Organizations

In Tower, Organizations allow you to segment everything in hermetic compartments. In our setup, Organizations are automatically created by our LDAP + SAML configuration. There is a direct link between LDAP groups and AWX groups. Organizations in AWX don't necessarily have the same ID as their counterpart in Tower, we needed to change them during reimport (sed was our friend). This is true for each object you import in AWX.

Inventories

Inventories contain Ansible hosts and groups. Usually hosts are divided by environment (test, production, …) and/or similarity (application, geography, …).

Inventories were imported using the addInventory function over a text list.

Credential types

If you need special credential types, for example for your own sites and applications, you have to reimport them first.

Credentials

We didn't want to restore user passwords, so we mostly focus on system credentials (ESX, network devices, Git, …).

We used the exportAll function to get all credentials as a JSON file. We filtered them using jq (see README) and used the importAll function to import them in AWX.

Projects

Each project is linked to a Git repository and a specific branch. We reimported them using the same method we used for the credentials.

Hosts, groups and variables

Ansible Tower is shipped with an excellent inventory export function. We use it in the function exportAnsibleInventory, it's only 20 lines of code! You can quickly obtain a beautiful JSON with all your hosts, their groups, and the most important part, all the variables you have saved in the inventory.

The tricky part is to reimport everything. In fact, it's not directly possible from the interface nor the API. You have to build a custom inventory script from the JSON file you recover.

The simplest method is to use a bash script:

#!/bin/bash
if [ "$1" == "--list" ] ; then
cat << "EOF"
{
    JSONFILE EXPORTED
}
EOF
elif [ "$1" == "--host" ]; then
  echo '{"_meta": {"hostvars": {}}}'
else
  echo "{ }"
fi

You add this script in the "Inventory Scripts" section, "New Custom Inventory". Next, you can configure an inventory to use this script in the "Sources" menu directly in the "Inventories" section.

It will import everything, hosts, groups and vars, after the first sync.

The fun part is when you want to unlink your inventory and your custom script: that's not possible. If you remove the custom script, it deletes everything with it.

The only solution we found was to update the database manually:

UPDATE main_group
   SET has_inventory_sources = 'f' WHERE has_inventory_sources = 't';
UPDATE main_host
   SET has_inventory_sources = 'f' WHERE has_inventory_sources = 't';

TRUNCATE TABLE main_group_inventory_sources;
TRUNCATE TABLE main_host_inventory_sources;

After this, you can remove the source of the inventory, using the web UI, without also losing all hosts and groups.

Two things to know after the import:

• Groups without members are not exported. You can have a list of these groups using the getLonelyGroups function, if you want to reimport them later.
• All new hosts are activated. If you want to keep your disabled hosts that way, you can export them using function exportAll disabledHosts and import the change using massChangeHostStatus

Job templates

Job templates are launch configurations and surveys for a role or playbook. It allows administrators to limit and configure the way a role is used.

You can use exportAllJobTemplates and importJobTemplates functions to automatically manage this part. awx-cli exports surveys, schedules and extra credentials.

The ugly

• When we updated Ansible Tower, we usually took a lot of caution. Each version fixed bugs, but most also came with new ones. AWX is worse on this. We encountered a lot of bugs, some of them simply prevented us from using the software. For example, this inventory GitHub issue. The sad part was that the fix had been developed, but it was released a week later during a scheduled merge. In the meantime, we had to wait.
• This upgrade issue is also a good example. AWX developers regularly modify old Django migrations! We managed to do it anyway by playing with SQL, but you need to understand these 4 facts if you plan to use AWX:

1. There is no guarantee that AWX works. As said by maintainers, "AWX is not a product; it's a project. The supported product is Ansible Tower."
2. AWX is not a community edition of Ansible Tower.
3. Data migration is not supported between versions. You are supposed to start from scratch and import the data back (that's not the way we proceeded, but it's not officialy supported).
4. AWX GitHub repository isn't used by the developers during development. They merge all changes periodically from a private repository downstream.

EDIT: In this issue, one of AWX developer write the following statement:

The AWX development team is aware of the pain related to upgrades, and we're committed to making the process much smoother in the near future by versioning appropriately and using migrations to bridge the gap from one version to another whenever possible.

This is awesome, and we are looking forward for the next updates.

The bad

• AWX isn't very stable. We have to restart the awx_task container every once in a while because job real time display stopped working.
• AWX JavaScript will eat all of your CPU and turn your laptop into a toaster. (EDIT: The new AWX 1.0.7 is a LOT better on this, yeaah!)

The good

• I don't know how Ansible Tower looks like right now, but when we switched (2018-04-19), AWX was way better. You could open most pages in new tabs, use search filters that almost work as expected, and the web UI was a little bit easier to use.
• We took advantage of the migration to reset all user access and permissions. We even plugged AWX to our SAML SSO.
• Lots of little new features and a clear improvement in performance.