# Deploying Enterprise AWX on K3s

* * *

# NetDevOps: Deploying Enterprise AWX on K3s

In the world of **NetDevOps**, moving from manual Ansible CLI execution to a centralized platform is a game-changer. **Ansible AWX** (the open-source version of Red Hat Ansible Automation Platform) provides the Web UI, RBAC, and API capabilities needed to scale network automation — like pushing mass firmware upgrades (e.g., Cisco IOS-XE 17.15.04b) across hundreds of devices.

However, deploying AWX on Kubernetes in certain regions (like Vietnam) often hits a major roadblock: the `ImagePullBackOff` error due to `gcr.io` (Google Container Registry) being throttled or blocked.

In this guide from **Hesti Networking Lab**, we will deploy AWX using the AWX Operator on **K3s** and implement a specific patch to bypass these network restrictions.

* * *

## 🏗️ 1. Infrastructure Preparation

To ensure stability for Ansible Execution Environments, we recommend using a full Virtual Machine (VM) rather than a container-based environment.

*   **OS:** Ubuntu 22.04 / 24.04 LTS
    
*   **Specs:** 4 vCPU, **8GB RAM (Minimum)**, 40GB+ Disk.
    
*   **Network:** Internet access and a static IP.
    

* * *

## 🚀 2. Step 1: Install K3s (The Foundation)

K3s is a highly available, certified Kubernetes distribution designed for production workloads in resource-constrained environments. It’s perfect for our NetDevOps Lab.

Run the following command to install K3s:

```shell
curl -sfL [https://get.k3s.io](https://get.k3s.io) | sh -
```

Configure permissions to run `kubectl` as your current user:

```shell
mkdir -p ~/.kube
sudo k3s kubectl config view --raw > ~/.kube/config
chmod 600 ~/.kube/config
```

Verify the node is ready:

```shell
kubectl get nodes
```

* * *

## ⚙️ 3. Step 2: The AWX Operator & GCR Fix

The "Standard" installation usually fails at this stage because the `kube-rbac-proxy` image is hosted on [`gcr.io`](http://gcr.io). We will fix this by patching the `kustomization.yaml` to pull from [`quay.io`](http://quay.io) instead.

Create a deployment directory:

```shell
mkdir ~/awx-deploy && cd ~/awx-deploy
```

Create `kustomization.yaml`:

```shell
nano kustomization.yaml
```

**Paste the following content:**

```yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  # Pull the AWX Operator (Version 2.19.1)
  - [github.com/ansible/awx-operator/config/default?ref=2.19.1](https://github.com/ansible/awx-operator/config/default?ref=2.19.1)

images:
  - name: quay.io/ansible/awx-operator
    newTag: 2.19.1
  # --- CRITICAL FIX FOR GCR.IO ISSUES ---
  - name: gcr.io/kubebuilder/kube-rbac-proxy
    newName: quay.io/brancz/kube-rbac-proxy
    newTag: v0.15.0

namespace: awx
```

Deploy the Operator:

```shell
kubectl apply -k .
```

```shell
kubectl get pods -n awx -w
```

Wait until you see `awx-operator-controller-manager` is **Running 2/2**.

* * *

## 🏗️ 4. Step 3: Deploy the AWX Instance

Now, we define the actual AWX application. We will use `nodeport` to make the web interface accessible via the VM's IP.

Create `awx-demo.yml`:

```shell
nano awx-demo.yml
```

**Paste the content:**

```yaml
---
apiVersion: [awx.ansible.com/v1beta1](https://awx.ansible.com/v1beta1)
kind: AWX
metadata:
  name: awx-demo
spec:
  service_type: nodeport
```

Update your `kustomization.yaml` to include this new resource:

```shell
nano kustomization.yaml
```

**Modify the resources section:**

```yaml
resources:
  - [github.com/ansible/awx-operator/config/default?ref=2.19.1](https://github.com/ansible/awx-operator/config/default?ref=2.19.1)
  - awx-demo.yml  # Add this line
```

Apply the final configuration:

```shell
kubectl apply -k .
```

* * *

## ⏳ 5. Step 4: Verification & Login

It will take 5-10 minutes for the Operator to pull the Postgres, Redis, Task, and Web images. Monitor the progress:

```bash
watch kubectl get pods -n awx
```

### Harvest the Rewards:

Once the `awx-demo-task` is **4/4 Running** and `awx-demo-web` is **3/3 Running**, you are ready.

**1\. Get the Web Access Port:**

```plaintext
kubectl get svc awx-demo-service -n awx
```

*Identify the Port mapped to 80 (e.g.,* `80:31213/TCP`*). Access it via* `http://<VM_IP>:31213`*.*

**2\. Retrieve the Admin Password:**

```plaintext
kubectl get secret awx-demo-admin-password -n awx -o jsonpath="{.data.password}" | base64 --decode ; echo
```

**Login:**

*   **Username:** `admin`
    
*   **Password:** (The string retrieved above)
    

* * *

## 🎯 Summary

By implementing a simple image patch, we bypassed regional network restrictions and successfully deployed a production-grade AWX instance on K3s. This setup is the perfect "Command Center" for any NetDevOps engineer looking to automate enterprise infrastructure.

Happy Automating!