Skip to content

AAP Migration

What to expect in the migration#

The migrations should go pretty fast -- DevEx will schedule AWX Organization cutover meetings on Zoom so the teams are there to validate that things are working as expected and ensure a quick transition. This should cover 95% of configuration in AWX/Tower, though anything stored in an encrypted field will need to be replaced by the customer, as we cannot access encrypted content.

What Devex will do#

DevEx will schedule AWX Organization cutovers with your team, likely in the first half of PI4. We have scripts that will copy your org's Azure Keyvault credential, any Source Control credentials, awx_user's Machine credential, Projects, Inventories, and Templates in AAP.

What teams will do#

Teams will need to validate their templates work from AAP and replace any credentials that were saved in AWX that couldn't be copied.

When we will be starting to move teams#

We will start in May and all AWX Organizations will be cut over by the end of the PI in July.

What you can do ahead of time to prepare#

In general, nothing is strictly necessary to do before you meet with us.

Some things you can consider doing to speed up migration are:

  • Identify of which credentials you have that are not pulling from an external secrets management (Azure Key Vault) and instead use local encryption. These secrets will need to be replaced by you.
  • Identify any useage of Surveys, Notifications, or Workflow Templates. These have required more adjustments post-migration and we can work through them during our meeting together.
  • Identify any important jobs or other features your team uses in AWX so they can be validated after the migration.
  • Update any firewalls to allow access from the new subnet, found in the #ansible-automation IT@UMN slack channel.

When AWX/Tower is going away#

Once all AWX Organizations have been onboarded to AAP, DevEx will disable any of the team's scheduled jobs and remove user access to tower.oit.umn.edu for a few months before decommissioning the underlying infrastructure.

What About Firewalls?#

AAP will be able to communicate with out-of-the-box HEAT provided RHEL 9 VMs right away. The new IP Range for AAP can be found in the channel topic in IT@UMN #ansible-automation channel.

Other considerations#