This guide covers the layout and day-two configuration of the CloudSOE AWX image on both AWS and Azure. It assumes you’ve finished one of the getting-started guides (AWS, Azure).
File locations
| Path | Purpose |
|---|---|
/opt/default-awx-login.txt | Generated admin credentials (mode 600) |
~/.kube/config | kubectl config for the admin user (copied from k3s) |
/mnt/awx-storage/postgresql | AWX PostgreSQL data (10 Gi persistent volume) |
/mnt/awx-storage/playbooks | Project/playbook persistent storage (5 Gi) |
/var/lib/awx-bootstrap.status | Live first-boot progress (percent and message) |
/var/lib/awx-firstboot.done | Marker that first boot completed |
/usr/local/bin/awx-bootstrap-status | Re-runnable live progress display |
The Kubernetes stack
AWX runs on single-node k3s, deployed by the AWX Operator (Helm chart, pinned to a version tested with AWX 24). Both kubectl and helm are on the box:
kubectl get pods # awx-web, awx-task, awx-postgres-15, operator
kubectl get awx awx -o yaml # the AWX custom resource driving the deployment
sudo systemctl status k3s # the cluster itselfThe AWX pods live in the default namespace. The rollout manifests used at first boot are deleted once bootstrap completes — the running configuration lives in the awx custom resource.
Changing the admin password
The first-boot password (from /opt/default-awx-login.txt) should be rotated once you’re in. Either use the web portal (Access → Users → admin → Edit), or from the shell:
TASK_POD=$(kubectl get pods | grep awx-task | cut -d " " -f1)
kubectl exec -it "$TASK_POD" -- awx-manage update_password --username=admin --password='<new-password>'Update or delete the credentials file afterwards so it doesn’t hold a stale secret.
The web portal port
AWX is exposed as a Kubernetes NodePort on 30300. To move it, edit the AWX custom resource and change nodeport_port:
kubectl edit awx awxThe operator reconciles the change automatically. Remember to update your security group / NSG rule to match.
Persistent storage
PostgreSQL data and project content are backed by local persistent volumes under /mnt/awx-storage. They survive pod restarts and reboots, and they’re what you need to protect in backups — see tips & tricks.
If you grow the instance’s disk, the volumes grow with the filesystem; no Kubernetes changes needed for local storage.
Putting AWX behind HTTPS
The image serves plain HTTP on port 30300. For production, terminate TLS in front of it:
- AWS: an Application Load Balancer with an ACM certificate, forwarding to the instance on port 30300.
- Azure: Application Gateway with your certificate, backend pool pointing at the VM on port 30300.
Lock the security group / NSG down so port 30300 only accepts traffic from the load balancer once it’s in place.
Adding execution environments
The image ships with the AWX EE images pre-pulled. Additional execution environments can be registered in the portal (Administration → Execution Environments) — k3s pulls them from the registry you specify on first use.
Next steps
- Tips & tricks — backups, troubleshooting first boot and sizing advice