
• pfexec
• dzdo
• pmrun
• runas
• enable
• doas
• ksu
• machinectl
• sesu

PRIVILEGE ESCALATION USERNAME: root

PRIVILEGE ESCALATION METHOD 

sudo

PRIVILEGE ESCALATION PASSWORD

admin

Then Save

Step 4 : Create a new Project on Ansible Tower( Skip this step if you have created one before)

Click Projects ---- "+" to Add a new Project

You can use the ff details

Name: MyWebAppPackages

Organization: Select an Existing org(You can create one)for this lab i selected Devops

SCM TYPE: Select Git

SCM URL: Enter your bitbucket url

Branch: Enter your bitbucket branch - Ansible

SCM Credential: Select your Bitbucket Credential you created

Then Save

Step 5: Add Target Host to inventory----click Inventories----"+" select ---inventory

Enter Name: Apache(You can Name it anything)

         Organization: Devops(Select the organization you created)

          Save

Click on GROUPS(Here we can create group of hosts) ----"+" to add a group

Enter Name: Apache-Server

Description: Any description will do (See Screenshot below)

Save

After saving ----Click on Hosts (To Add your target host to the group) ----"+" select---- New Host

Enter 

HOST NAME:  IP of your Target Host

Save

Step 6: Add the playbook to your repo

---Go to your project on  your computer

---Open Git bash

---Go into the repo folder : cd myfirstrepo

---launch vscode : code .

----Create a New File

Copy the below Playbook and paste in the New file

---

- name: Playbook to install NGINX

hosts: "{{ deploy_host }}"

tasks:

- name: Ansible apt install Apache

apt:

name: apache2

state: present

Save it as apache.yml

Commit and push to your repo

Step 7: Refresh your project to load the new playbook

Step 8: Create a New Template----click Templates----"+"

Enter Name : Apache-Install

Job Type: Run

Inventory: Apache(Select the inventory you created)

PROJECT: MyWebAppPackages

PLAYBOOK: apache.yml(Select your playbook)

CREDENTIALS: ubuntu(Select the credentials you created)

VERBOSITY: Select 4

In EXTRA VARIABLES Add the deploy host(Specify the group server name or host ip)

deploy_host: Apache-Servers

Save then Launch

This will install Apache Server on your Target Host

Go to the Ip Address. Open port 80 and you should see Apache running

You can try these steps to install more packages with the following paybooks:

Remove Apache:

---

- name: Playbook to install APache

hosts: "{{ deploy_host }}"

tasks:

- name: Ansible apt install Apache

apt:

name: apache2

state: absent

Install Openssl-update cache

---

- name: Playbook to install NGINX

hosts: "{{ deploy_host }}"

tasks:

- name: Ansible apt install open ssl

apt:

name: openssl

state: present

update_cache: yes

Install Nginx

---

- name: Playbook to install NGINX

hosts: "{{ deploy_host }}"

tasks:

- name: Ansible apt install nginx

apt:

name: nginx

state: present

Install Jenkins

---

- name: Playbook to install Jenkins

hosts: "{{ deploy_host }}"

tasks:

- name: Install OpenJDK Java

become: yes

apt:

name: "{{ item }}"

state: present

with_items:

openjdk-8-jdk

- name: ensure the jenkins apt repository key is installed

apt_key: url=https://pkg.jenkins.io/debian-stable/jenkins.io.key state=present

become: yes

- name: ensure the repository is configured

apt_repository: repo='deb https://pkg.jenkins.io/debian-stable binary/' state=present

become: yes

- name: ensure jenkins is installed

apt: name=jenkins update_cache=yes

become: yes

- name: ensure jenkins is running

service: name=jenkins state=started

Install Tomcat

---

- name: Playbook to install TOMCAT

hosts: "{{ deploy_host }}"

tasks:

- name: Install Tomcat 9 on Ubuntu

become: yes

apt: pkg={{ item }} state=latest update_cache=yes cache_valid_time=3600

with_items:

- tomcat8

Install Maven

--- - name: Playbook to install MAVEN hosts: "{{ deploy_host }}" tasks: - name: Install Maven using Ansible become: yes apt: name: maven state: present

Install LAMP stack(ApcheMysqlPhp)

---

- name: Playbook to install Jenkins

hosts: "{{ deploy_host }}"

tasks:

- name: Install LAMP stack using Ansible

become: yes

apt:

name: "{{ packages }}"

state: present

vars:

packages:

- apache2

- mysql-server

- php

You can also download other Playbooks from the internet and use

How to use vault In Ansible Tower to Encrypt Credentials and sensitive data

 

Ansible Vault is a feature of ansible that allows you to keep sensitive data such as passwords or keys in encrypted files, rather than as plaintext in playbooks or roles. These vault files can then be distributed or placed in source control

Remember of previous tutorial on How to create EC2 instance with Ansible : https://violetstreamstechnology.blogspot.com/2020/09/how-to-create-ec2-instance-using.html

If you notice we had the aws_secret_key and aws_access_key placed as extra variables in Ansible Tower

This is not the best practice. Best practice is to encrypt the access_key and secret_key using Ansible vault to hide this sensitive data.

Lets do this to make our project comply with best practices:

Step 1:

Create a vault credential

Create the “Vault AWX” vault credential.

Left Menu (Credentials) > click [+] > Fill the form > click [SAVE]

Give name as  access_key: Any name will work

VAULT_PASSWORD:Give it any password you desire: For this tutorial you can use:admin123

Step 2: Encrypt the access_key and secret_key strings

step 2.1 :Log into the Ansible Tower machine

step 2.2: Use the below command:

ansible-vault encrypt_string "AKIAXR5FQWYQMB" --name "access_key"

Replace Highlighted green above with your access_key

You will be prompted for password. use admin123

You should get result like below:

Copy the encrypted output and save in a notepad(see eg below, copy text in green)

access_key: !vault |

          $ANSIBLE_VAULT;1.1;AES256

          32666533393238663538663035343932386637386562383830363963643163356537646161316565

          6631303132633362663138313334653531306230333866310a373866356135623732613765643234

          31643430313236306664376633356564343639376637323832323832313036346231353964336236

          6435313139666530380a316331633837376263613637623630633033343734333839326234396131

          30303933623736393735393762353863333262313431663130643235636663663236

If you get an error like

Error reading config file (/etc/ansible/ansible.cfg): File contains no section headers.

file: <???>, line:  9 

u'collections_paths = /home/ubuntu/.ansible/collections/ansible_collections\n'

open /etc/ansible/ansible.cfg  with vi editor and insert 

collections_paths = /home/ubuntu/.ansible/collections/ansible_collections  below [Default] header

$ sudo vi /etc/ansible/ansible.cfg

Then try again

Step 3: Repeat the same process for secret_key: we will use same password:admin123

Step 4: Go to your Playbook from previous exercise, Extra Variables And Paste the encrypted variable

---

- hosts: "{{ host }}"

gather_facts: true

vars:

access_key: YOUR_ACCESSKEY

secret_key: YOUR_SECRETKEY

tasks:

- name: Provision instance

ec2:

aws_access_key: "{{ access_key}}"

aws_secret_key: "{{ secret_key }}"

key_name: "{{ pem_key }}"

instance_type: t2.micro

image: ami-03657b56516ab7912

wait: yes

count: 1

region: us-east-2

Replace your accesskeys and secret keys variables with the encrypted string u copied from vault

New playbook should look like below:

---

- hosts: "{{ host }}"

gather_facts: true

vars:

access_key: !vault |

$ANSIBLE_VAULT;1.1;AES256

34376266633337386531356334323464633063633238356564623535653733346531663638393833

3439633230316565363365326436313063363865396565640a306136623863383365613231396166

64303062633561306338346364633132656435396166623361666534353730616365383134663532

3934363563613764310a313661643034666530663235316438336266663833323933343562306337

64343738633030346537386363653464616166343832616561336231313763616266

secret_key: !vault |

$ANSIBLE_VAULT;1.1;AES256

37333631633938653231633238353434373063663865666434343266383636346336343936643336

6338316330316461336365373165313163363432333630360a343334316665643336333762363665

62383035383534386238376363373339666531613262376239393466653234376330326138633239

6361646661323037640a306530663331616339343062333164366666343263383332333962643936

31316338653139633837303563396463313461343232396166346664376230316565376330356166

3436366138363430653838313064653563653731626539306664

tasks:

- name: Provision instance

ec2:

aws_access_key: "{{ access_key}}"

aws_secret_key: "{{ secret_key }}"

key_name: "{{ pem_key }}"

instance_type: t2.micro

image: ami-03657b56516ab7912

wait: yes

count: 1

region: us-east-2

Step 5: In Templates go to credentials Section

Select your Vault credentials for access_key

Save and run your template. The playbook will use the new encrypted variable