Merge pull request #500 from shanemcd/0.13.0

Bump versions / OLM metadata

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,39 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+##### ISSUE TYPE
+ - Bug Report
+
+##### SUMMARY
+<!-- Briefly describe the problem. -->
+
+##### ENVIRONMENT
+* AWX version: X.Y.Z
+* Operator version: X.Y.Z
+* Kubernetes version: 
+* AWX install method: openshift, minishift, docker on linux, docker for mac, boot2docker
+
+##### STEPS TO REPRODUCE
+
+<!-- Please describe exactly how to reproduce the problem. -->
+
+##### EXPECTED RESULTS
+
+<!-- What did you expect to happen when running the steps above? -->
+
+##### ACTUAL RESULTS
+
+<!-- What actually happened? -->
+
+##### ADDITIONAL INFORMATION
+
+<!-- Include any links to sosreport, database dumps, screenshots or other
+information. -->
+
+##### AWX-OPERATOR LOGS

.github/workflows/ci.yaml

@@ -31,14 +31,21 @@ jobs:
             ansible-lint \
             openshift \
             jmespath \
-            ansible
+            ansible-core
 
       - name: Install Collections
         run: |
-         ansible-galaxy collection install community.kubernetes operator_sdk.util
+         ansible-galaxy collection install community.general kubernetes.core:1.2.1 operator_sdk.util
+
+      - name: Setup Minikube
+        uses: manusa/actions-setup-minikube@v2.4.2
+        with:
+          minikube version: 'v1.16.0'
+          kubernetes version: 'v1.19.2'
+          github token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run Molecule
         env:
           MOLECULE_VERBOSITY: 3
         run: |
-          molecule test -s test-local
+          molecule test -s test-minikube

CHANGELOG.md

@@ -0,0 +1,37 @@
+# Changelog
+
+This is a list of high-level changes for each release of `awx-operator`. A full list of commits can be found at `https://github.com/ansible/awx-operator/releases/tag/<version>`.
+
+# 0.10.0 (Jun 1, 2021)
+
+- Make tower_ingress_type to respect ClusterIP definition (Marcelo Moreira de Mello) - e37c091 (breaking_change)
+- Add ability to get/create/delete secrets for the awx service account (Christian M. Adams) - 61b3cb4
+- Added ability to specify annotations to ServiceAccount (Marcelo Moreira de Mello) - 446ac0b
+- Do not shadow other variables (Yanis Guenane) - 223fe98
+- Do not prepend variables name with tower_ (Yanis Guenane) - 75458d0 (breaking_change)
+- Fully remove finalizer (Christian M. Adams) - fd92050
+- Use custom pg_dump format for faster restores (Christian M. Adams) - f16d9ac
+- Allow user to specify empty string for storage class on PVC (Christian M. Adams) - 818b837
+- Unset ownerRefs in the installer instead of the finalizer (Christian M. Adams) - c12a1f0
+- Make awx-operator compatible with Ansible 2.12 (Alan Rominger) - 5216489
+- Restore: set proper kind var after deploying AWX CR (Julen Landa Alustiza) - fc4687f
+- Add support for custom service labels (Jeremy Kimber) - fd42802
+- Rename product specific variable names (Christian M. Adams) - 5ae3636 (breaking_change)
+- Add watcher for backup CR (Christian M. Adams) - fdcc745
+
+# 0.9.0 (May 1, 2021)
+
+- Update playbook to allow for deploying custom image version/tag (Shane McDonald) - 77e7039 
+- Mounts /var/lib/awx/projects on awx-web container (Marcelo Moreira de Mello) - f21ec4d 
+- Extra Settings: Allow one to pass extra API configuration settings. (Yanis Guenane) - 1d14ebc 
+- PostgreSQL: Properly handle variable name difference when using Red Hat containers (Yanis Guenane) - 2965a90 
+- Deployment type: Make more fields dynamic based on that field (Yanis Guenane) - 4706aa9 
+- Add templated EE volume mount var to operator config (Christian M. Adams) - e55d83f 
+- Add NodePort to tower_ingress_type enum (TheStally) - 96b878f 
+- Split container image and version in 2 variables (Marcelo Moreira de Mello) - bc34758 (breaking_change)
+- Handles deleting and recreating statefulset and deployment when needed (Marcelo Moreira de Mello) - 597356f 
+- Add tower_ingress_type NodePort (stal) - 1b87616 
+- expose settings to use custom volumes and volume mounts (Gabe Muniz) - 8d65b84 
+- Inherit imagePullPolicy to redis container (Marcelo Moreira de Mello) - 83a85d1 
+- Add nodeSelector and tolerations for Postgres pod (Ernesto Pérez) - 151ff11 
+- Added support to override pg_sslmode (Marcelo Moreira de Mello) - 298d39c 

CONTRIBUTING.md

@@ -0,0 +1,140 @@
+# AWX-Operator Contributing Guidelines
+
+Hi there! We're excited to have you as a contributor.
+
+Have questions about this document or anything not covered here? Please file a new at [https://github.com/ansible/awx-operator/issues](https://github.com/ansible/awx-operator/issues).
+
+## Table of contents
+
+* [Things to know prior to submitting code](#things-to-know-prior-to-submitting-code)
+* [Submmiting your Work](#submitting-your-work)
+* [Testing](#testing)
+    * [Testing in Docker](#testing-in-docker)
+    * [Testing in Minikube](#testing-in-minikube)
+* [Generating a bundle](#generating-a-bundle)
+* [Reporting Issues](#reporting-issues)
+
+
+## Things to know prior to submitting code
+
+- All code submissions are done through pull requests against the `devel` branch.
+- All PRs must have a single commit. Make sure to `squash` any changes into a single commit.
+- Take care to make sure no merge commits are in the submission, and use `git rebase` vs `git merge` for this reason.
+- If collaborating with someone else on the same branch, consider using `--force-with-lease` instead of `--force`. This will prevent you from accidentally overwriting commits pushed by someone else. For more information, see https://git-scm.com/docs/git-push#git-push---force-with-leaseltrefnamegt
+- We ask all of our community members and contributors to adhere to the [Ansible code of conduct](http://docs.ansible.com/ansible/latest/community/code_of_conduct.html). If you have questions, or need assistance, please reach out to our community team at [codeofconduct@ansible.com](mailto:codeofconduct@ansible.com)
+
+
+## Submmiting your work
+1. From your fork `devel` branch, create a new brach to stage your changes.
+```sh
+#> git checkout -b <branch-name>
+```
+2. Make your changes.
+3. Test your changes according described on the Testing section.
+4. If everylooks looks correct, commit your changes.
+```sh
+#> git add <FILES>
+#> git commit -m "My message here"
+```
+5. Create your [pull request](https://github.com/ansible/awx-operator/pulls)
+
+**Note**: If you have multiple commits, make sure to `squash` your commits into a single commit which will facilitate our release process.
+
+
+
+## Testing
+
+This Operator includes a [Molecule](https://molecule.readthedocs.io/en/stable/)-based test environment, which can be executed standalone in Docker (e.g. in CI or in a single Docker container anywhere), or inside any kind of Kubernetes cluster (e.g. Minikube).
+
+You need to make sure you have Molecule installed before running the following commands. You can install Molecule with:
+
+```sh
+#> pip install 'molecule[docker]'
+```
+
+Running `molecule test` sets up a clean environment, builds the operator, runs all configured tests on an example operator instance, then tears down the environment (at least in the case of Docker).
+
+If you want to actively develop the operator, use `molecule converge`, which does everything but tear down the environment at the end.
+
+#### Testing in Docker
+
+```sh
+#> molecule test -s test-local
+```
+
+This environment is meant for headless testing (e.g. in a CI environment, or when making smaller changes which don't need to be verified through a web interface). It is difficult to test things like AWX's web UI or to connect other applications on your local machine to the services running inside the cluster, since it is inside a Docker container with no static IP address.
+
+#### Testing in Minikube
+
+```sh
+#> minikube start --memory 8g --cpus 4
+#> minikube addons enable ingress
+#> molecule test -s test-minikube
+```
+
+[Minikube](https://kubernetes.io/docs/tasks/tools/install-minikube/) is a more full-featured test environment running inside a full VM on your computer, with an assigned IP address. This makes it easier to test things like NodePort services and Ingress from outside the Kubernetes cluster (e.g. in a browser on your computer).
+
+Once the operator is deployed, you can visit the AWX UI in your browser by following these steps:
+
+  1. Make sure you have an entry like `IP_ADDRESS  example-awx.test` in your `/etc/hosts` file. (Get the IP address with `minikube ip`.)
+  2. Visit `http://example-awx.test/` in your browser. (Default admin login is `test`/`changeme`.)
+
+Alternatively, you can also update the service `awx-service` in your namespace to use the type `NodePort` and use following command to get the URL to access your AWX instance:
+
+```sh
+#> minikube service <serviceName> -n <namespaceName> --url
+```
+
+## Generating a bundle
+
+> :warning: operator-sdk version 0.19.4 is needed to run the following commands
+
+If one has the Operator Lifecycle Manager (OLM) installed, the following steps is the process to generate the bundle that would nicely display in the OLM interface.
+
+At the root of this directory:
+
+1. Build and publish the operator
+
+```
+#> operator-sdk build registry.example.com/ansible/awx-operator:mytag
+#> podman push registry.example.com/ansible/awx-operator:mytag
+```
+
+2. Build and publish the bundle
+
+```
+#> podman build . -f bundle.Dockerfile -t registry.example.com/ansible/awx-operator-bundle:mytag
+#> podman push registry.example.com/ansible/awx-operator-bundle:mytag
+```
+
+3. Build and publish an index with your bundle in it
+
+```
+#> opm index add --bundles registry.example.com/ansible/awx-operator-bundle:mytag --tag registry.example.com/ansible/awx-operator-catalog:mytag
+#> podman push registry.example.com/ansible/awx-operator-catalog:mytag
+```
+
+4. In your Kubernetes create a new CatalogSource pointing to `registry.example.com/ansible/awx-operator-catalog:mytag`
+
+```
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: CatalogSource
+metadata:
+  name: <catalogsource-name>
+  namespace: <namespace>
+spec:
+  displayName: 'myoperatorhub'
+  image: registry.example.com/ansible/awx-operator-catalog:mytag
+  publisher: 'myoperatorhub'
+  sourceType: grpc
+```
+
+Applying this template will do it. Once the CatalogSource is in a READY state, the bundle should be available on the OperatorHub tab (as part of the custom CatalogSource that just got added)
+
+5. Enjoy
+
+
+## Reporting Issues
+
+We welcome your feedback, and encourage you to file an issue when you run into a problem.

ansible/build-and-push.yml

@@ -3,15 +3,15 @@
   hosts: localhost
 
   collections:
-    - community.general
+    - community.docker
 
   tasks:
     - name: Build and (optionally) push operator image
       docker_image:
         name: "{{ operator_image }}:{{ operator_version }}"
-        pull: no
-        push: "{{ push_image | bool }}"
+        source: "build"
+        push: "{{ push_image }}"
         build:
           dockerfile: "build/Dockerfile"
           path: "../"
-        force: yes
+        force_source: "yes"

ansible/chain-operator-files.yml

@@ -6,12 +6,24 @@
   gather_facts: false
 
   tasks:
-    - name: Template CRD
+    - name: Template AWX CRD
       template:
         src: crd.yml.j2
         dest: "{{ playbook_dir }}/../deploy/crds/awx_v1beta1_crd.yaml"
         mode: '0644'
 
+    - name: Template AWXBackup CRD
+      template:
+        src: awxbackup_crd.yml.j2
+        dest: "{{ playbook_dir }}/../deploy/crds/awxbackup_v1beta1_crd.yaml"
+        mode: '0644'
+
+    - name: Template AWXRestore CRD
+      template:
+        src: awxrestore_crd.yml.j2
+        dest: "{{ playbook_dir }}/../deploy/crds/awxrestore_v1beta1_crd.yaml"
+        mode: '0644'
+
     - name: Template awx-operator.yaml
       template:
         src: awx-operator.yaml.j2

ansible/deploy-operator.yml

@@ -1,6 +1,6 @@
 ---
 - name: Reconstruct awx-operator.yaml
-  include: chain-operator-files.yml
+  import_playbook: chain-operator-files.yml
 
 - name: Deploy Operator
   hosts: localhost
@@ -9,7 +9,7 @@
     obliterate: no
 
   collections:
-    - community.kubernetes
+    - kubernetes.core
 
   tasks:
     - name: Obliterate Operator

ansible/group_vars/all

@@ -1,3 +1,4 @@
 operator_image: quay.io/ansible/awx-operator
-operator_version: 0.9.0
+operator_version: 0.13.0
 pull_policy: Always
+ansible_debug_logs: "false"

ansible/instantiate-awx-deployment.yml

@@ -3,13 +3,13 @@
   hosts: localhost
 
   collections:
-    - community.kubernetes
+    - kubernetes.core
 
   tasks:
     - name: Deploy AWX
       k8s:
         state: "{{ state | default('present') }}"
-        namespace: "{{ tower_namespace | default('default') }}"
+        namespace: "{{ namespace | default('default') }}"
         apply: yes
         wait: yes
         definition:
@@ -18,13 +18,14 @@
           metadata:
             name: awx
           spec:
-            tower_admin_user: admin
-            tower_admin_email: admin@localhost
-            tower_ingress_type: "{{ tower_ingress_type | default(omit) }}"  # Either Route, Ingress or LoadBalancer
-            tower_image: "{{ tower_image | default(omit) }}"
-            tower_image_version: "{{ tower_image_version | default(omit) }}"
+            admin_user: admin
+            admin_email: admin@localhost
+            service_type: "{{ service_type | default(omit) }}"  # Either clusterIP, Loadbalancer or NodePort
+            ingress_type: "{{ ingress_type | default(omit) }}"  # Either none, Ingress, Route
+            image: "{{ image | default(omit) }}"
+            image_version: "{{ image_version | default(omit) }}"
             development_mode: "{{ development_mode | default(omit) | bool }}"
-            tower_image_pull_policy: "{{ tower_image_pull_policy | default(omit) }}"
-            # tower_ee_images:
+            image_pull_policy: "{{ image_pull_policy | default(omit) }}"
+            # ee_images:
             #   - name: test-ee
             #     image: quay.io/<user>/awx-ee

ansible/templates/awx-operator.yaml.j2

@@ -3,6 +3,10 @@
 # Update templates under ansible/templates/
 {% include 'crd.yml.j2' %}
 
+{% include 'awxbackup_crd.yml.j2' %}
+
+{% include 'awxrestore_crd.yml.j2' %}
+
 {% include 'role.yml.j2' %}
 
 {% include 'role_binding.yml.j2' %}

ansible/templates/awxbackup_crd.yml.j2

@@ -0,0 +1,78 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: awxbackups.awx.ansible.com
+spec:
+  group: awx.ansible.com
+  names:
+    kind: AWXBackup
+    listKind: AWXBackupList
+    plural: awxbackups
+    singular: awxbackup
+  scope: Namespaced
+  versions:
+    - name: v1beta1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+          description: Schema validation for the AWXBackup CRD
+          properties:
+            spec:
+              type: object
+              required:
+                - deployment_name
+              properties:
+                deployment_name:
+                  description: Name of the deployment to be backed up
+                  type: string
+                backup_pvc:
+                  description: Name of the PVC to be used for storing the backup
+                  type: string
+                backup_pvc_namespace:
+                  description: Namespace the PVC is in
+                  type: string
+                backup_storage_requirements:
+                  description: Storage requirements for the PostgreSQL container
+                  type: string
+                backup_storage_class:
+                  description: Storage class to use when creating PVC for backup
+                  type: string
+                postgres_label_selector:
+                  description: Label selector used to identify postgres pod for backing up data
+                  type: string
+                postgres_image:
+                  description: Registry path to the PostgreSQL container to use
+                  type: string
+                postgres_image_version:
+                  description: PostgreSQL container image version to use
+                  type: string
+            status:
+              type: object
+              properties:
+                conditions:
+                  description: The resulting conditions when a Service Telemetry is
+                    instantiated
+                  items:
+                    properties:
+                      lastTransitionTime:
+                        type: string
+                      reason:
+                        type: string
+                      status:
+                        type: string
+                      type:
+                        type: string
+                    type: object
+                  type: array
+                backupDirectory:
+                  description: Backup directory name on the specified pvc
+                  type: string
+                backupClaim:
+                  description: Backup persistent volume claim
+                  type: string

ansible/templates/awxrestore_crd.yml.j2

@@ -0,0 +1,79 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: awxrestores.awx.ansible.com
+spec:
+  group: awx.ansible.com
+  names:
+    kind: AWXRestore
+    listKind: AWXRestoreList
+    plural: awxrestores
+    singular: awxrestore
+  scope: Namespaced
+  versions:
+    - name: v1beta1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+          description: Schema validation for the AWXRestore CRD
+          properties:
+            spec:
+              type: object
+              properties:
+                backup_source:
+                  description: Backup source
+                  type: string
+                  enum:
+                    - CR
+                    - PVC
+                deployment_name:
+                  description: Name of the deployment to be restored to
+                  type: string
+                backup_name:
+                  description: AWXBackup object name
+                  type: string
+                backup_pvc:
+                  description: Name of the PVC to be restored from, set as a status found on the awxbackup object (backupClaim)
+                  type: string
+                backup_pvc_namespace:
+                  description: Namespace the PVC is in
+                  type: string
+                backup_dir:
+                  description: Backup directory name, set as a status found on the awxbackup object (backupDirectory)
+                  type: string
+                postgres_label_selector:
+                  description: Label selector used to identify postgres pod for backing up data
+                  type: string
+                postgres_image:
+                  description: Registry path to the PostgreSQL container to use
+                  type: string
+                postgres_image_version:
+                  description: PostgreSQL container image version to use
+                  type: string
+            status:
+              type: object
+              properties:
+                conditions:
+                  description: The resulting conditions when a Service Telemetry is
+                    instantiated
+                  items:
+                    properties:
+                      lastTransitionTime:
+                        type: string
+                      reason:
+                        type: string
+                      status:
+                        type: string
+                      type:
+                        type: string
+                    type: object
+                  type: array
+                restoreComplete:
+                  description: Restore process complete
+                  type: boolean

ansible/templates/crd.yml.j2

@@ -26,48 +26,58 @@ spec:
                 deployment_type:
                   description: Name of the deployment type
                   type: string
-                  default: awx
                 kind:
                   description: Kind of the deployment type
                   type: string
-                  default: AWX
                 api_version:
                   description: apiVersion of the deployment type
                   type: string
-                  default: awx.ansible.com/v1beta1
-                tower_task_privileged:
+                task_privileged:
                   description: If a privileged security context should be enabled
                   type: boolean
                   default: false
-                tower_admin_user:
+                admin_user:
                   description: Username to use for the admin account
                   type: string
                   default: admin
-                tower_hostname:
+                hostname:
                   description: The hostname of the instance
                   type: string
-                tower_admin_email:
+                admin_email:
                   description: The admin user email
                   type: string
-                tower_admin_password_secret:
+                admin_password_secret:
                   description: Secret where the admin password can be found
                   type: string
-                tower_postgres_configuration_secret:
+                postgres_configuration_secret:
                   description: Secret where the database configuration can be found
                   type: string
-                tower_old_postgres_configuration_secret:
+                old_postgres_configuration_secret:
                   description: Secret where the old database configuration can be found for data migration
                   type: string
-                tower_secret_key_secret:
+                postgres_label_selector:
+                  description: Label selector used to identify postgres pod for data migration
+                  type: string
+                secret_key_secret:
                   description: Secret where the secret key can be found
                   type: string
-                tower_broadcast_websocket_secret:
+                broadcast_websocket_secret:
                   description: Secret where the broadcast websocket secret can be found
                   type: string
-                tower_extra_volumes:
+                extra_volumes:
                   description: Specify extra volumes to add to the application pod
                   type: string
-                tower_ingress_type:
+                service_type:
+                  description: The service type to be used on the deployed instance
+                  type: string
+                  enum:
+                    - LoadBalancer
+                    - loadbalancer
+                    - ClusterIP
+                    - clusterip
+                    - NodePort
+                    - nodeport
+                ingress_type:
                   description: The ingress type to use to reach the deployed instance
                   type: string
                   enum:
@@ -76,34 +86,33 @@ spec:
                     - ingress
                     - Route
                     - route
-                    - LoadBalancer
-                    - loadbalancer
-                    - NodePort
-                    - nodeport
-                tower_ingress_annotations:
-                  description: Annotations to add to the ingress
+                ingress_path:
+                  description: The ingress path used to reach the deployed service
                   type: string
-                tower_ingress_tls_secret:
-                  description: Secret where the ingress TLS secret can be found
+                ingress_annotations:
+                  description: Annotations to add to the Ingress Controller
                   type: string
-                tower_loadbalancer_annotations:
+                ingress_tls_secret:
+                  description: Secret where the Ingress TLS secret can be found
+                  type: string
+                loadbalancer_annotations:
                   description: Annotations to add to the loadbalancer
                   type: string
-                tower_loadbalancer_protocol:
+                loadbalancer_protocol:
                   description: Protocol to use for the loadbalancer
                   type: string
                   default: http
                   enum:
                     - http
                     - https
-                tower_loadbalancer_port:
+                loadbalancer_port:
                   description: Port to use for the loadbalancer
                   type: integer
                   default: 80
-                tower_route_host:
+                route_host:
                   description: The DNS to use to points to the instance
                   type: string
-                tower_route_tls_termination_mechanism:
+                route_tls_termination_mechanism:
                   description: The secure TLS termination mechanism to use
                   type: string
                   default: Edge
@@ -112,22 +121,25 @@ spec:
                     - edge
                     - Passthrough
                     - passthrough
-                tower_route_tls_secret:
+                route_tls_secret:
                   description: Secret where the TLS related credentials are stored
                   type: string
-                tower_node_selector:
-                  description: nodeSelector for the AWX pods
+                node_selector:
+                  description: nodeSelector for the pods
                   type: string
-                tower_tolerations:
-                  description: node tolerations for the AWX pods
+                service_labels:
+                  description: Additional labels to apply to the service
                   type: string
-                tower_image:
+                tolerations:
+                  description: node tolerations for the pods
+                  type: string
+                image:
                   description: Registry path to the application container to use
                   type: string
-                tower_image_version:
+                image_version:
                   description: Application container image version to use
                   type: string
-                tower_ee_images:
+                ee_images:
                   description: Registry path to the Execution Environment container to use
                   type: array
                   items:
@@ -137,7 +149,13 @@ spec:
                         type: string
                       image:
                         type: string
-                tower_image_pull_policy:
+                control_plane_ee_image:
+                  description: Registry path to the Execution Environment container image to use on control plane pods
+                  type: string
+                ee_pull_credentials_secret:
+                  description: Secret where pull credentials for registered ees can be found
+                  type: string
+                image_pull_policy:
                   description: The image pull policy
                   type: string
                   default: IfNotPresent
@@ -148,10 +166,10 @@ spec:
                     - never
                     - IfNotPresent
                     - ifnotpresent
-                tower_image_pull_secret:
+                image_pull_secret:
                   description: The image pull secret
                   type: string
-                tower_task_resource_requirements:
+                task_resource_requirements:
                   description: Resource requirements for the task container
                   properties:
                     requests:
@@ -173,7 +191,7 @@ spec:
                           type: string
                       type: object
                   type: object
-                tower_web_resource_requirements:
+                web_resource_requirements:
                   description: Resource requirements for the web container
                   properties:
                     requests:
@@ -195,67 +213,106 @@ spec:
                           type: string
                       type: object
                   type: object
-                tower_replicas:
+                ee_resource_requirements:
+                  description: Resource requirements for the ee container
+                  properties:
+                    requests:
+                      properties:
+                        cpu:
+                          type: string
+                        memory:
+                          type: string
+                        storage:
+                          type: string
+                      type: object
+                    limits:
+                      properties:
+                        cpu:
+                          type: string
+                        memory:
+                          type: string
+                        storage:
+                          type: string
+                      type: object
+                  type: object
+                service_account_annotations:
+                  description: ServiceAccount annotations
+                  type: string
+                replicas:
                   description: Number of instance replicas
                   type: integer
                   default: 1
                   format: int32
-                tower_garbage_collect_secrets:
+                garbage_collect_secrets:
                   description: Whether or not to remove secrets upon instance removal
                   default: false
                   type: boolean
-                tower_create_preload_data:
-                  description: Whether or not to preload data upon Tower instance creation
+                create_preload_data:
+                  description: Whether or not to preload data upon instance creation
                   default: true
                   type: boolean
-                tower_task_args:
+                task_args:
                   type: array
                   items:
                     type: string
-                tower_task_command:
+                task_command:
                   type: array
                   items:
                     type: string
-                tower_web_args:
+                web_args:
                   type: array
                   items:
                     type: string
-                tower_web_command:
+                web_command:
                   type: array
                   items:
                     type: string
-                tower_task_extra_env:
+                task_extra_env:
                   type: string
-                tower_web_extra_env:
+                web_extra_env:
                   type: string
-                tower_ee_extra_volume_mounts:
+                ee_extra_env:
+                  type: string
+                ee_extra_volume_mounts:
                   description: Specify volume mounts to be added to Execution container
                   type: string
-                tower_task_extra_volume_mounts:
+                task_extra_volume_mounts:
                   description: Specify volume mounts to be added to Task container
                   type: string
-                tower_web_extra_volume_mounts:
+                web_extra_volume_mounts:
                   description: Specify volume mounts to be added to the Web container
                   type: string
-                tower_redis_image:
+                redis_image:
                   description: Registry path to the redis container to use
                   type: string
-                tower_redis_image_version:
+                redis_image_version:
                   description: Redis container image version to use
                   type: string
-                tower_postgres_image:
+                init_container_image:
+                  description: Registry path to the init container to use
+                  type: string
+                init_container_image_version:
+                  description: Init container image version to use
+                  type: string
+                init_container_extra_commands:
+                  description: Extra commands for the init container
+                  type: string
+                init_container_extra_volume_mounts:
+                  description: Specify volume mounts to be added to the init container
+                  type: string
+                postgres_image:
                   description: Registry path to the PostgreSQL container to use
                   type: string
-                tower_postgres_image_version:
+                postgres_image_version:
                   description: PostgreSQL container image version to use
                   type: string
-                tower_postgres_selector:
+                postgres_selector:
                   description: nodeSelector for the Postgres pods
                   type: string
-                tower_postgres_tolerations:
+                postgres_tolerations:
                   description: node tolerations for the Postgres pods
                   type: string
-                tower_postgres_storage_requirements:
+                postgres_storage_requirements:
                   description: Storage requirements for the PostgreSQL container
                   properties:
                     requests:
@@ -269,7 +326,7 @@ spec:
                           type: string
                       type: object
                   type: object
-                tower_postgres_resource_requirements:
+                postgres_resource_requirements:
                   description: Resource requirements for the PostgreSQL container
                   properties:
                     requests:
@@ -287,10 +344,10 @@ spec:
                           type: string
                       type: object
                   type: object
-                tower_postgres_storage_class:
+                postgres_storage_class:
                   description: Storage class to use for the PostgreSQL PVC
                   type: string
-                tower_postgres_data_path:
+                postgres_data_path:
                   description: Path where the PostgreSQL data are located
                   type: string
                 ca_trust_bundle:
@@ -302,27 +359,30 @@ spec:
                 ldap_cacert_secret:
                   description: Secret where can be found the LDAP trusted Certificate Authority Bundle
                   type: string
-                tower_projects_persistence:
+                bundle_cacert_secret:
+                  description: Secret where can be found the trusted Certificate Authority Bundle
+                  type: string
+                projects_persistence:
                   description: Whether or not the /var/lib/projects directory will be persistent
                   default: false
                   type: boolean
-                tower_projects_use_existing_claim:
+                projects_use_existing_claim:
                   description: Using existing PersistentVolumeClaim
                   type: string
                   enum:
                     - _Yes_
                     - _No_
-                tower_projects_existing_claim:
+                projects_existing_claim:
                   description: PersistentVolumeClaim to mount /var/lib/projects directory
                   type: string
-                tower_projects_storage_class:
+                projects_storage_class:
                   description: Storage class for the /var/lib/projects PersistentVolumeClaim
                   type: string
-                tower_projects_storage_size:
+                projects_storage_size:
                   description: Size for the /var/lib/projects PersistentVolumeClaim
                   default: 8Gi
                   type: string
-                tower_projects_storage_access_mode:
+                projects_storage_access_mode:
                   description: AccessMode for the /var/lib/projects PersistentVolumeClaim
                   default: ReadWriteMany
                   type: string
@@ -333,28 +393,37 @@ spec:
                       setting:
                         type: string
                       value:
-                        type: string
+                        x-kubernetes-preserve-unknown-fields: true
                     type: object
                   type: array
               type: object
             status:
               properties:
-                towerURL:
+                URL:
                   description: URL to access the deployed instance
                   type: string
-                towerAdminUser:
+                adminUser:
                   description: Admin user of the deployed instance
                   type: string
-                towerAdminPasswordSecret:
-                  description: Admin password of the deployed instance
+                adminPasswordSecret:
+                  description: Admin password secret name of the deployed instance
                   type: string
-                towerMigratedFromSecret:
-                  description: The secret used for migrating an old Tower.
+                postgresConfigurationSecret:
+                  description: Postgres Configuration secret name of the deployed instance
                   type: string
-                towerVersion:
+                broadcastWebsocketSecret:
+                  description: Broadcast websocket secret name of the deployed instance
+                  type: string
+                secretKeySecret:
+                  description: Secret key secret name of the deployed instance
+                  type: string
+                migratedFromSecret:
+                  description: The secret used for migrating an old instance.
+                  type: string
+                version:
                   description: Version of the deployed instance
                   type: string
-                towerImage:
+                image:
                   description: URL of the image used for the deployed instance
                   type: string
                 conditions:

ansible/templates/operator.yml.j2

@@ -33,6 +33,10 @@ spec:
               value: awx-operator
             - name: ANSIBLE_GATHERING
               value: explicit
+            - name: OPERATOR_VERSION
+              value: "{{ operator_version }}"
+            - name: ANSIBLE_DEBUG_LOGS
+              value: "{{ ansible_debug_logs|lower | default('false'|lower) }}"
           livenessProbe:
             httpGet:
               path: /healthz

ansible/templates/role.yml.j2

@@ -79,5 +79,7 @@ rules:
       - awx.ansible.com
     resources:
       - '*'
+      - awxbackups
+      - awxrestores
     verbs:
       - '*'

bundle.Dockerfile

@@ -6,9 +6,9 @@ LABEL operators.operatorframework.io.bundle.metadata.v1=metadata/
 LABEL operators.operatorframework.io.bundle.package.v1=awx-operator
 LABEL operators.operatorframework.io.bundle.channels.v1=alpha
 LABEL operators.operatorframework.io.bundle.channel.default.v1=alpha
-LABEL operators.operatorframework.io.metrics.project_layout=ansible
 LABEL operators.operatorframework.io.metrics.mediatype.v1=metrics+v1
 LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v0.19.4
+LABEL operators.operatorframework.io.metrics.project_layout=ansible
 
 COPY deploy/olm-catalog/awx-operator/manifests /manifests/
 COPY deploy/olm-catalog/awx-operator/metadata /metadata/

deploy/awx-operator.yaml

@@ -28,48 +28,58 @@ spec:
                 deployment_type:
                   description: Name of the deployment type
                   type: string
-                  default: awx
                 kind:
                   description: Kind of the deployment type
                   type: string
-                  default: AWX
                 api_version:
                   description: apiVersion of the deployment type
                   type: string
-                  default: awx.ansible.com/v1beta1
-                tower_task_privileged:
+                task_privileged:
                   description: If a privileged security context should be enabled
                   type: boolean
                   default: false
-                tower_admin_user:
+                admin_user:
                   description: Username to use for the admin account
                   type: string
                   default: admin
-                tower_hostname:
+                hostname:
                   description: The hostname of the instance
                   type: string
-                tower_admin_email:
+                admin_email:
                   description: The admin user email
                   type: string
-                tower_admin_password_secret:
+                admin_password_secret:
                   description: Secret where the admin password can be found
                   type: string
-                tower_postgres_configuration_secret:
+                postgres_configuration_secret:
                   description: Secret where the database configuration can be found
                   type: string
-                tower_old_postgres_configuration_secret:
+                old_postgres_configuration_secret:
                   description: Secret where the old database configuration can be found for data migration
                   type: string
-                tower_secret_key_secret:
+                postgres_label_selector:
+                  description: Label selector used to identify postgres pod for data migration
+                  type: string
+                secret_key_secret:
                   description: Secret where the secret key can be found
                   type: string
-                tower_broadcast_websocket_secret:
+                broadcast_websocket_secret:
                   description: Secret where the broadcast websocket secret can be found
                   type: string
-                tower_extra_volumes:
+                extra_volumes:
                   description: Specify extra volumes to add to the application pod
                   type: string
-                tower_ingress_type:
+                service_type:
+                  description: The service type to be used on the deployed instance
+                  type: string
+                  enum:
+                    - LoadBalancer
+                    - loadbalancer
+                    - ClusterIP
+                    - clusterip
+                    - NodePort
+                    - nodeport
+                ingress_type:
                   description: The ingress type to use to reach the deployed instance
                   type: string
                   enum:
@@ -78,34 +88,33 @@ spec:
                     - ingress
                     - Route
                     - route
-                    - LoadBalancer
-                    - loadbalancer
-                    - NodePort
-                    - nodeport
-                tower_ingress_annotations:
-                  description: Annotations to add to the ingress
+                ingress_path:
+                  description: The ingress path used to reach the deployed service
                   type: string
-                tower_ingress_tls_secret:
-                  description: Secret where the ingress TLS secret can be found
+                ingress_annotations:
+                  description: Annotations to add to the Ingress Controller
                   type: string
-                tower_loadbalancer_annotations:
+                ingress_tls_secret:
+                  description: Secret where the Ingress TLS secret can be found
+                  type: string
+                loadbalancer_annotations:
                   description: Annotations to add to the loadbalancer
                   type: string
-                tower_loadbalancer_protocol:
+                loadbalancer_protocol:
                   description: Protocol to use for the loadbalancer
                   type: string
                   default: http
                   enum:
                     - http
                     - https
-                tower_loadbalancer_port:
+                loadbalancer_port:
                   description: Port to use for the loadbalancer
                   type: integer
                   default: 80
-                tower_route_host:
+                route_host:
                   description: The DNS to use to points to the instance
                   type: string
-                tower_route_tls_termination_mechanism:
+                route_tls_termination_mechanism:
                   description: The secure TLS termination mechanism to use
                   type: string
                   default: Edge
@@ -114,22 +123,25 @@ spec:
                     - edge
                     - Passthrough
                     - passthrough
-                tower_route_tls_secret:
+                route_tls_secret:
                   description: Secret where the TLS related credentials are stored
                   type: string
-                tower_node_selector:
-                  description: nodeSelector for the AWX pods
+                node_selector:
+                  description: nodeSelector for the pods
                   type: string
-                tower_tolerations:
-                  description: node tolerations for the AWX pods
+                service_labels:
+                  description: Additional labels to apply to the service
                   type: string
-                tower_image:
+                tolerations:
+                  description: node tolerations for the pods
+                  type: string
+                image:
                   description: Registry path to the application container to use
                   type: string
-                tower_image_version:
+                image_version:
                   description: Application container image version to use
                   type: string
-                tower_ee_images:
+                ee_images:
                   description: Registry path to the Execution Environment container to use
                   type: array
                   items:
@@ -139,7 +151,13 @@ spec:
                         type: string
                       image:
                         type: string
-                tower_image_pull_policy:
+                control_plane_ee_image:
+                  description: Registry path to the Execution Environment container image to use on control plane pods
+                  type: string
+                ee_pull_credentials_secret:
+                  description: Secret where pull credentials for registered ees can be found
+                  type: string
+                image_pull_policy:
                   description: The image pull policy
                   type: string
                   default: IfNotPresent
@@ -150,10 +168,10 @@ spec:
                     - never
                     - IfNotPresent
                     - ifnotpresent
-                tower_image_pull_secret:
+                image_pull_secret:
                   description: The image pull secret
                   type: string
-                tower_task_resource_requirements:
+                task_resource_requirements:
                   description: Resource requirements for the task container
                   properties:
                     requests:
@@ -175,7 +193,7 @@ spec:
                           type: string
                       type: object
                   type: object
-                tower_web_resource_requirements:
+                web_resource_requirements:
                   description: Resource requirements for the web container
                   properties:
                     requests:
@@ -197,67 +215,106 @@ spec:
                           type: string
                       type: object
                   type: object
-                tower_replicas:
+                ee_resource_requirements:
+                  description: Resource requirements for the ee container
+                  properties:
+                    requests:
+                      properties:
+                        cpu:
+                          type: string
+                        memory:
+                          type: string
+                        storage:
+                          type: string
+                      type: object
+                    limits:
+                      properties:
+                        cpu:
+                          type: string
+                        memory:
+                          type: string
+                        storage:
+                          type: string
+                      type: object
+                  type: object
+                service_account_annotations:
+                  description: ServiceAccount annotations
+                  type: string
+                replicas:
                   description: Number of instance replicas
                   type: integer
                   default: 1
                   format: int32
-                tower_garbage_collect_secrets:
+                garbage_collect_secrets:
                   description: Whether or not to remove secrets upon instance removal
                   default: false
                   type: boolean
-                tower_create_preload_data:
-                  description: Whether or not to preload data upon Tower instance creation
+                create_preload_data:
+                  description: Whether or not to preload data upon instance creation
                   default: true
                   type: boolean
-                tower_task_args:
+                task_args:
                   type: array
                   items:
                     type: string
-                tower_task_command:
+                task_command:
                   type: array
                   items:
                     type: string
-                tower_web_args:
+                web_args:
                   type: array
                   items:
                     type: string
-                tower_web_command:
+                web_command:
                   type: array
                   items:
                     type: string
-                tower_task_extra_env:
+                task_extra_env:
                   type: string
-                tower_web_extra_env:
+                web_extra_env:
                   type: string
-                tower_ee_extra_volume_mounts:
+                ee_extra_env:
+                  type: string
+                ee_extra_volume_mounts:
                   description: Specify volume mounts to be added to Execution container
                   type: string
-                tower_task_extra_volume_mounts:
+                task_extra_volume_mounts:
                   description: Specify volume mounts to be added to Task container
                   type: string
-                tower_web_extra_volume_mounts:
+                web_extra_volume_mounts:
                   description: Specify volume mounts to be added to the Web container
                   type: string
-                tower_redis_image:
+                redis_image:
                   description: Registry path to the redis container to use
                   type: string
-                tower_redis_image_version:
+                redis_image_version:
                   description: Redis container image version to use
                   type: string
-                tower_postgres_image:
+                init_container_image:
+                  description: Registry path to the init container to use
+                  type: string
+                init_container_image_version:
+                  description: Init container image version to use
+                  type: string
+                init_container_extra_commands:
+                  description: Extra commands for the init container
+                  type: string
+                init_container_extra_volume_mounts:
+                  description: Specify volume mounts to be added to the init container
+                  type: string
+                postgres_image:
                   description: Registry path to the PostgreSQL container to use
                   type: string
-                tower_postgres_image_version:
+                postgres_image_version:
                   description: PostgreSQL container image version to use
                   type: string
-                tower_postgres_selector:
+                postgres_selector:
                   description: nodeSelector for the Postgres pods
                   type: string
-                tower_postgres_tolerations:
+                postgres_tolerations:
                   description: node tolerations for the Postgres pods
                   type: string
-                tower_postgres_storage_requirements:
+                postgres_storage_requirements:
                   description: Storage requirements for the PostgreSQL container
                   properties:
                     requests:
@@ -271,7 +328,7 @@ spec:
                           type: string
                       type: object
                   type: object
-                tower_postgres_resource_requirements:
+                postgres_resource_requirements:
                   description: Resource requirements for the PostgreSQL container
                   properties:
                     requests:
@@ -289,10 +346,10 @@ spec:
                           type: string
                       type: object
                   type: object
-                tower_postgres_storage_class:
+                postgres_storage_class:
                   description: Storage class to use for the PostgreSQL PVC
                   type: string
-                tower_postgres_data_path:
+                postgres_data_path:
                   description: Path where the PostgreSQL data are located
                   type: string
                 ca_trust_bundle:
@@ -304,27 +361,30 @@ spec:
                 ldap_cacert_secret:
                   description: Secret where can be found the LDAP trusted Certificate Authority Bundle
                   type: string
-                tower_projects_persistence:
+                bundle_cacert_secret:
+                  description: Secret where can be found the trusted Certificate Authority Bundle
+                  type: string
+                projects_persistence:
                   description: Whether or not the /var/lib/projects directory will be persistent
                   default: false
                   type: boolean
-                tower_projects_use_existing_claim:
+                projects_use_existing_claim:
                   description: Using existing PersistentVolumeClaim
                   type: string
                   enum:
                     - _Yes_
                     - _No_
-                tower_projects_existing_claim:
+                projects_existing_claim:
                   description: PersistentVolumeClaim to mount /var/lib/projects directory
                   type: string
-                tower_projects_storage_class:
+                projects_storage_class:
                   description: Storage class for the /var/lib/projects PersistentVolumeClaim
                   type: string
-                tower_projects_storage_size:
+                projects_storage_size:
                   description: Size for the /var/lib/projects PersistentVolumeClaim
                   default: 8Gi
                   type: string
-                tower_projects_storage_access_mode:
+                projects_storage_access_mode:
                   description: AccessMode for the /var/lib/projects PersistentVolumeClaim
                   default: ReadWriteMany
                   type: string
@@ -335,28 +395,37 @@ spec:
                       setting:
                         type: string
                       value:
-                        type: string
+                        x-kubernetes-preserve-unknown-fields: true
                     type: object
                   type: array
               type: object
             status:
               properties:
-                towerURL:
+                URL:
                   description: URL to access the deployed instance
                   type: string
-                towerAdminUser:
+                adminUser:
                   description: Admin user of the deployed instance
                   type: string
-                towerAdminPasswordSecret:
-                  description: Admin password of the deployed instance
+                adminPasswordSecret:
+                  description: Admin password secret name of the deployed instance
                   type: string
-                towerMigratedFromSecret:
-                  description: The secret used for migrating an old Tower.
+                postgresConfigurationSecret:
+                  description: Postgres Configuration secret name of the deployed instance
                   type: string
-                towerVersion:
+                broadcastWebsocketSecret:
+                  description: Broadcast websocket secret name of the deployed instance
+                  type: string
+                secretKeySecret:
+                  description: Secret key secret name of the deployed instance
+                  type: string
+                migratedFromSecret:
+                  description: The secret used for migrating an old instance.
+                  type: string
+                version:
                   description: Version of the deployed instance
                   type: string
-                towerImage:
+                image:
                   description: URL of the image used for the deployed instance
                   type: string
                 conditions:
@@ -376,6 +445,165 @@ spec:
               type: object
           type: object
 
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: awxbackups.awx.ansible.com
+spec:
+  group: awx.ansible.com
+  names:
+    kind: AWXBackup
+    listKind: AWXBackupList
+    plural: awxbackups
+    singular: awxbackup
+  scope: Namespaced
+  versions:
+    - name: v1beta1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+          description: Schema validation for the AWXBackup CRD
+          properties:
+            spec:
+              type: object
+              required:
+                - deployment_name
+              properties:
+                deployment_name:
+                  description: Name of the deployment to be backed up
+                  type: string
+                backup_pvc:
+                  description: Name of the PVC to be used for storing the backup
+                  type: string
+                backup_pvc_namespace:
+                  description: Namespace the PVC is in
+                  type: string
+                backup_storage_requirements:
+                  description: Storage requirements for the PostgreSQL container
+                  type: string
+                backup_storage_class:
+                  description: Storage class to use when creating PVC for backup
+                  type: string
+                postgres_label_selector:
+                  description: Label selector used to identify postgres pod for backing up data
+                  type: string
+                postgres_image:
+                  description: Registry path to the PostgreSQL container to use
+                  type: string
+                postgres_image_version:
+                  description: PostgreSQL container image version to use
+                  type: string
+            status:
+              type: object
+              properties:
+                conditions:
+                  description: The resulting conditions when a Service Telemetry is
+                    instantiated
+                  items:
+                    properties:
+                      lastTransitionTime:
+                        type: string
+                      reason:
+                        type: string
+                      status:
+                        type: string
+                      type:
+                        type: string
+                    type: object
+                  type: array
+                backupDirectory:
+                  description: Backup directory name on the specified pvc
+                  type: string
+                backupClaim:
+                  description: Backup persistent volume claim
+                  type: string
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: awxrestores.awx.ansible.com
+spec:
+  group: awx.ansible.com
+  names:
+    kind: AWXRestore
+    listKind: AWXRestoreList
+    plural: awxrestores
+    singular: awxrestore
+  scope: Namespaced
+  versions:
+    - name: v1beta1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+          description: Schema validation for the AWXRestore CRD
+          properties:
+            spec:
+              type: object
+              properties:
+                backup_source:
+                  description: Backup source
+                  type: string
+                  enum:
+                    - CR
+                    - PVC
+                deployment_name:
+                  description: Name of the deployment to be restored to
+                  type: string
+                backup_name:
+                  description: AWXBackup object name
+                  type: string
+                backup_pvc:
+                  description: Name of the PVC to be restored from, set as a status found on the awxbackup object (backupClaim)
+                  type: string
+                backup_pvc_namespace:
+                  description: Namespace the PVC is in
+                  type: string
+                backup_dir:
+                  description: Backup directory name, set as a status found on the awxbackup object (backupDirectory)
+                  type: string
+                postgres_label_selector:
+                  description: Label selector used to identify postgres pod for backing up data
+                  type: string
+                postgres_image:
+                  description: Registry path to the PostgreSQL container to use
+                  type: string
+                postgres_image_version:
+                  description: PostgreSQL container image version to use
+                  type: string
+            status:
+              type: object
+              properties:
+                conditions:
+                  description: The resulting conditions when a Service Telemetry is
+                    instantiated
+                  items:
+                    properties:
+                      lastTransitionTime:
+                        type: string
+                      reason:
+                        type: string
+                      status:
+                        type: string
+                      type:
+                        type: string
+                    type: object
+                  type: array
+                restoreComplete:
+                  description: Restore process complete
+                  type: boolean
+
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -457,6 +685,8 @@ rules:
       - awx.ansible.com
     resources:
       - '*'
+      - awxbackups
+      - awxrestores
     verbs:
       - '*'
 
@@ -499,7 +729,7 @@ spec:
       serviceAccountName: awx-operator
       containers:
         - name: awx-operator
-          image: "quay.io/ansible/awx-operator:0.9.0"
+          image: "quay.io/ansible/awx-operator:0.13.0"
           imagePullPolicy: "Always"
           volumeMounts:
             - mountPath: /tmp/ansible-operator/runner
@@ -516,6 +746,10 @@ spec:
               value: awx-operator
             - name: ANSIBLE_GATHERING
               value: explicit
+            - name: OPERATOR_VERSION
+              value: "0.13.0"
+            - name: ANSIBLE_DEBUG_LOGS
+              value: "false"
           livenessProbe:
             httpGet:
               path: /healthz

deploy/crds/awx_v1beta1_crd.yaml

@@ -26,48 +26,58 @@ spec:
                 deployment_type:
                   description: Name of the deployment type
                   type: string
-                  default: awx
                 kind:
                   description: Kind of the deployment type
                   type: string
-                  default: AWX
                 api_version:
                   description: apiVersion of the deployment type
                   type: string
-                  default: awx.ansible.com/v1beta1
-                tower_task_privileged:
+                task_privileged:
                   description: If a privileged security context should be enabled
                   type: boolean
                   default: false
-                tower_admin_user:
+                admin_user:
                   description: Username to use for the admin account
                   type: string
                   default: admin
-                tower_hostname:
+                hostname:
                   description: The hostname of the instance
                   type: string
-                tower_admin_email:
+                admin_email:
                   description: The admin user email
                   type: string
-                tower_admin_password_secret:
+                admin_password_secret:
                   description: Secret where the admin password can be found
                   type: string
-                tower_postgres_configuration_secret:
+                postgres_configuration_secret:
                   description: Secret where the database configuration can be found
                   type: string
-                tower_old_postgres_configuration_secret:
+                old_postgres_configuration_secret:
                   description: Secret where the old database configuration can be found for data migration
                   type: string
-                tower_secret_key_secret:
+                postgres_label_selector:
+                  description: Label selector used to identify postgres pod for data migration
+                  type: string
+                secret_key_secret:
                   description: Secret where the secret key can be found
                   type: string
-                tower_broadcast_websocket_secret:
+                broadcast_websocket_secret:
                   description: Secret where the broadcast websocket secret can be found
                   type: string
-                tower_extra_volumes:
+                extra_volumes:
                   description: Specify extra volumes to add to the application pod
                   type: string
-                tower_ingress_type:
+                service_type:
+                  description: The service type to be used on the deployed instance
+                  type: string
+                  enum:
+                    - LoadBalancer
+                    - loadbalancer
+                    - ClusterIP
+                    - clusterip
+                    - NodePort
+                    - nodeport
+                ingress_type:
                   description: The ingress type to use to reach the deployed instance
                   type: string
                   enum:
@@ -76,34 +86,33 @@ spec:
                     - ingress
                     - Route
                     - route
-                    - LoadBalancer
-                    - loadbalancer
-                    - NodePort
-                    - nodeport
-                tower_ingress_annotations:
-                  description: Annotations to add to the ingress
+                ingress_path:
+                  description: The ingress path used to reach the deployed service
                   type: string
-                tower_ingress_tls_secret:
-                  description: Secret where the ingress TLS secret can be found
+                ingress_annotations:
+                  description: Annotations to add to the Ingress Controller
                   type: string
-                tower_loadbalancer_annotations:
+                ingress_tls_secret:
+                  description: Secret where the Ingress TLS secret can be found
+                  type: string
+                loadbalancer_annotations:
                   description: Annotations to add to the loadbalancer
                   type: string
-                tower_loadbalancer_protocol:
+                loadbalancer_protocol:
                   description: Protocol to use for the loadbalancer
                   type: string
                   default: http
                   enum:
                     - http
                     - https
-                tower_loadbalancer_port:
+                loadbalancer_port:
                   description: Port to use for the loadbalancer
                   type: integer
                   default: 80
-                tower_route_host:
+                route_host:
                   description: The DNS to use to points to the instance
                   type: string
-                tower_route_tls_termination_mechanism:
+                route_tls_termination_mechanism:
                   description: The secure TLS termination mechanism to use
                   type: string
                   default: Edge
@@ -112,22 +121,25 @@ spec:
                     - edge
                     - Passthrough
                     - passthrough
-                tower_route_tls_secret:
+                route_tls_secret:
                   description: Secret where the TLS related credentials are stored
                   type: string
-                tower_node_selector:
-                  description: nodeSelector for the AWX pods
+                node_selector:
+                  description: nodeSelector for the pods
                   type: string
-                tower_tolerations:
-                  description: node tolerations for the AWX pods
+                service_labels:
+                  description: Additional labels to apply to the service
                   type: string
-                tower_image:
+                tolerations:
+                  description: node tolerations for the pods
+                  type: string
+                image:
                   description: Registry path to the application container to use
                   type: string
-                tower_image_version:
+                image_version:
                   description: Application container image version to use
                   type: string
-                tower_ee_images:
+                ee_images:
                   description: Registry path to the Execution Environment container to use
                   type: array
                   items:
@@ -137,7 +149,13 @@ spec:
                         type: string
                       image:
                         type: string
-                tower_image_pull_policy:
+                control_plane_ee_image:
+                  description: Registry path to the Execution Environment container image to use on control plane pods
+                  type: string
+                ee_pull_credentials_secret:
+                  description: Secret where pull credentials for registered ees can be found
+                  type: string
+                image_pull_policy:
                   description: The image pull policy
                   type: string
                   default: IfNotPresent
@@ -148,10 +166,10 @@ spec:
                     - never
                     - IfNotPresent
                     - ifnotpresent
-                tower_image_pull_secret:
+                image_pull_secret:
                   description: The image pull secret
                   type: string
-                tower_task_resource_requirements:
+                task_resource_requirements:
                   description: Resource requirements for the task container
                   properties:
                     requests:
@@ -173,7 +191,7 @@ spec:
                           type: string
                       type: object
                   type: object
-                tower_web_resource_requirements:
+                web_resource_requirements:
                   description: Resource requirements for the web container
                   properties:
                     requests:
@@ -195,67 +213,106 @@ spec:
                           type: string
                       type: object
                   type: object
-                tower_replicas:
+                ee_resource_requirements:
+                  description: Resource requirements for the ee container
+                  properties:
+                    requests:
+                      properties:
+                        cpu:
+                          type: string
+                        memory:
+                          type: string
+                        storage:
+                          type: string
+                      type: object
+                    limits:
+                      properties:
+                        cpu:
+                          type: string
+                        memory:
+                          type: string
+                        storage:
+                          type: string
+                      type: object
+                  type: object
+                service_account_annotations:
+                  description: ServiceAccount annotations
+                  type: string
+                replicas:
                   description: Number of instance replicas
                   type: integer
                   default: 1
                   format: int32
-                tower_garbage_collect_secrets:
+                garbage_collect_secrets:
                   description: Whether or not to remove secrets upon instance removal
                   default: false
                   type: boolean
-                tower_create_preload_data:
-                  description: Whether or not to preload data upon Tower instance creation
+                create_preload_data:
+                  description: Whether or not to preload data upon instance creation
                   default: true
                   type: boolean
-                tower_task_args:
+                task_args:
                   type: array
                   items:
                     type: string
-                tower_task_command:
+                task_command:
                   type: array
                   items:
                     type: string
-                tower_web_args:
+                web_args:
                   type: array
                   items:
                     type: string
-                tower_web_command:
+                web_command:
                   type: array
                   items:
                     type: string
-                tower_task_extra_env:
+                task_extra_env:
                   type: string
-                tower_web_extra_env:
+                web_extra_env:
                   type: string
-                tower_ee_extra_volume_mounts:
+                ee_extra_env:
+                  type: string
+                ee_extra_volume_mounts:
                   description: Specify volume mounts to be added to Execution container
                   type: string
-                tower_task_extra_volume_mounts:
+                task_extra_volume_mounts:
                   description: Specify volume mounts to be added to Task container
                   type: string
-                tower_web_extra_volume_mounts:
+                web_extra_volume_mounts:
                   description: Specify volume mounts to be added to the Web container
                   type: string
-                tower_redis_image:
+                redis_image:
                   description: Registry path to the redis container to use
                   type: string
-                tower_redis_image_version:
+                redis_image_version:
                   description: Redis container image version to use
                   type: string
-                tower_postgres_image:
+                init_container_image:
+                  description: Registry path to the init container to use
+                  type: string
+                init_container_image_version:
+                  description: Init container image version to use
+                  type: string
+                init_container_extra_commands:
+                  description: Extra commands for the init container
+                  type: string
+                init_container_extra_volume_mounts:
+                  description: Specify volume mounts to be added to the init container
+                  type: string
+                postgres_image:
                   description: Registry path to the PostgreSQL container to use
                   type: string
-                tower_postgres_image_version:
+                postgres_image_version:
                   description: PostgreSQL container image version to use
                   type: string
-                tower_postgres_selector:
+                postgres_selector:
                   description: nodeSelector for the Postgres pods
                   type: string
-                tower_postgres_tolerations:
+                postgres_tolerations:
                   description: node tolerations for the Postgres pods
                   type: string
-                tower_postgres_storage_requirements:
+                postgres_storage_requirements:
                   description: Storage requirements for the PostgreSQL container
                   properties:
                     requests:
@@ -269,7 +326,7 @@ spec:
                           type: string
                       type: object
                   type: object
-                tower_postgres_resource_requirements:
+                postgres_resource_requirements:
                   description: Resource requirements for the PostgreSQL container
                   properties:
                     requests:
@@ -287,10 +344,10 @@ spec:
                           type: string
                       type: object
                   type: object
-                tower_postgres_storage_class:
+                postgres_storage_class:
                   description: Storage class to use for the PostgreSQL PVC
                   type: string
-                tower_postgres_data_path:
+                postgres_data_path:
                   description: Path where the PostgreSQL data are located
                   type: string
                 ca_trust_bundle:
@@ -302,27 +359,30 @@ spec:
                 ldap_cacert_secret:
                   description: Secret where can be found the LDAP trusted Certificate Authority Bundle
                   type: string
-                tower_projects_persistence:
+                bundle_cacert_secret:
+                  description: Secret where can be found the trusted Certificate Authority Bundle
+                  type: string
+                projects_persistence:
                   description: Whether or not the /var/lib/projects directory will be persistent
                   default: false
                   type: boolean
-                tower_projects_use_existing_claim:
+                projects_use_existing_claim:
                   description: Using existing PersistentVolumeClaim
                   type: string
                   enum:
                     - _Yes_
                     - _No_
-                tower_projects_existing_claim:
+                projects_existing_claim:
                   description: PersistentVolumeClaim to mount /var/lib/projects directory
                   type: string
-                tower_projects_storage_class:
+                projects_storage_class:
                   description: Storage class for the /var/lib/projects PersistentVolumeClaim
                   type: string
-                tower_projects_storage_size:
+                projects_storage_size:
                   description: Size for the /var/lib/projects PersistentVolumeClaim
                   default: 8Gi
                   type: string
-                tower_projects_storage_access_mode:
+                projects_storage_access_mode:
                   description: AccessMode for the /var/lib/projects PersistentVolumeClaim
                   default: ReadWriteMany
                   type: string
@@ -333,28 +393,37 @@ spec:
                       setting:
                         type: string
                       value:
-                        type: string
+                        x-kubernetes-preserve-unknown-fields: true
                     type: object
                   type: array
               type: object
             status:
               properties:
-                towerURL:
+                URL:
                   description: URL to access the deployed instance
                   type: string
-                towerAdminUser:
+                adminUser:
                   description: Admin user of the deployed instance
                   type: string
-                towerAdminPasswordSecret:
-                  description: Admin password of the deployed instance
+                adminPasswordSecret:
+                  description: Admin password secret name of the deployed instance
                   type: string
-                towerMigratedFromSecret:
-                  description: The secret used for migrating an old Tower.
+                postgresConfigurationSecret:
+                  description: Postgres Configuration secret name of the deployed instance
                   type: string
-                towerVersion:
+                broadcastWebsocketSecret:
+                  description: Broadcast websocket secret name of the deployed instance
+                  type: string
+                secretKeySecret:
+                  description: Secret key secret name of the deployed instance
+                  type: string
+                migratedFromSecret:
+                  description: The secret used for migrating an old instance.
+                  type: string
+                version:
                   description: Version of the deployed instance
                   type: string
-                towerImage:
+                image:
                   description: URL of the image used for the deployed instance
                   type: string
                 conditions:

deploy/crds/awx_v1beta1_molecule.yaml

@@ -5,13 +5,19 @@ metadata:
   name: example-awx
   namespace: example-awx
 spec:
+  service_account_annotations: |
+    foo: bar
   deployment_type: awx
-  tower_ingress_type: ingress
-  tower_web_resource_requirements:
+  ingress_type: ingress
+  web_resource_requirements:
     requests:
       cpu: 500m
       memory: 128M
-  tower_task_resource_requirements:
+  task_resource_requirements:
     requests:
       cpu: 500m
       memory: 128M
+  ee_resource_requirements:
+    requests:
+      cpu: 200m
+      memory: 64M

deploy/crds/awxbackup_v1beta1_crd.yaml

@@ -0,0 +1,78 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: awxbackups.awx.ansible.com
+spec:
+  group: awx.ansible.com
+  names:
+    kind: AWXBackup
+    listKind: AWXBackupList
+    plural: awxbackups
+    singular: awxbackup
+  scope: Namespaced
+  versions:
+    - name: v1beta1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+          description: Schema validation for the AWXBackup CRD
+          properties:
+            spec:
+              type: object
+              required:
+                - deployment_name
+              properties:
+                deployment_name:
+                  description: Name of the deployment to be backed up
+                  type: string
+                backup_pvc:
+                  description: Name of the PVC to be used for storing the backup
+                  type: string
+                backup_pvc_namespace:
+                  description: Namespace the PVC is in
+                  type: string
+                backup_storage_requirements:
+                  description: Storage requirements for the PostgreSQL container
+                  type: string
+                backup_storage_class:
+                  description: Storage class to use when creating PVC for backup
+                  type: string
+                postgres_label_selector:
+                  description: Label selector used to identify postgres pod for backing up data
+                  type: string
+                postgres_image:
+                  description: Registry path to the PostgreSQL container to use
+                  type: string
+                postgres_image_version:
+                  description: PostgreSQL container image version to use
+                  type: string
+            status:
+              type: object
+              properties:
+                conditions:
+                  description: The resulting conditions when a Service Telemetry is
+                    instantiated
+                  items:
+                    properties:
+                      lastTransitionTime:
+                        type: string
+                      reason:
+                        type: string
+                      status:
+                        type: string
+                      type:
+                        type: string
+                    type: object
+                  type: array
+                backupDirectory:
+                  description: Backup directory name on the specified pvc
+                  type: string
+                backupClaim:
+                  description: Backup persistent volume claim
+                  type: string

deploy/crds/awxrestore_v1beta1_crd.yaml

@@ -0,0 +1,79 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: awxrestores.awx.ansible.com
+spec:
+  group: awx.ansible.com
+  names:
+    kind: AWXRestore
+    listKind: AWXRestoreList
+    plural: awxrestores
+    singular: awxrestore
+  scope: Namespaced
+  versions:
+    - name: v1beta1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+          description: Schema validation for the AWXRestore CRD
+          properties:
+            spec:
+              type: object
+              properties:
+                backup_source:
+                  description: Backup source
+                  type: string
+                  enum:
+                    - CR
+                    - PVC
+                deployment_name:
+                  description: Name of the deployment to be restored to
+                  type: string
+                backup_name:
+                  description: AWXBackup object name
+                  type: string
+                backup_pvc:
+                  description: Name of the PVC to be restored from, set as a status found on the awxbackup object (backupClaim)
+                  type: string
+                backup_pvc_namespace:
+                  description: Namespace the PVC is in
+                  type: string
+                backup_dir:
+                  description: Backup directory name, set as a status found on the awxbackup object (backupDirectory)
+                  type: string
+                postgres_label_selector:
+                  description: Label selector used to identify postgres pod for backing up data
+                  type: string
+                postgres_image:
+                  description: Registry path to the PostgreSQL container to use
+                  type: string
+                postgres_image_version:
+                  description: PostgreSQL container image version to use
+                  type: string
+            status:
+              type: object
+              properties:
+                conditions:
+                  description: The resulting conditions when a Service Telemetry is
+                    instantiated
+                  items:
+                    properties:
+                      lastTransitionTime:
+                        type: string
+                      reason:
+                        type: string
+                      status:
+                        type: string
+                      type:
+                        type: string
+                    type: object
+                  type: array
+                restoreComplete:
+                  description: Restore process complete
+                  type: boolean

deploy/olm-catalog/awx-operator/manifests/awx-operator.clusterserviceversion.yaml

@@ -13,14 +13,21 @@ metadata:
           },
           "spec": {
             "deployment_type": "awx",
-            "tower_ingress_type": "ingress",
-            "tower_task_resource_requirements": {
+            "ee_resource_requirements": {
+              "requests": {
+                "cpu": "200m",
+                "memory": "64M"
+              }
+            },
+            "ingress_type": "ingress",
+            "service_account_annotations": "foo: bar\n",
+            "task_resource_requirements": {
               "requests": {
                 "cpu": "500m",
                 "memory": "128M"
               }
             },
-            "tower_web_resource_requirements": {
+            "web_resource_requirements": {
               "requests": {
                 "cpu": "500m",
                 "memory": "128M"
@@ -32,158 +39,283 @@ metadata:
     capabilities: Basic Install
     operators.operatorframework.io/builder: operator-sdk-v0.19.4
     operators.operatorframework.io/project_layout: ansible
-  name: awx-operator.v0.0.1
+  name: awx-operator.v0.13.0
   namespace: placeholder
 spec:
   apiservicedefinitions: {}
   customresourcedefinitions:
     owned:
+    - displayName: AWX Backup
+      kind: AWXBackup
+      name: awxbackups.awx.ansible.com
+      specDescriptors:
+      - displayName: Deployment name
+        path: deployment_name
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+      - displayName: Backup persistent volume claim
+        path: backup_pvc
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+      - displayName: Backup persistent volume claim namespace
+        path: backup_pvc_namespace
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+      - displayName: Backup PVC storage requirements
+        path: backup_storage_requirements
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+      - displayName: Backup PVC storage class
+        path: backup_storage_class
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+      - displayName: Database backup label selector
+        path: postgres_label_selector
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:hidden
+      - displayName: PostgreSQL Image
+        path: postgres_image
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:hidden
+      - displayName: PostgreSQL Image Version
+        path: postgres_image_version
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:hidden
+      statusDescriptors:
+      - description: The persistent volume claim name used during backup
+        displayName: Backup claim
+        path: backupClaim
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+      - description: The directory data is backed up to on the PVC
+        displayName: Backup directory
+        path: backupDirectory
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+      version: v1beta1
+    - displayName: AWX Restore
+      kind: AWXRestore
+      name: awxrestores.awx.ansible.com
+      specDescriptors:
+      - displayName: Backup source to restore ?
+        path: backup_source
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:select:CR
+        - urn:alm:descriptor:com.tectonic.ui:select:PVC
+      - displayName: Backup name
+        path: backup_name
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:backup_source:CR
+      - displayName: Name of newly restored deployment
+        path: deployment_name
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+      - displayName: Backup persistent volume claim
+        path: backup_pvc
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:backup_source:PVC
+      - displayName: Backup namespace
+        path: backup_pvc_namespace
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+      - displayName: Backup directory in the persistent volume claim
+        path: backup_dir
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:backup_source:PVC
+      - displayName: Database restore label selector
+        path: postgres_label_selector
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:hidden
+      - displayName: PostgreSQL Image
+        path: postgres_image
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:hidden
+      - displayName: PostgreSQL Image Version
+        path: postgres_image_version
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:hidden
+      statusDescriptors:
+      - description: The state of the restore
+        displayName: Restore status
+        path: restoreComplete
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+      version: v1beta1
     - description: A AWX Instance
       displayName: AWX
       kind: AWX
       name: awxs.awx.ansible.com
       specDescriptors:
       - displayName: Hostname
-        path: tower_hostname
+        path: hostname
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:text
       - displayName: Admin account username
-        path: tower_admin_user
+        path: admin_user
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:text
       - displayName: Admin email address
-        path: tower_admin_email
+        path: admin_email
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:text
       - displayName: Admin password secret
-        path: tower_admin_password_secret
+        path: admin_password_secret
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:io.kubernetes:Secret
       - displayName: Database configuration secret
-        path: tower_postgres_configuration_secret
+        path: postgres_configuration_secret
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:io.kubernetes:Secret
       - displayName: Old Database configuration secret
-        path: tower_old_postgres_configuration_secret
+        path: old_postgres_configuration_secret
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:io.kubernetes:Secret
       - displayName: Secret key secret
-        path: tower_secret_key_secret
+        path: secret_key_secret
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:io.kubernetes:Secret
       - displayName: Broadcast Websocket Secret
-        path: tower_broadcast_websocket_secret
+        path: broadcast_websocket_secret
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:io.kubernetes:Secret
-      - displayName: Ingress Type
-        path: tower_ingress_type
+      - displayName: Service Account Annotations
+        path: service_account_annotations
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:text
+      - displayName: Tower Service Type
+        path: service_type
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:select:ClusterIP
+        - urn:alm:descriptor:com.tectonic.ui:select:LoadBalancer
+        - urn:alm:descriptor:com.tectonic.ui:select:NodePort
+      - displayName: Tower Ingress Type
+        path: ingress_type
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:select:none
         - urn:alm:descriptor:com.tectonic.ui:select:Ingress
         - urn:alm:descriptor:com.tectonic.ui:select:Route
-        - urn:alm:descriptor:com.tectonic.ui:select:LoadBalancer
-        - urn:alm:descriptor:com.tectonic.ui:select:NodePort
       - displayName: Tower Ingress Annotations
-        path: tower_ingress_annotations
+        path: ingress_annotations
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:text
-        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:tower_ingress_type:Ingress
+        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:ingress_type:Ingress
       - displayName: Tower Ingress TLS Secret
-        path: tower_ingress_tls_secret
+        path: ingress_tls_secret
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:io.kubernetes:Secret
-        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:tower_ingress_type:Ingress
+        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:ingress_type:Ingress
       - displayName: Tower LoadBalancer Annotations
-        path: tower_loadbalancer_annotations
+        path: loadbalancer_annotations
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:text
-        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:tower_ingress_type:LoadBalancer
+        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:service_type:LoadBalancer
       - displayName: Tower LoadBalancer Protocol
-        path: tower_loadbalancer_protocol
+        path: loadbalancer_protocol
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:select:http
         - urn:alm:descriptor:com.tectonic.ui:select:https
-        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:tower_ingress_type:LoadBalancer
+        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:service_type:LoadBalancer
       - displayName: Tower LoadBalancer Port
-        path: tower_loadbalancer_port
+        path: loadbalancer_port
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:number
-        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:tower_ingress_type:LoadBalancer
+        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:service_type:LoadBalancer
       - displayName: Route DNS host
-        path: tower_route_host
+        path: route_host
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:text
-        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:tower_ingress_type:Route
+        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:ingress_type:Route
       - displayName: Route TLS termination mechanism
-        path: tower_route_tls_termination_mechanism
+        path: route_tls_termination_mechanism
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:select:Edge
         - urn:alm:descriptor:com.tectonic.ui:select:Passthrough
-        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:tower_ingress_type:Route
+        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:ingress_type:Route
       - displayName: Route TLS credential secret
-        path: tower_route_tls_secret
+        path: route_tls_secret
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:io.kubernetes:Secret
-        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:tower_ingress_type:Route
+        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:ingress_type:Route
       - displayName: Image Pull Policy
-        path: tower_image_pull_policy
+        path: image_pull_policy
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:imagePullPolicy
       - displayName: Image Pull Secret
-        path: tower_image_pull_secret
+        path: image_pull_secret
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
-        - urn:alm:descriptor:com.tectonic.ui:imagePullSecret
+        - urn:alm:descriptor:io.kubernetes:Secret
       - displayName: Web container resource requirements
-        path: tower_web_resource_requirements
+        path: web_resource_requirements
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:resourceRequirements
       - displayName: Task container resource requirements
-        path: tower_task_resource_requirements
+        path: task_resource_requirements
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:resourceRequirements
-      - displayName: PostgreSQL container resource requirements (when using a managed instance)
-        path: tower_postgres_resource_requirements
+      - displayName: EE Control Plane container resource requirements
+        path: ee_resource_requirements
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:resourceRequirements
-      - displayName: PostgreSQL container storage requirements (when using a managed instance)
-        path: tower_postgres_storage_requirements
+      - displayName: PostgreSQL container resource requirements (when using a managed
+          instance)
+        path: postgres_resource_requirements
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:resourceRequirements
+      - displayName: PostgreSQL container storage requirements (when using a managed
+          instance)
+        path: postgres_storage_requirements
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:resourceRequirements
       - displayName: Replicas
-        path: tower_replicas
+        path: replicas
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:number
       - displayName: Remove used secrets on instance removal ?
-        path: tower_garbage_collect_secrets
+        path: garbage_collect_secrets
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:booleanSwitch
       - displayName: Preload instance with data upon creation ?
-        path: tower_create_preload_data
+        path: create_preload_data
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:booleanSwitch
@@ -193,8 +325,8 @@ spec:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:booleanSwitch
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Should Tower Task container deployed with privileged level ?
-        path: tower_task_privileged
+      - displayName: Should the task container deployed with privileged level ?
+        path: task_privileged
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:booleanSwitch
@@ -214,53 +346,58 @@ spec:
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Tower Image
-        path: tower_image
+      - displayName: Image
+        path: image
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Tower Image Version
-        path: tower_image_version
+      - displayName: Image Version
+        path: image_version
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
       - displayName: Redis Image
-        path: tower_redis_image
+        path: redis_image
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
       - displayName: Redis Image Version
-        path: tower_redis_image_version
+        path: redis_image_version
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
       - displayName: PostgreSQL Image
-        path: tower_postgres_image
+        path: postgres_image
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
       - displayName: PostgreSQL Image Version
-        path: tower_postgres_image_version
+        path: postgres_image_version
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Tower Postgres Selector
-        path: tower_postgres_selector
+      - displayName: Postgres Selector
+        path: postgres_selector
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Tower Postgres Tolerations
-        path: tower_postgres_tolerations
+      - displayName: Postgres Label Selector
+        path: postgres_label_selector
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Tower Postgres Storage Class
-        path: tower_postgres_storage_class
+      - displayName: Postgres Tolerations
+        path: postgres_tolerations
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Tower Postgres Datapath
-        path: tower_postgres_data_path
+      - displayName: Postgres Storage Class
+        path: postgres_storage_class
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:hidden
+      - displayName: Postgres Datapath
+        path: postgres_data_path
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
@@ -274,115 +411,140 @@ spec:
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:io.kubernetes:Secret
-      - displayName: Tower Task Args
-        path: tower_task_args
+      - displayName: Task Args
+        path: task_args
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
       - displayName: Enable persistence for /var/lib/projects directory?
-        path: tower_projects_persistence
+        path: projects_persistence
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:booleanSwitch
       - displayName: Use existing Persistent Claim?
-        path: tower_projects_use_existing_claim
+        path: projects_use_existing_claim
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:select:_Yes_
         - urn:alm:descriptor:com.tectonic.ui:select:_No_
-        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:tower_projects_persistence:true
-      - displayName: Tower Projects Existing Persistent Claim
-        path: tower_projects_existing_claim
+        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:projects_persistence:true
+      - displayName: Projects Existing Persistent Claim
+        path: projects_existing_claim
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
-        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:tower_projects_use_existing_claim:_Yes_
+        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:projects_use_existing_claim:_Yes_
         - urn:alm:descriptor:io.kubernetes:PersistentVolumeClaim
-      - description: Tower Projects Storage Class Name. If not present, the default
-          storage class will be used.
-        displayName: Tower Projects Storage Class Name
-        path: tower_projects_storage_class
+      - description: Projects Storage Class Name. If not present, the default storage
+          class will be used.
+        displayName: Projects Storage Class Name
+        path: projects_storage_class
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
-        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:tower_projects_use_existing_claim:_No_
+        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:projects_use_existing_claim:_No_
         - urn:alm:descriptor:com.tectonic.ui:text
-      - description: Tower Projects Storage Size
-        displayName: Tower Projects Storage Size
-        path: tower_projects_storage_size
+      - description: Projects Storage Size
+        displayName: Projects Storage Size
+        path: projects_storage_size
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
-        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:tower_projects_use_existing_claim:_No_
+        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:projects_use_existing_claim:_No_
         - urn:alm:descriptor:com.tectonic.ui:text
-      - description: Tower Projects Storage Access Mode
-        displayName: Tower Projects Storage Access Mode
-        path: tower_projects_storage_access_mode
+      - description: Projects Storage Access Mode
+        displayName: Projects Storage Access Mode
+        path: projects_storage_access_mode
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
-        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:tower_projects_use_existing_claim:_No_
+        - urn:alm:descriptor:com.tectonic.ui:fieldDependency:projects_use_existing_claim:_No_
         - urn:alm:descriptor:com.tectonic.ui:text
-      - displayName: Tower Task Command
-        path: tower_task_command
+      - displayName: Task Command
+        path: task_command
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Tower Task Extra Env
-        description: Environment variables to be added to Task container
-        path: tower_task_extra_env
+      - description: Environment variables to be added to Task container
+        displayName: Task Extra Env
+        path: task_extra_env
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: 
-        path: tower_ee_extra_volume_mounts
-        description: Specify volume mounts to be added to Execution container
+      - description: Specify volume mounts to be added to Execution container
+        displayName: EE Extra Volume Mounts
+        path: ee_extra_volume_mounts
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Tower EE Images
-        description: Registry path to the Execution Environment container to use
-        path: tower_ee_images
+      - description: Registry path to the Execution Environment container to use
+        displayName: EE Images
+        path: ee_images
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Tower Task Extra Volume Mounts
-        description: Specify volume mounts to be added to Task container
-        path: tower_task_extra_volume_mounts
+      - description: Environment variables to be added to EE container
+        displayName: EE Extra Env
+        path: ee_extra_env
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Tower Web Args
-        path: tower_web_args
+      - description: Registry path to the Execution Environment container to use on
+          control plane pods
+        displayName: Control Plane EE Image
+        path: control_plane_ee_image
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Tower Web Command
-        path: tower_web_command
+      - description: EE Images Pull Credentials Secret
+        displayName: EE Images Pull Credentials Secret
+        path: ee_pull_credentials_secret
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:io.kubernetes:Secret
+      - description: Specify volume mounts to be added to Task container
+        displayName: Task Extra Volume Mounts
+        path: task_extra_volume_mounts
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Tower Web Extra Env
-        description: Environment variables to be added to Web container
-        path: tower_web_extra_env
+      - displayName: Web Args
+        path: web_args
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Tower Web Extra Volume Mounts
-        description: Specify volume mounts to be added to Web container
-        path: tower_web_extra_volume_mounts
+      - displayName: Web Command
+        path: web_command
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Tower Extra Volumes
-        description: Specify extra volumes to add to the application pod
-        path: tower_extra_volumes
+      - description: Environment variables to be added to Web container
+        displayName: Web Extra Env
+        path: web_extra_env
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Tower Node Selector
-        path: tower_node_selector
+      - description: Specify volume mounts to be added to Web container
+        displayName: Web Extra Volume Mounts
+        path: web_extra_volume_mounts
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
-      - displayName: Tower Tolerations
-        path: tower_tolerations
+      - description: Specify extra volumes to add to the application pod
+        displayName: Extra Volumes
+        path: extra_volumes
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:hidden
+      - displayName: Node Selector
+        path: node_selector
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:hidden
+      - displayName: Service Labels
+        path: service_labels
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:text
+        - urn:alm:descriptor:com.tectonic.ui:hidden
+      - displayName: Tolerations
+        path: tolerations
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
@@ -391,30 +553,59 @@ spec:
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
         - urn:alm:descriptor:com.tectonic.ui:hidden
+      - description: Registry path to the init container to use
+        displayName: Init Container Image
+        path: init_container_image
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:hidden
+      - description: Init container image version to use
+        displayName: Init Container Image Version
+        path: init_container_image_version
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:hidden
+      - description: Specify Extra commands for the Init container
+        displayName: Init Container Extra Commands
+        path: init_container_extra_commands
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:hidden
+      - description: Specify volume mounts to be added to Init container
+        displayName: Init Container Extra Volume Mounts
+        path: init_container_extra_volume_mounts
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:hidden
+      - description: Secret where can be found the trusted Certificate Authority Bundle
+        path: bundle_cacert_secret
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:io.kubernetes:Secret
       statusDescriptors:
       - description: Route to access the instance deployed
         displayName: URL
-        path: towerURL
+        path: URL
         x-descriptors:
         - urn:alm:descriptor:org.w3:link
       - description: Admin user for the instance deployed
         displayName: Admin User
-        path: towerAdminUser
+        path: adminUser
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:text
       - description: Admin password for the instance deployed
         displayName: Admin Password
-        path: towerAdminPasswordSecret
+        path: adminPasswordSecret
         x-descriptors:
         - urn:alm:descriptor:io.kubernetes:Secret
       - description: Version of the instance deployed
         displayName: Version
-        path: towerVersion
+        path: version
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:text
       - description: Image of the instance deployed
         displayName: Image
-        path: towerImage
+        path: image
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:text
       version: v1beta1
@@ -501,6 +692,8 @@ spec:
           - awx.ansible.com
           resources:
           - '*'
+          - awxbackups
+          - awxrestores
           verbs:
           - '*'
         serviceAccountName: awx-operator
@@ -531,7 +724,11 @@ spec:
                   value: awx-operator
                 - name: ANSIBLE_GATHERING
                   value: explicit
-                image: quay.io/ansible/awx-operator:0.8.0
+                - name: OPERATOR_VERSION
+                  value: 0.13.0
+                - name: ANSIBLE_DEBUG_LOGS
+                  value: "false"
+                image: quay.io/ansible/awx-operator:0.13.0
                 imagePullPolicy: Always
                 livenessProbe:
                   httpGet:
@@ -570,4 +767,5 @@ spec:
   provider:
     name: AWX Community
     url: https://github.com/ansible/awx-operator
-  version: 0.0.1
+  replaces: awx-operator.v0.12.0
+  version: 0.13.0

deploy/olm-catalog/awx-operator/manifests/awx.ansible.com_awxbackups_crd.yaml

@@ -0,0 +1,85 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  creationTimestamp: null
+  name: awxbackups.awx.ansible.com
+spec:
+  group: awx.ansible.com
+  names:
+    kind: AWXBackup
+    listKind: AWXBackupList
+    plural: awxbackups
+    singular: awxbackup
+  scope: Namespaced
+  versions:
+  - name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: Schema validation for the AWXBackup CRD
+        properties:
+          spec:
+            properties:
+              backup_pvc:
+                description: Name of the PVC to be used for storing the backup
+                type: string
+              backup_pvc_namespace:
+                description: Namespace the PVC is in
+                type: string
+              backup_storage_class:
+                description: Storage class to use when creating PVC for backup
+                type: string
+              backup_storage_requirements:
+                description: Storage requirements for the PostgreSQL container
+                type: string
+              deployment_name:
+                description: Name of the deployment to be backed up
+                type: string
+              postgres_image:
+                description: Registry path to the PostgreSQL container to use
+                type: string
+              postgres_image_version:
+                description: PostgreSQL container image version to use
+                type: string
+              postgres_label_selector:
+                description: Label selector used to identify postgres pod for backing
+                  up data
+                type: string
+            required:
+            - deployment_name
+            type: object
+          status:
+            properties:
+              backupClaim:
+                description: Backup persistent volume claim
+                type: string
+              backupDirectory:
+                description: Backup directory name on the specified pvc
+                type: string
+              conditions:
+                description: The resulting conditions when a Service Telemetry is
+                  instantiated
+                items:
+                  properties:
+                    lastTransitionTime:
+                      type: string
+                    reason:
+                      type: string
+                    status:
+                      type: string
+                    type:
+                      type: string
+                  type: object
+                type: array
+            type: object
+        type: object
+        x-kubernetes-preserve-unknown-fields: true
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null

deploy/olm-catalog/awx-operator/manifests/awx.ansible.com_awxrestores_crd.yaml

@@ -0,0 +1,88 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  creationTimestamp: null
+  name: awxrestores.awx.ansible.com
+spec:
+  group: awx.ansible.com
+  names:
+    kind: AWXRestore
+    listKind: AWXRestoreList
+    plural: awxrestores
+    singular: awxrestore
+  scope: Namespaced
+  versions:
+  - name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: Schema validation for the AWXRestore CRD
+        properties:
+          spec:
+            properties:
+              backup_dir:
+                description: Backup directory name, set as a status found on the awxbackup
+                  object (backupDirectory)
+                type: string
+              backup_name:
+                description: AWXBackup object name
+                type: string
+              backup_pvc:
+                description: Name of the PVC to be restored from, set as a status
+                  found on the awxbackup object (backupClaim)
+                type: string
+              backup_pvc_namespace:
+                description: Namespace the PVC is in
+                type: string
+              backup_source:
+                description: Backup source
+                enum:
+                - CR
+                - PVC
+                type: string
+              deployment_name:
+                description: Name of the deployment to be restored to
+                type: string
+              postgres_image:
+                description: Registry path to the PostgreSQL container to use
+                type: string
+              postgres_image_version:
+                description: PostgreSQL container image version to use
+                type: string
+              postgres_label_selector:
+                description: Label selector used to identify postgres pod for backing
+                  up data
+                type: string
+            type: object
+          status:
+            properties:
+              conditions:
+                description: The resulting conditions when a Service Telemetry is
+                  instantiated
+                items:
+                  properties:
+                    lastTransitionTime:
+                      type: string
+                    reason:
+                      type: string
+                    status:
+                      type: string
+                    type:
+                      type: string
+                  type: object
+                type: array
+              restoreComplete:
+                description: Restore process complete
+                type: boolean
+            type: object
+        type: object
+        x-kubernetes-preserve-unknown-fields: true
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null

deploy/olm-catalog/awx-operator/manifests/awx.ansible.com_awxs_crd.yaml

@@ -19,46 +19,49 @@ spec:
         properties:
           spec:
             properties:
-              ca_trust_bundle:
-                description: Path where the trusted CA bundle is available
-                type: string
-              deployment_type:
-                description: Name of the deployment type
-                type: string
-                default: awx
-              kind:
-                description: Kind of the deployment type
-                type: string
-                default: AWX
-              api_version:
-                description: apiVersion of the deployment type
-                type: string
-                default: awx.ansible.com/v1beta1
-              development_mode:
-                description: If the deployment should be done in development mode
-                type: boolean
-              ldap_cacert_secret:
-                description: Secret where can be found the LDAP trusted Certificate
-                  Authority Bundle
-                type: string
-              tower_admin_email:
+              admin_email:
                 description: The admin user email
                 type: string
-              tower_admin_password_secret:
+              admin_password_secret:
                 description: Secret where the admin password can be found
                 type: string
-              tower_admin_user:
+              admin_user:
                 default: admin
                 description: Username to use for the admin account
                 type: string
-              tower_broadcast_websocket_secret:
+              api_version:
+                description: apiVersion of the deployment type
+                type: string
+              broadcast_websocket_secret:
                 description: Secret where the broadcast websocket secret can be found
                 type: string
-              tower_create_preload_data:
+              bundle_cacert_secret:
+                description: Secret where can be found the trusted Certificate Authority
+                  Bundle
+                type: string
+              ca_trust_bundle:
+                description: Path where the trusted CA bundle is available
+                type: string
+              control_plane_ee_image:
+                description: Registry path to the Execution Environment container
+                  image to use on control plane pods
+                type: string
+              create_preload_data:
                 default: true
-                description: Whether or not to preload data upon Tower instance creation
+                description: Whether or not to preload data upon instance creation
                 type: boolean
-              tower_ee_images:
+              deployment_type:
+                description: Name of the deployment type
+                type: string
+              development_mode:
+                description: If the deployment should be done in development mode
+                type: boolean
+              ee_extra_env:
+                type: string
+              ee_extra_volume_mounts:
+                description: Specify volume mounts to be added to Execution container
+                type: string
+              ee_images:
                 description: Registry path to the Execution Environment container
                   to use
                 items:
@@ -69,245 +72,12 @@ spec:
                       type: string
                   type: object
                 type: array
-              tower_extra_volumes:
-                description: Specify extra volumes to add to the application pod
+              ee_pull_credentials_secret:
+                description: Secret where pull credentials for registered ees can
+                  be found
                 type: string
-              tower_garbage_collect_secrets:
-                default: false
-                description: Whether or not to remove secrets upon instance removal
-                type: boolean
-              tower_hostname:
-                description: The hostname of the instance
-                type: string
-              tower_image:
-                description: Registry path to the application container to use
-                type: string
-              tower_image_version:
-                description: Application container image version to use
-                type: string
-              tower_image_pull_policy:
-                default: IfNotPresent
-                description: The image pull policy
-                enum:
-                - Always
-                - always
-                - Never
-                - never
-                - IfNotPresent
-                - ifnotpresent
-                type: string
-              tower_image_pull_secret:
-                description: The image pull secret
-                type: string
-              tower_ingress_annotations:
-                description: Annotations to add to the ingress
-                type: string
-              tower_ingress_tls_secret:
-                description: Secret where the ingress TLS secret can be found
-                type: string
-              tower_ingress_type:
-                description: The ingress type to use to reach the deployed instance
-                enum:
-                - none
-                - Ingress
-                - ingress
-                - Route
-                - route
-                - LoadBalancer
-                - loadbalancer
-                - NodePort
-                - nodeport
-                type: string
-              tower_loadbalancer_annotations:
-                description: Annotations to add to the loadbalancer
-                type: string
-              tower_loadbalancer_port:
-                default: 80
-                description: Port to use for the loadbalancer
-                type: integer
-              tower_loadbalancer_protocol:
-                default: http
-                description: Protocol to use for the loadbalancer
-                enum:
-                - http
-                - https
-                type: string
-              tower_node_selector:
-                description: nodeSelector for the AWX pods
-                type: string
-              tower_old_postgres_configuration_secret:
-                description: Secret where the old database configuration can be found
-                  for data migration
-                type: string
-              tower_postgres_configuration_secret:
-                description: Secret where the database configuration can be found
-                type: string
-              tower_postgres_data_path:
-                description: Path where the PostgreSQL data are located
-                type: string
-              tower_postgres_image:
-                description: Registry path to the PostgreSQL container to use
-                type: string
-              tower_postgres_image_version:
-                description: PostgreSQL container image version to use
-                type: string
-              tower_postgres_selector:
-                description: nodeSelector for the Postgres pods
-                type: string
-              tower_postgres_tolerations:
-                description: node tolerations for the Postgres pods
-                type: string
-              tower_postgres_storage_requirements:
-                description: Storage requirements for the PostgreSQL container
-                properties:
-                  requests:
-                    properties:
-                      storage:
-                        type: string
-                    type: object
-                  limits:
-                    properties:
-                      storage:
-                        type: string
-                    type: object
-                type: object
-              tower_postgres_resource_requirements:
-                description: Resource requirements for the PostgreSQL container
-                properties:
-                  requests:
-                    properties:
-                      cpu:
-                        type: string
-                      memory:
-                        type: string
-                    type: object
-                  limits:
-                    properties:
-                      cpu:
-                        type: string
-                      memory:
-                        type: string
-                    type: object
-                type: object
-              tower_postgres_storage_class:
-                description: Storage class to use for the PostgreSQL PVC
-                type: string
-              tower_projects_existing_claim:
-                description: PersistentVolumeClaim to mount /var/lib/projects directory
-                type: string
-              tower_projects_persistence:
-                default: false
-                description: Whether or not the /var/lib/projects directory will be
-                  persistent
-                type: boolean
-              tower_projects_storage_access_mode:
-                default: ReadWriteMany
-                description: AccessMode for the /var/lib/projects PersistentVolumeClaim
-                type: string
-              tower_projects_storage_class:
-                description: Storage class for the /var/lib/projects PersistentVolumeClaim
-                type: string
-              tower_projects_storage_size:
-                default: 8Gi
-                description: Size for the /var/lib/projects PersistentVolumeClaim
-                type: string
-              tower_projects_use_existing_claim:
-                description: Using existing PersistentVolumeClaim
-                enum:
-                - _Yes_
-                - _No_
-                type: string
-              tower_redis_image:
-                description: Registry path to the redis container to use
-                type: string
-              tower_redis_image_version:
-                description: Redis container image version to use
-                type: string
-              tower_replicas:
-                default: 1
-                description: Number of instance replicas
-                format: int32
-                type: integer
-              tower_route_host:
-                description: The DNS to use to points to the instance
-                type: string
-              tower_route_tls_secret:
-                description: Secret where the TLS related credentials are stored
-                type: string
-              tower_route_tls_termination_mechanism:
-                default: Edge
-                description: The secure TLS termination mechanism to use
-                enum:
-                - Edge
-                - edge
-                - Passthrough
-                - passthrough
-                type: string
-              tower_secret_key_secret:
-                description: Secret where the secret key can be found
-                type: string
-              tower_task_args:
-                items:
-                  type: string
-                type: array
-              tower_task_command:
-                items:
-                  type: string
-                type: array
-              tower_task_extra_env:
-                description: Environment variables to be added to Task container
-                type: string
-              tower_ee_extra_volume_mounts:
-                description: Specify volume mounts to be added to Execution container
-                type: string
-              tower_task_extra_volume_mounts:
-                description: Specify volume mounts to be added to Task container
-                type: string
-              tower_task_privileged:
-                default: false
-                description: If a privileged security context should be enabled
-                type: boolean
-              tower_task_resource_requirements:
-                description: Resource requirements for the task container
-                properties:
-                  limits:
-                    properties:
-                      cpu:
-                        type: string
-                      memory:
-                        type: string
-                      storage:
-                        type: string
-                    type: object
-                  requests:
-                    properties:
-                      cpu:
-                        type: string
-                      memory:
-                        type: string
-                      storage:
-                        type: string
-                    type: object
-                type: object
-              tower_tolerations:
-                description: node tolerations for the AWX pods
-                type: string
-              tower_web_args:
-                items:
-                  type: string
-                type: array
-              tower_web_command:
-                items:
-                  type: string
-                type: array
-              tower_web_extra_env:
-                description: Environment variables to be added to Web container
-                type: string
-              tower_web_extra_volume_mounts:
-                description: Specify volume mounts to be added to web container
-                type: string
-              tower_web_resource_requirements:
-                description: Resource requirements for the web container
+              ee_resource_requirements:
+                description: Resource requirements for the ee container
                 properties:
                   limits:
                     properties:
@@ -335,12 +105,316 @@ spec:
                     setting:
                       type: string
                     value:
-                      type: string
+                      x-kubernetes-preserve-unknown-fields: true
                   type: object
                 type: array
+              extra_volumes:
+                description: Specify extra volumes to add to the application pod
+                type: string
+              garbage_collect_secrets:
+                default: false
+                description: Whether or not to remove secrets upon instance removal
+                type: boolean
+              hostname:
+                description: The hostname of the instance
+                type: string
+              image:
+                description: Registry path to the application container to use
+                type: string
+              image_pull_policy:
+                default: IfNotPresent
+                description: The image pull policy
+                enum:
+                - Always
+                - always
+                - Never
+                - never
+                - IfNotPresent
+                - ifnotpresent
+                type: string
+              image_pull_secret:
+                description: The image pull secret
+                type: string
+              image_version:
+                description: Application container image version to use
+                type: string
+              ingress_annotations:
+                description: Annotations to add to the Ingress Controller
+                type: string
+              ingress_path:
+                description: The ingress path used to reach the deployed service
+                type: string
+              ingress_tls_secret:
+                description: Secret where the Ingress TLS secret can be found
+                type: string
+              ingress_type:
+                description: The ingress type to use to reach the deployed instance
+                enum:
+                - none
+                - Ingress
+                - ingress
+                - Route
+                - route
+                type: string
+              init_container_extra_commands:
+                description: Extra commands for the init container
+                type: string
+              init_container_extra_volume_mounts:
+                description: Specify volume mounts to be added to the init container
+                type: string
+              init_container_image:
+                description: Registry path to the init container to use
+                type: string
+              init_container_image_version:
+                description: Init container image version to use
+                type: string
+              kind:
+                description: Kind of the deployment type
+                type: string
+              ldap_cacert_secret:
+                description: Secret where can be found the LDAP trusted Certificate
+                  Authority Bundle
+                type: string
+              loadbalancer_annotations:
+                description: Annotations to add to the loadbalancer
+                type: string
+              loadbalancer_port:
+                default: 80
+                description: Port to use for the loadbalancer
+                type: integer
+              loadbalancer_protocol:
+                default: http
+                description: Protocol to use for the loadbalancer
+                enum:
+                - http
+                - https
+                type: string
+              node_selector:
+                description: nodeSelector for the pods
+                type: string
+              old_postgres_configuration_secret:
+                description: Secret where the old database configuration can be found
+                  for data migration
+                type: string
+              postgres_configuration_secret:
+                description: Secret where the database configuration can be found
+                type: string
+              postgres_data_path:
+                description: Path where the PostgreSQL data are located
+                type: string
+              postgres_image:
+                description: Registry path to the PostgreSQL container to use
+                type: string
+              postgres_image_version:
+                description: PostgreSQL container image version to use
+                type: string
+              postgres_label_selector:
+                description: Label selector used to identify postgres pod for data
+                  migration
+                type: string
+              postgres_resource_requirements:
+                description: Resource requirements for the PostgreSQL container
+                properties:
+                  limits:
+                    properties:
+                      cpu:
+                        type: string
+                      memory:
+                        type: string
+                    type: object
+                  requests:
+                    properties:
+                      cpu:
+                        type: string
+                      memory:
+                        type: string
+                    type: object
+                type: object
+              postgres_selector:
+                description: nodeSelector for the Postgres pods
+                type: string
+              postgres_storage_class:
+                description: Storage class to use for the PostgreSQL PVC
+                type: string
+              postgres_storage_requirements:
+                description: Storage requirements for the PostgreSQL container
+                properties:
+                  limits:
+                    properties:
+                      storage:
+                        type: string
+                    type: object
+                  requests:
+                    properties:
+                      storage:
+                        type: string
+                    type: object
+                type: object
+              postgres_tolerations:
+                description: node tolerations for the Postgres pods
+                type: string
+              projects_existing_claim:
+                description: PersistentVolumeClaim to mount /var/lib/projects directory
+                type: string
+              projects_persistence:
+                default: false
+                description: Whether or not the /var/lib/projects directory will be
+                  persistent
+                type: boolean
+              projects_storage_access_mode:
+                default: ReadWriteMany
+                description: AccessMode for the /var/lib/projects PersistentVolumeClaim
+                type: string
+              projects_storage_class:
+                description: Storage class for the /var/lib/projects PersistentVolumeClaim
+                type: string
+              projects_storage_size:
+                default: 8Gi
+                description: Size for the /var/lib/projects PersistentVolumeClaim
+                type: string
+              projects_use_existing_claim:
+                description: Using existing PersistentVolumeClaim
+                enum:
+                - _Yes_
+                - _No_
+                type: string
+              redis_image:
+                description: Registry path to the redis container to use
+                type: string
+              redis_image_version:
+                description: Redis container image version to use
+                type: string
+              replicas:
+                default: 1
+                description: Number of instance replicas
+                format: int32
+                type: integer
+              route_host:
+                description: The DNS to use to points to the instance
+                type: string
+              route_tls_secret:
+                description: Secret where the TLS related credentials are stored
+                type: string
+              route_tls_termination_mechanism:
+                default: Edge
+                description: The secure TLS termination mechanism to use
+                enum:
+                - Edge
+                - edge
+                - Passthrough
+                - passthrough
+                type: string
+              secret_key_secret:
+                description: Secret where the secret key can be found
+                type: string
+              service_account_annotations:
+                description: ServiceAccount annotations
+                type: string
+              service_labels:
+                description: Additional labels to apply to the service
+                type: string
+              service_type:
+                description: The service type to be used on the deployed instance
+                enum:
+                - LoadBalancer
+                - loadbalancer
+                - ClusterIP
+                - clusterip
+                - NodePort
+                - nodeport
+                type: string
+              task_args:
+                items:
+                  type: string
+                type: array
+              task_command:
+                items:
+                  type: string
+                type: array
+              task_extra_env:
+                type: string
+              task_extra_volume_mounts:
+                description: Specify volume mounts to be added to Task container
+                type: string
+              task_privileged:
+                default: false
+                description: If a privileged security context should be enabled
+                type: boolean
+              task_resource_requirements:
+                description: Resource requirements for the task container
+                properties:
+                  limits:
+                    properties:
+                      cpu:
+                        type: string
+                      memory:
+                        type: string
+                      storage:
+                        type: string
+                    type: object
+                  requests:
+                    properties:
+                      cpu:
+                        type: string
+                      memory:
+                        type: string
+                      storage:
+                        type: string
+                    type: object
+                type: object
+              tolerations:
+                description: node tolerations for the pods
+                type: string
+              web_args:
+                items:
+                  type: string
+                type: array
+              web_command:
+                items:
+                  type: string
+                type: array
+              web_extra_env:
+                type: string
+              web_extra_volume_mounts:
+                description: Specify volume mounts to be added to the Web container
+                type: string
+              web_resource_requirements:
+                description: Resource requirements for the web container
+                properties:
+                  limits:
+                    properties:
+                      cpu:
+                        type: string
+                      memory:
+                        type: string
+                      storage:
+                        type: string
+                    type: object
+                  requests:
+                    properties:
+                      cpu:
+                        type: string
+                      memory:
+                        type: string
+                      storage:
+                        type: string
+                    type: object
+                type: object
             type: object
           status:
             properties:
+              URL:
+                description: URL to access the deployed instance
+                type: string
+              adminPasswordSecret:
+                description: Admin password secret name of the deployed instance
+                type: string
+              adminUser:
+                description: Admin user of the deployed instance
+                type: string
+              broadcastWebsocketSecret:
+                description: Broadcast websocket secret name of the deployed instance
+                type: string
               conditions:
                 description: The resulting conditions when a Service Telemetry is
                   instantiated
@@ -356,22 +430,19 @@ spec:
                       type: string
                   type: object
                 type: array
-              towerAdminPasswordSecret:
-                description: Admin password of the deployed instance
-                type: string
-              towerAdminUser:
-                description: Admin user of the deployed instance
-                type: string
-              towerImage:
+              image:
                 description: URL of the image used for the deployed instance
                 type: string
-              towerMigratedFromSecret:
-                description: The secret used for migrating an old Tower.
+              migratedFromSecret:
+                description: The secret used for migrating an old instance.
                 type: string
-              towerURL:
-                description: URL to access the deployed instance
+              postgresConfigurationSecret:
+                description: Postgres Configuration secret name of the deployed instance
                 type: string
-              towerVersion:
+              secretKeySecret:
+                description: Secret key secret name of the deployed instance
+                type: string
+              version:
                 description: Version of the deployed instance
                 type: string
             type: object

docs/migration.md

@@ -6,14 +6,14 @@ To migrate data from an older AWX installation, you must provide some informatio
 
 ### Secret Key
 
-You can find your old secret key in the inventory file you used to deploy AWX in releases prior to version 18. 
+You can find your old secret key in the inventory file you used to deploy AWX in releases prior to version 18.
 
 ```yaml
 apiVersion: v1
 kind: Secret
 metadata:
   name: <resourcename>-secret-key
-  namespace: <target namespace>
+  namespace: <target-namespace>
 stringData:
   secret_key: <old-secret-key>
 type: Opaque
@@ -45,10 +45,13 @@ type: Opaque
 
 If your AWX deployment is already using an external database server or its database is otherwise not managed
 by the AWX deployment, you can instead create the same secret as above but omit the `-old-` from the `name`.
-In the next section pass it in through `tower_postgres_configuration_secret` instead, omitting the `_old_`
+In the next section pass it in through `postgres_configuration_secret` instead, omitting the `_old_`
 from the key and ensuring the value matches the name of the secret. This will make AWX pick up on the existing
 database and apply any pending migrations. It is strongly recommended to backup your database beforehand.
 
+The postgresql pod for the old deployment is used when streaming data to the new postgresql pod.  If your postgresql pod has a custom label,
+you can pass that via the `postgres_label_selector` variable to make sure the postgresql pod can be found.
+
 ## Deploy AWX
 
 When you apply your AWX object, you must specify the name to the database secret you created above:
@@ -59,6 +62,6 @@ kind: AWX
 metadata:
   name: awx
 spec:
-  tower_old_postgres_configuration_secret: <resourcename>-old-postgres-configuration
+  old_postgres_configuration_secret: <resourcename>-old-postgres-configuration
   ...
 ```

molecule/default/molecule.yml

@@ -27,8 +27,3 @@ provisioner:
     group_vars:
       all:
         operator_namespace: ${TEST_NAMESPACE:-default}
-  env:
-    K8S_AUTH_KUBECONFIG: /tmp/molecule/kind-default/kubeconfig
-    KUBECONFIG: /tmp/molecule/kind-default/kubeconfig
-    ANSIBLE_ROLES_PATH: ${MOLECULE_PROJECT_DIRECTORY}/roles
-    KIND_PORT: '${TEST_CLUSTER_PORT:-9443}'

molecule/default/prepare.yml

@@ -11,10 +11,18 @@
     - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/ansible/group_vars/all"
 
   tasks:
-    - name: Create Custom Resource Definition
+    - name: Create AWX Custom Resource Definition
       k8s:
         definition: "{{ lookup('file', '/'.join([deploy_dir, 'crds/awx_v1beta1_crd.yaml'])) }}"
 
+    - name: Create AWXBackup Custom Resource Definition
+      k8s:
+        definition: "{{ lookup('file', '/'.join([deploy_dir, 'crds/awxbackup_v1beta1_crd.yaml'])) }}"
+
+    - name: Create AWXRestore Custom Resource Definition
+      k8s:
+        definition: "{{ lookup('file', '/'.join([deploy_dir, 'crds/awxrestore_v1beta1_crd.yaml'])) }}"
+
     - name: Ensure specified namespace is present
       k8s:
         api_version: v1

molecule/test-local/ansible.cfg

@@ -1,2 +0,0 @@
-[defaults]
-stdout_callback = yaml

molecule/test-local/converge.yml

@@ -1,133 +0,0 @@
----
-- name: Build Operator in Kind container
-  hosts: k8s
-
-  vars:
-    image_name: awx.ansible.com/awx-operator:testing
-
-  tasks:
-    # using command so we don't need to install any dependencies
-    - name: Get existing image hash
-      command: docker images -q {{ image_name }}
-      register: prev_hash
-      changed_when: false
-
-    - name: Build Operator Image
-      command: docker build -f /build/build/Dockerfile -t {{ image_name }} /build
-      register: build_cmd
-      changed_when: not prev_hash.stdout or (prev_hash.stdout and prev_hash.stdout not in ''.join(build_cmd.stdout_lines[-2:]))
-
-- name: Converge
-  hosts: localhost
-  connection: local
-
-  vars:
-    ansible_python_interpreter: '{{ ansible_playbook_python }}'
-    deploy_dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/deploy"
-    templates_dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/ansible/templates"
-    pull_policy: Never
-    operator_image: awx.ansible.com/awx-operator
-    operator_version: testing
-    custom_resource: "{{ lookup('file', '/'.join([deploy_dir, 'crds/awx_v1beta1_molecule.yaml'])) | from_yaml }}"
-  tasks:
-
-    - block:
-
-        - name: Delete the Operator Deployment
-          k8s:
-            state: absent
-            namespace: '{{ operator_namespace }}'
-            definition: "{{ lookup('template', '/'.join([templates_dir, 'operator.yml.j2'])) }}"
-          register: delete_deployment
-          when: hostvars[groups.k8s.0].build_cmd.changed
-
-        - name: Wait 30s for Operator Deployment to terminate
-          k8s_info:
-            api_version: '{{ definition.apiVersion }}'
-            kind: '{{ definition.kind }}'
-            namespace: '{{ operator_namespace }}'
-            name: '{{ definition.metadata.name }}'
-          vars:
-            definition: "{{ lookup('template', '/'.join([templates_dir, 'operator.yml.j2'])) | from_yaml }}"
-          register: deployment
-          until: not deployment.resources
-          delay: 3
-          retries: 10
-          when: delete_deployment.changed
-
-        - name: Create the Operator Deployment
-          k8s:
-            namespace: '{{ operator_namespace }}'
-            definition: "{{ lookup('template', '/'.join([templates_dir, 'operator.yml.j2'])) }}"
-
-        - name: Ensure the AWX custom_resource namespace exists
-          k8s:
-            state: present
-            name: '{{ custom_resource.metadata.namespace }}'
-            kind: Namespace
-            api_version: v1
-
-        - name: Create the AWX Custom Resource
-          k8s:
-            state: present
-            namespace: '{{ custom_resource.metadata.namespace }}'
-            definition: '{{ custom_resource }}'
-
-        - name: Wait 15m for reconciliation to run
-          k8s_info:
-            api_version: '{{ custom_resource.apiVersion }}'
-            kind: '{{ custom_resource.kind }}'
-            namespace: '{{ custom_resource.metadata.namespace }}'
-            name: '{{ custom_resource.metadata.name }}'
-          register: cr
-          until:
-            - "'Successful' in (cr | json_query('resources[].status.conditions[].reason'))"
-          delay: 6
-          retries: 150
-
-      rescue:
-
-        - name: debug cr
-          ignore_errors: yes
-          failed_when: false
-          debug:
-            var: debug_cr
-          vars:
-            debug_cr: '{{ lookup("k8s",
-              kind=custom_resource.kind,
-              api_version=custom_resource.apiVersion,
-              namespace=custom_resource.metadata.namespace,
-              resource_name=custom_resource.metadata.name)
-            }}'
-
-        - name: debug awx deployment
-          ignore_errors: yes
-          failed_when: false
-          debug:
-            var: deploy
-          vars:
-            deploy: '{{ lookup("k8s",
-              kind="Deployment",
-              api_version="apps/v1",
-              namespace=custom_resource.metadata.namespace,
-              label_selector="app.kubernetes.io/name=example-awx")
-            }}'
-
-        - name: get operator logs
-          ignore_errors: yes
-          failed_when: false
-          command: kubectl logs deployment/{{ definition.metadata.name }} -n {{ operator_namespace }}
-          environment:
-            KUBECONFIG: '{{ lookup("env", "KUBECONFIG") }}'
-          vars:
-            definition: "{{ lookup('template', '/'.join([templates_dir, 'operator.yml.j2'])) | from_yaml }}"
-          register: log
-
-        - name: print debug output
-          debug: var=log.stdout_lines
-
-        - name: fail if converge didn't succeed
-          fail:
-            msg: "Failed on action: converge"
-
-- import_playbook: '{{ playbook_dir }}/../default/asserts.yml'

molecule/test-local/molecule.yml

@@ -1,46 +0,0 @@
----
-dependency:
-  name: galaxy
-driver:
-  name: docker
-lint: |
-  set -e
-  yamllint .
-  ansible-lint
-platforms:
-  - name: kind-test-local
-    groups:
-      - k8s
-    image: bsycorp/kind:v1.17.9
-    privileged: True
-    override_command: no
-    exposed_ports:
-      - 8443/tcp
-      - 10080/tcp
-    published_ports:
-      - 0.0.0.0:${TEST_CLUSTER_PORT:-10443}:8443/tcp
-    pre_build_image: yes
-    volumes:
-      - ${MOLECULE_PROJECT_DIRECTORY}:/build:Z
-provisioner:
-  name: ansible
-  log: True
-  inventory:
-    group_vars:
-      all:
-        operator_namespace: ${TEST_NAMESPACE:-default}
-  env:
-    K8S_AUTH_KUBECONFIG: /tmp/molecule/kind-test-local/kubeconfig
-    KUBECONFIG: /tmp/molecule/kind-test-local/kubeconfig
-    ANSIBLE_ROLES_PATH: ${MOLECULE_PROJECT_DIRECTORY}/roles
-    KIND_PORT: '${TEST_CLUSTER_PORT:-10443}'
-scenario:
-  test_sequence:
-    - lint
-    - destroy
-    - dependency
-    - syntax
-    - create
-    - prepare
-    - converge
-    - destroy

molecule/test-local/prepare.yml

@@ -1,38 +0,0 @@
----
-- name: Prepare kubernetes environment
-  hosts: k8s
-  gather_facts: no
-  vars:
-    kubeconfig: "{{ lookup('env', 'KUBECONFIG') }}"
-  tasks:
-    - name: delete the kubeconfig if present
-      file:
-        path: '{{ kubeconfig }}'
-        state: absent
-      delegate_to: localhost
-
-    - name: Fetch the kubeconfig
-      fetch:
-        dest: '{{ kubeconfig }}'
-        flat: yes
-        src: /root/.kube/config
-
-    - name: Change the kubeconfig port to the proper value
-      replace:
-        regexp: 8443
-        replace: "{{ lookup('env', 'KIND_PORT') }}"
-        path: '{{ kubeconfig }}'
-        mode: 0644
-      delegate_to: localhost
-
-    - name: Wait for the Kubernetes API to become available (this could take a minute)
-      uri:
-        url: "http://localhost:10080/kubernetes-ready"
-        status_code: 200
-        validate_certs: no
-      register: result
-      until: (result.status|default(-1)) == 200
-      retries: 60
-      delay: 5
-
-- import_playbook: ../default/prepare.yml

molecule/test-minikube/converge.yml

@@ -36,6 +36,7 @@
     pull_policy: Never
     operator_image: awx.ansible.com/awx-operator
     operator_version: testing
+    ansible_debug_logs: "true"
     # Change this to _awx to test AWX, _tower to test Tower.
     custom_resource: "{{ lookup('file', '/'.join([deploy_dir, 'crds/awx_v1beta1_molecule.yaml'])) | from_yaml }}"
 
@@ -125,8 +126,6 @@
           ignore_errors: yes
           failed_when: false
           command: kubectl logs deployment/{{ definition.metadata.name }} -n {{ operator_namespace }} -c operator
-          environment:
-            KUBECONFIG: '{{ lookup("env", "KUBECONFIG") }}'
           vars:
             definition: "{{ lookup('template', '/'.join([templates_dir, 'operator.yml.j2'])) | from_yaml }}"
           register: log

requirements.yml

@@ -1,6 +1,6 @@
 ---
 collections:
-  - name: community.kubernetes
+  - name: kubernetes.core
     version: '==1.1.1'
   - name: operator_sdk.util
     version: '==0.1.0'

roles/backup/README.md

@@ -0,0 +1,95 @@
+Backup Role
+=========
+
+The purpose of this role is to create a backup of your AWX deployment which includes:
+  - custom deployment specific values in the spec section of the AWX custom resource object
+  - backup of the postgresql database
+  - secret_key, admin_password, and broadcast_websocket secrets
+  - database configuration
+
+Requirements
+------------
+
+This role assumes you are authenticated with an Openshift or Kubernetes cluster:
+  - The awx-operator has been deployed to the cluster
+  - AWX is deployed to via the operator
+
+
+Usage
+----------------
+
+Then create a file named `backup-awx.yml` with the following contents:
+
+```yaml
+---
+apiVersion: awx.ansible.com/v1beta1
+kind: AWXBackup
+metadata:
+  name: awxbackup-2021-04-22
+  namespace: my-namespace
+spec:
+  deployment_name: mytower
+```
+
+Note that the `deployment_name` above is the name of the AWX deployment you intend to backup from.  The namespace above is the one containing the AWX deployment that will be backed up.
+
+Finally, use `kubectl` to create the backup object in your cluster:
+
+```bash
+$ kubectl apply -f backup-awx.yml
+```
+
+The resulting pvc will contain a backup tar that can be used to restore to a new deployment. Future backups will also be stored in separate tars on the same pvc.
+
+
+Role Variables
+--------------
+
+A custom, pre-created pvc can be used by setting the following variables.  
+
+```
+backup_pvc: 'awx-backup-volume-claim'
+```
+
+> If no pvc or storage class is provided, the cluster's default storage class will be used to create the pvc.
+
+This role will automatically create a pvc using a Storage Class if provided:
+
+```
+backup_storage_class: 'standard'
+backup_storage_requirements: '20Gi'
+```
+
+By default, the backup pvc will be created in the same namespace the awxbackup object is created in.  If you want your backup to be stored
+in a specific namespace, you can do so by specifying `backup_pvc_namespace`.  Keep in mind that you will
+need to provide the same namespace when restoring.  
+
+```
+backup_pvc_namespace: 'custom-namespace'
+```
+
+If a custom postgres configuration secret was used when deploying AWX, it will automatically be used by the backup role.  
+To check the name of this secret, look at the postgresConfigurationSecret status on your AWX object.  
+
+The postgresql pod for the old deployment is used when backing up data to the new postgresql pod.  If your postgresql pod has a custom label,
+you can pass that via the `postgres_label_selector` variable to make sure the postgresql pod can be found.
+
+
+Testing
+----------------
+
+You can test this role directly by creating and running the following playbook with the appropriate variables:
+
+```
+---
+- name: Backup AWX
+  hosts: localhost
+  gather_facts: false
+  roles:
+    - backup
+```
+
+License
+-------
+
+MIT

roles/backup/defaults/main.yml

@@ -0,0 +1,12 @@
+---
+# Required: specify name of tower deployment to backup from
+deployment_name: ''
+kind: 'AWXBackup'
+api_version: '{{ deployment_type }}.ansible.com/v1beta1'
+
+# Specify a pre-created PVC (name) to backup to
+backup_pvc: ''
+backup_pvc_namespace: "{{ meta.namespace }}"
+
+# Size of backup PVC if created dynamically
+backup_storage_requirements: ''

roles/backup/meta/main.yml

@@ -0,0 +1,31 @@
+---
+galaxy_info:
+  author: Ansible
+  description: AWX role for AWX Operator for Kubernetes.
+  company: Red Hat, Inc.
+
+  license: MIT
+
+  min_ansible_version: 2.8
+
+  platforms:
+    - name: EL
+      versions:
+        - all
+    - name: Debian
+      versions:
+        - all
+
+  galaxy_tags:
+    - tower
+    - controller
+    - awx
+    - ansible
+    - backup
+    - automation
+
+dependencies: []
+
+collections:
+  - kubernetes.core
+  - operator_sdk.util

roles/backup/tasks/awx-cro.yml

@@ -0,0 +1,34 @@
+---
+
+- name: Get AWX custom resource object
+  k8s_info:
+    version: v1beta1
+    kind: AWX
+    namespace: '{{ meta.namespace }}'
+    name: '{{ deployment_name }}'
+  register: _awx_cro
+
+- name: Set AWX object
+  set_fact:
+    _awx: "{{ this_awx['resources'][0]['spec'] }}"
+
+- name: Set names of backed up secrets in the CR spec
+  set_fact:
+    _awx: "{{ _awx | combine ({ item.key : item.value }) }}"
+  with_items:
+    - {"key": "secret_key_secret", "value": "{{ this_awx['resources'][0]['status']['secretKeySecret'] }}"}
+    - {"key": "admin_password_secret", "value": "{{ this_awx['resources'][0]['status']['adminPasswordSecret'] }}"}
+    - {"key": "broadcast_websocket_secret", "value": "{{ this_awx['resources'][0]['status']['broadcastWebsocketSecret'] }}"}
+    - {"key": "postgres_configuration_secret", "value": "{{ this_awx['resources'][0]['status']['postgresConfigurationSecret'] }}"}
+
+- name: Set AWX object
+  set_fact:
+    awx_spec:
+      spec: "{{ _awx }}"
+
+- name: Write awx object to pvc
+  k8s_exec:
+    namespace: "{{ backup_pvc_namespace }}"
+    pod: "{{ meta.name }}-db-management"
+    command: >-
+      bash -c 'echo "$0" > {{ backup_dir  }}/awx_object' {{ awx_spec | to_yaml | quote  }}

roles/backup/tasks/cleanup.yml

@@ -0,0 +1,9 @@
+---
+
+- name: Delete any existing management pod
+  k8s:
+    name: "{{ meta.name }}-db-management"
+    kind: Pod
+    namespace: "{{ backup_pvc_namespace }}"
+    state: absent
+    force: true

roles/backup/tasks/dump_generated_secret.yml

@@ -0,0 +1,39 @@
+---
+
+- name: Get secret name
+  set_fact:
+      _name: "{{ this_awx['resources'][0]['status'][item] }}"
+
+- name: Fail if status is not set on AWX CR
+  block:
+      - name: Set error message
+        set_fact:
+            error_msg: "{{ item }} status is not set on AWX object yet"
+
+      - name: Handle error
+        import_tasks: error_handling.yml
+
+      - name: Fail early if secret name status is not set
+        fail:
+            msg: "{{ error_msg }}"
+  when: _name is not defined or _name == ''
+
+- name: Get secret
+  k8s_info:
+      version: v1
+      kind: Secret
+      namespace: '{{ meta.namespace }}'
+      name: "{{ _name }}"
+  register: _secret
+  no_log: true
+
+- name: Set secret data
+  set_fact:
+      _data: "{{ _secret['resources'][0]['data'] }}"
+      _type: "{{ _secret['resources'][0]['type'] }}"
+  no_log: true
+
+- name: Create and Add secret names and data to dictionary
+  set_fact:
+      secret_dict: "{{ secret_dict | default({}) | combine({ item: {'name': _name, 'data': _data, 'type': _type }}) }}"
+  no_log: true

roles/backup/tasks/dump_secret.yml

@@ -0,0 +1,28 @@
+---
+
+- name: Get Secret Name
+  set_fact:
+      _name: "{{ awx_spec.spec[item] | default('') }}"
+
+- name: Backup secret if defined
+  block:
+      - name: Get secret
+        k8s_info:
+            version: v1
+            kind: Secret
+            namespace: '{{ meta.namespace }}'
+            name: "{{ _name }}"
+        register: _secret
+        no_log: true
+
+      - name: Set secret key
+        set_fact:
+            _data: "{{ _secret['resources'][0]['data'] }}"
+            _type: "{{ _secret['resources'][0]['type'] }}"
+        no_log: true
+
+      - name: Create and Add secret names and data to dictionary
+        set_fact:
+            secret_dict: "{{ secret_dict | default({}) | combine({item: { 'name': _name, 'data': _data, 'type': _type }}) }}"
+        no_log: true
+  when: _name != ''

roles/backup/tasks/error_handling.yml

@@ -0,0 +1,11 @@
+---
+
+- name: Determine the timestamp
+  set_fact:
+    now: '{{ lookup("pipe", "date +%FT%TZ") }}'
+
+- name: Emit ocp event with error
+  k8s:
+    kind: Event
+    namespace: "{{ meta.namespace }}"
+    template: "event.yml.j2"

roles/backup/tasks/init.yml

@@ -0,0 +1,80 @@
+---
+
+- name: Delete any existing management pod
+  k8s:
+    name: "{{ meta.name }}-db-management"
+    kind: Pod
+    namespace: "{{ backup_pvc_namespace }}"
+    state: absent
+    force: true
+    wait: true
+
+# Check to make sure provided pvc exists, error loudly if not.  Otherwise, the management pod will just stay in pending state forever.
+- name: Check provided PVC exists
+  k8s_info:
+    name: "{{ backup_pvc }}"
+    kind: PersistentVolumeClaim
+    namespace: "{{ backup_pvc_namespace }}"
+  register: provided_pvc
+  when:
+    - backup_pvc != ''
+
+- name: Surface error to user
+  block:
+    - name: Set error message
+      set_fact:
+        error_msg: "{{ backup_pvc }} does not exist, please create this pvc first."
+
+    - name: Handle error
+      import_tasks: error_handling.yml
+
+    - name: Fail early if pvc is defined but does not exist
+      fail:
+        msg: "{{ backup_pvc }} does not exist, please create this pvc first."
+  when:
+    - backup_pvc != ''
+    - provided_pvc.resources | length == 0
+
+# If backup_pvc is defined, use in management-pod.yml.j2
+- name: Set default pvc name
+  set_fact:
+    _default_backup_pvc: "{{ deployment_name }}-backup-claim"
+
+# by default, it will re-use the old pvc if already created (unless a pvc is provided)
+- name: Set PVC to use for backup
+  set_fact:
+    backup_claim: "{{ backup_pvc | default(_default_backup_pvc, true) }}"
+
+- block:
+    - name: Create PVC for backup
+      k8s:
+        kind: PersistentVolumeClaim
+        template: "backup_pvc.yml.j2"
+
+    - name: Remove PVC ownerReference
+      k8s:
+        definition:
+          apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            name: '{{ deployment_name }}-backup-claim'
+            namespace: '{{ backup_pvc_namespace }}'
+            ownerReferences: null
+  when:
+    - backup_pvc == '' or backup_pvc is not defined
+
+- name: Create management pod from templated deployment config
+  k8s:
+    name: "{{ meta.name }}-db-management"
+    kind: Deployment
+    state: present
+    template: "management-pod.yml.j2"
+    wait: true
+
+- name: Look up details for this deployment
+  k8s_info:
+    api_version: "{{ api_version }}"
+    kind: "AWX"
+    name: "{{ deployment_name }}"
+    namespace: "{{ meta.namespace }}"
+  register: this_awx

roles/backup/tasks/main.yml

@@ -0,0 +1,47 @@
+---
+- name: Patching labels to {{ kind }} kind
+  k8s:
+    state: present
+    definition:
+      apiVersion: '{{ api_version }}'
+      kind: '{{ kind }}'
+      name: '{{ meta.name }}'
+      namespace: '{{ meta.namespace }}'
+      metadata:
+        name: '{{ meta.name }}'
+        namespace: '{{ meta.namespace }}'
+        labels:
+          app.kubernetes.io/name: '{{ meta.name }}'
+          app.kubernetes.io/part-of: '{{ meta.name }}'
+          app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
+          app.kubernetes.io/component: '{{ deployment_type }}'
+          app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
+
+- name: Look up details for this backup object
+  k8s_info:
+    api_version: "{{ api_version }}"
+    kind: "{{ kind }}"
+    name: "{{ meta.name }}"
+    namespace: "{{ meta.namespace }}"
+  register: this_backup
+
+- block:
+    - include_tasks: init.yml
+
+    - include_tasks: postgres.yml
+
+    - include_tasks: awx-cro.yml
+
+    - include_tasks: secrets.yml
+
+    - name: Set flag signifying this backup was successful
+      set_fact:
+        backup_complete: true
+
+    - include_tasks: cleanup.yml
+
+  when:
+    - this_backup['resources'][0]['status']['backupDirectory'] is not defined
+
+- name: Update status variables
+  include_tasks: update_status.yml

roles/backup/tasks/postgres.yml

@@ -0,0 +1,107 @@
+---
+
+- name: Get PostgreSQL configuration
+  k8s_info:
+    kind: Secret
+    namespace: '{{ meta.namespace }}'
+    name: "{{ this_awx['resources'][0]['status']['postgresConfigurationSecret'] }}"
+  register: pg_config
+  no_log: true
+
+- name: Fail if postgres configuration secret status does not exist
+  fail:
+    msg: "The postgresConfigurationSecret status is not set on the AWX object yet or the secret has been deleted."
+  when: not pg_config | default([]) | length
+
+- name: Store Database Configuration
+  set_fact:
+    awx_postgres_user: "{{ pg_config['resources'][0]['data']['username'] | b64decode }}"
+    awx_postgres_pass: "{{ pg_config['resources'][0]['data']['password'] | b64decode }}"
+    awx_postgres_database: "{{ pg_config['resources'][0]['data']['database'] | b64decode }}"
+    awx_postgres_port: "{{ pg_config['resources'][0]['data']['port'] | b64decode }}"
+    awx_postgres_host: "{{ pg_config['resources'][0]['data']['host'] | b64decode }}"
+    awx_postgres_type: "{{ pg_config['resources'][0]['data']['type'] | default('unmanaged'|b64encode) | b64decode }}"
+  no_log: true
+
+- block:
+    - name: Delete pod to reload a resource configuration
+      set_fact:
+        postgres_label_selector: "app.kubernetes.io/instance=postgres-{{ deployment_name }}"
+      when: postgres_label_selector is not defined
+
+    - name: Get the postgres pod information
+      k8s_info:
+        kind: Pod
+        namespace: '{{ meta.namespace }}'
+        label_selectors:
+          - "{{ postgres_label_selector }}"
+      register: postgres_pod
+      until:
+        - "postgres_pod['resources'] | length"
+        - "postgres_pod['resources'][0]['status']['phase'] == 'Running'"
+      delay: 5
+      retries: 60
+
+    - name: Set the resource pod name as a variable.
+      set_fact:
+        postgres_pod_name: "{{ postgres_pod['resources'][0]['metadata']['name'] }}"
+  when: awx_postgres_type == 'managed'
+
+- name: Determine the timestamp for the backup once for all nodes
+  set_fact:
+    now: '{{ lookup("pipe", "date +%F-%T") }}'
+
+- name: Set backup directory name
+  set_fact:
+    backup_dir: "/backups/tower-openshift-backup-{{ now }}"
+
+- name: Create directory for backup
+  k8s_exec:
+    namespace: "{{ backup_pvc_namespace }}"
+    pod: "{{ meta.name }}-db-management"
+    command: >-
+      mkdir -p {{ backup_dir }}
+
+- name: Precreate file for database dump
+  k8s_exec:
+    namespace: "{{ backup_pvc_namespace }}"
+    pod: "{{ meta.name }}-db-management"
+    command: >-
+      touch {{ backup_dir }}/tower.db
+
+- name: Set permissions on file for database dump
+  k8s_exec:
+    namespace: "{{ backup_pvc_namespace }}"
+    pod: "{{ meta.name }}-db-management"
+    command: >-
+      bash -c "chmod 0600 {{ backup_dir }}/tower.db && chown postgres:root {{ backup_dir }}/tower.db"
+
+- name: Set full resolvable host name for postgres pod
+  set_fact:
+    resolvable_db_host: '{{ (awx_postgres_type == "managed") | ternary(awx_postgres_host + "." + meta.namespace + ".svc.cluster.local", awx_postgres_host) }}'  # noqa 204
+  no_log: true
+
+- name: Set pg_dump command
+  set_fact:
+    pgdump: >-
+      pg_dump --clean --create
+      -h {{ resolvable_db_host }}
+      -U {{ awx_postgres_user }}
+      -d {{ awx_postgres_database }}
+      -p {{ awx_postgres_port }}
+      -F custom
+  no_log: true
+
+- name: Write pg_dump to backup on PVC
+  k8s_exec:
+    namespace: "{{ backup_pvc_namespace }}"
+    pod: "{{ meta.name }}-db-management"
+    command: |
+      bash -c """
+      set -e -o pipefail
+      PGPASSWORD={{ awx_postgres_pass }} {{ pgdump }} > {{ backup_dir }}/tower.db
+      echo 'Successful'
+      """
+  register: data_migration
+  no_log: true
+  failed_when: "'Successful' not in data_migration.stdout"

roles/backup/tasks/secrets.yml

@@ -0,0 +1,38 @@
+---
+
+- name: Create Temporary secrets file
+  tempfile:
+    state: file
+    suffix: .json
+  register: tmp_secrets
+
+- name: Dump (generated) secret names from statuses and data into file
+  include_tasks: dump_generated_secret.yml
+  with_items:
+    - secretKeySecret
+    - adminPasswordSecret
+    - broadcastWebsocketSecret
+    - postgresConfigurationSecret
+
+- name: Dump secret names from awx spec and data into file
+  include_tasks: dump_secret.yml
+  loop:
+    - route_tls_secret
+    - ingress_tls_secret
+    - ldap_cacert_secret
+    - bundle_cacert_secret
+    - image_pull_secret
+    - ee_pull_credentials_secret
+
+- name: Nest secrets under a single variable
+  set_fact:
+    secrets: {"secrets": '{{ secret_dict }}'}
+  no_log: true
+
+- name: Write postgres configuration to pvc
+  k8s_exec:
+    namespace: "{{ backup_pvc_namespace }}"
+    pod: "{{ meta.name }}-db-management"
+    command: >-
+      bash -c "echo '{{ secrets | to_yaml }}' > {{ backup_dir }}/secrets.yml"
+  no_log: true

roles/backup/tasks/update_status.yml

@@ -0,0 +1,13 @@
+---
+
+# The backup directory in this status can be referenced when restoring
+- name: Update CR Backup status
+  operator_sdk.util.k8s_status:
+    api_version: '{{ api_version }}'
+    kind: "{{ kind }}"
+    name: "{{ meta.name }}"
+    namespace: "{{ meta.namespace }}"
+    status:
+      backupDirectory: "{{ backup_dir }}"
+      backupClaim: "{{ backup_claim }}"
+  when: backup_complete

roles/backup/templates/backup_pvc.yml.j2

@@ -0,0 +1,22 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ deployment_name }}-backup-claim
+  namespace: {{ backup_pvc_namespace }}
+  ownerReferences: null
+  labels:
+    app.kubernetes.io/name: '{{ meta.name }}'
+    app.kubernetes.io/part-of: '{{ meta.name }}'
+    app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
+    app.kubernetes.io/component: '{{ deployment_type }}'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
+spec:
+  accessModes:
+    - ReadWriteOnce
+{% if backup_storage_class is defined %}
+  storageClassName: {{ backup_storage_class }}
+{% endif %}
+  resources:
+    requests:
+      storage: {{ backup_storage_requirements | default('5Gi', true) }}

roles/backup/templates/event.yml.j2

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Event
+metadata:
+  name: backup-error.{{ now }}
+  namespace: {{ meta.namespace }}
+involvedObject:
+  apiVersion: awx.ansible.com/v1beta1
+  kind: {{ kind }}
+  name: {{ meta.name }}
+  namespace: {{ meta.namespace }}
+message: {{ error_msg }}
+reason: BackupFailed
+type: Warning
+firstTimestamp: {{ now }}
+lastTimestamp: {{ now }}
+count: 1

roles/backup/templates/management-pod.yml.j2

@@ -0,0 +1,28 @@
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: {{ meta.name }}-db-management
+  namespace: {{ backup_pvc_namespace }}
+  labels:
+    app.kubernetes.io/name: '{{ meta.name }}'
+    app.kubernetes.io/part-of: '{{ meta.name }}'
+    app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
+    app.kubernetes.io/component: '{{ deployment_type }}'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
+spec:
+  containers:
+  - name: {{ meta.name }}-db-management
+    image: "{{ postgres_image }}:{{ postgres_image_version }}"
+    imagePullPolicy: Always
+    command: ["sleep", "infinity"]
+    volumeMounts:
+    - name: {{ meta.name }}-backup
+      mountPath: /backups
+      readOnly: false
+  volumes:
+    - name: {{ meta.name }}-backup
+      persistentVolumeClaim:
+        claimName: {{ backup_claim }}
+        readOnly: false
+  restartPolicy: Never

roles/backup/vars/main.yml

@@ -0,0 +1,6 @@
+---
+deployment_type: "awx"
+postgres_image: postgres
+postgres_image_version: 12
+backup_complete: false
+database_type: "unmanaged"

roles/finalizer/defaults/main.yml

@@ -1,21 +0,0 @@
----
-# Whether secrets should be garbage collected
-# on teardown
-#
-tower_garbage_collect_secrets: false
-
-# Secret to lookup that provide the admin password
-#
-tower_admin_password_secret: ''
-
-# Secret to lookup that provide the secret key
-#
-tower_secret_key_secret: ''
-
-# Secret to lookup that provide the PostgreSQL configuration
-#
-tower_postgres_configuration_secret: ''
-
-# Secret to lookup that provide the broadcast websocket key
-#
-tower_broadcast_websocket_secret: ''

roles/finalizer/tasks/main.yml

@@ -1,27 +0,0 @@
----
-- block:
-    - name: Define secrets name
-      set_fact:
-        _admin_password: '{{ tower_admin_password_secret | length | ternary(tower_admin_password_secret, meta.name + "-admin-password") }}'
-        _secret_key: '{{ tower_secret_key_secret | length | ternary(tower_secret_key_secret, meta.name + "-secret-key") }}'
-        # yamllint disable-line rule:line-length
-        _broadcast_websocket_secret: '{{ tower_broadcast_websocket_secret | length | ternary(tower_broadcast_websocket_secret, meta.name + "-broadcast-websocket") }}'  # noqa 204
-        # yamllint disable-line rule:line-length
-        _postgres_configuration: '{{ tower_postgres_configuration_secret | length | ternary(tower_postgres_configuration_secret, meta.name + "-postgres-configuration") }}'  # noqa 204
-
-    - name: Remove ownerReferences reference
-      k8s:
-        definition:
-          apiVersion: v1
-          kind: Secret
-          metadata:
-            name: '{{ item }}'
-            namespace: '{{ meta.namespace }}'
-            ownerReferences: null
-      loop:
-        - '{{ _admin_password }}'
-        - '{{ _secret_key }}'
-        - '{{ _postgres_configuration }}'
-        - '{{ _broadcast_websocket_secret }}'
-
-  when: not tower_garbage_collect_secrets | bool

roles/installer/defaults/main.yml

@@ -6,175 +6,217 @@ api_version: '{{ deployment_type }}.ansible.com/v1beta1'
 database_name: "{{ deployment_type }}"
 database_username: "{{ deployment_type }}"
 
-tower_task_privileged: false
-tower_ingress_type: none
+task_privileged: false
+service_type: ClusterIP
+ingress_type: none
+ingress_path: '/'
+# Add annotations to the service account. Specify as literal block. E.g.:
+# service_account_annotations: |
+#   eks.amazonaws.com/role-arn: arn:aws:iam::<ACCOUNT_ID>:role/<IAM_ROLE_NAME>
+service_account_annotations: ''
+
+# Custom labels for the tower service. Specify as literal block. E.g.:
+# service_labels: |
+#   environment: non-production
+#   zone: internal
+service_labels: ''
 
 # Add annotations to the ingress. Specify as literal block. E.g.:
-# tower_ingress_annotations: |
+# ingress_annotations: |
 #   kubernetes.io/ingress.class: nginx
 #   nginx.ingress.kubernetes.io/proxy-connect-timeout: 60s
-tower_ingress_annotations: ''
+ingress_annotations: ''
+
 # TLS secret for the ingress. The secret either has to exist before hand with
 # the corresponding cert and key or just be an indicator for where an automated
 # process like cert-manager (enabled via annotations) will store the TLS
 # certificate and key.
-tower_ingress_tls_secret: ''
+ingress_tls_secret: ''
 
-tower_loadbalancer_protocol: 'http'
-tower_loadbalancer_port: '80'
+loadbalancer_protocol: 'http'
+loadbalancer_port: '80'
+loadbalancer_annotations: ''
 
 # The TLS termination mechanism to use to access
 # the services. Supported mechanism are: edge, passthrough
 #
-tower_route_tls_termination_mechanism: edge
+route_tls_termination_mechanism: edge
 
 # Secret to lookup that provide the TLS specific
 # credentials to deploy
 #
-tower_route_tls_secret: ''
+route_tls_secret: ''
 
 # Host to create the root with.
 # If not specific will default to <instance-name>-<namespace>-<routerCanonicalHostname>
 #
-tower_route_host: ''
+route_host: ''
 
-tower_hostname: '{{ deployment_type }}.example.com'
+hostname: '{{ meta.name }}.example.com'
 
 # Add a nodeSelector for the AWX pods. It must match a node's labels for the pod
 # to be scheduled on that node. Specify as literal block. E.g.:
-# tower_node_selector: |
+# node_selector: |
 #   disktype: ssd
 #   kubernetes.io/arch: amd64
 #   kubernetes.io/os: linux
-tower_node_selector: ''
+node_selector: ''
 
 # Add node tolerations for the AWX pods. Specify as literal block. E.g.:
-# tower_tolerations: |
+# tolerations: |
 #   - key: "dedicated"
 #     operator: "Equal"
 #     value: "AWX"
 #     effect: "NoSchedule"
-tower_tolerations: ''
+tolerations: ''
 
-tower_admin_user: admin
-tower_admin_email: test@example.com
+admin_user: admin
+admin_email: test@example.com
 
 # Secret to lookup that provide the admin password
 #
-tower_admin_password_secret: ''
+admin_password_secret: ''
 
 # Secret to lookup that provide the broadcast websocket key
 #
-tower_broadcast_websocket_secret: ''
+broadcast_websocket_secret: ''
 
 # Secret to lookup that provide the secret key
 #
-tower_secret_key_secret: ''
+secret_key_secret: ''
+
+# Secret to lookup that provide the PostgreSQL configuration
+#
+postgres_configuration_secret: ''
 
 # Secret to lookup that provides old database credentials (for migration)
 
-tower_old_postgres_configuration_secret: ''
+old_postgres_configuration_secret: ''
+
+# Secret to lookup that provides default execution environment pull credentials
+#
+ee_pull_credentials_secret: ''
 
 # Add extra volumes to the AWX pod. Specify as literal block. E.g.:
-# tower_extra_volumes: |
+# extra_volumes: |
 #   - name: my-volume
 #     emptyDir: {}
-tower_extra_volumes: ''
+extra_volumes: ''
 
 # Use these image versions for Ansible AWX.
 
-tower_image: quay.io/ansible/awx
-tower_image_version: 19.1.0
-tower_redis_image: docker.io/redis
-tower_redis_image_version: latest
-tower_postgres_image: postgres
-tower_postgres_image_version: 12
-tower_image_pull_policy: IfNotPresent
-tower_image_pull_secret: ''
+image: quay.io/ansible/awx
+image_version: 19.3.0
+redis_image: docker.io/redis
+redis_image_version: latest
+postgres_image: postgres
+postgres_image_version: 12
+init_container_image: quay.io/centos/centos
+init_container_image_version: 8
+image_pull_policy: IfNotPresent
+image_pull_secret: ''
 
-tower_ee_images:
-  - name: AWX EE 0.2.0
-    image: quay.io/ansible/awx-ee:0.2.0
+# Extra commands which will be appended to the initContainer
+# Make sure that each command entered return an exit code 0
+# otherwise the initContainer will fail
+# init_container_extra_commands: |
+#   date >> /var/lib/awx/projects/timestamp
+#   chgrp 1000 /shared
+#   chmod 775 /shared
+init_container_extra_commands: ''
 
-tower_create_preload_data: true
+# Mount extra volumes on the initContainer.
+# The volume used must be defined as an `extra_volumes` resource
+# init_container_extra_volume_mounts: |
+#   - name: shared-vol
+#     mountPath: /shared
+init_container_extra_volume_mounts: ''
 
-tower_replicas: "1"
+ee_images:
+  - name: AWX EE (latest)
+    image: quay.io/ansible/awx-ee:latest
 
-tower_task_args:
+control_plane_ee_image: quay.io/ansible/awx-ee:latest
+
+create_preload_data: true
+
+replicas: "1"
+
+task_args:
   - /usr/bin/launch_awx_task.sh
-tower_task_command: []
-tower_web_args: []
-tower_web_command: []
+task_command: []
+web_args: []
+web_command: []
 
-tower_task_resource_requirements:
+task_resource_requirements:
   requests:
     cpu: 500m
     memory: 1Gi
 
-tower_web_resource_requirements:
+web_resource_requirements:
   requests:
     cpu: 1000m
     memory: 2Gi
 
+ee_resource_requirements:
+  requests:
+    cpu: 500m
+    memory: 1Gi
+
 # Add extra environment variables to the AWX task/web containers. Specify as
 # literal block. E.g.:
-# tower_task_extra_env: |
+# task_extra_env: |
 #   - name: FOO
 #     value: bar
 #   - name: BAZ
 #     value: bing
-tower_task_extra_env: ''
-tower_web_extra_env: ''
+task_extra_env: ''
+web_extra_env: ''
+ee_extra_env: ''
 
 # Mount extra volumes on the AWX task/web containers. Specify as literal block.
 # E.g.:
-# tower_task_extra_volume_mounts: ''
+# task_extra_volume_mounts: ''
 #   - name: my-volume
 #     mountPath: /some/path
-tower_task_extra_volume_mounts: ''
-tower_web_extra_volume_mounts: ''
-tower_ee_extra_volume_mounts: ''
+task_extra_volume_mounts: ''
+web_extra_volume_mounts: ''
+ee_extra_volume_mounts: ''
 
 # Add a nodeSelector for the Postgres pods.
 # It must match a node's labels for the pod to be scheduled on that node.
 # Specify as literal block. E.g.:
-# tower_postgres_selector: |
+# postgres_selector: |
 #   disktype: ssd
 #   kubernetes.io/arch: amd64
 #   kubernetes.io/os: linux
-tower_postgres_selector: ''
+postgres_selector: ''
 
 # Add node tolerations for the Postgres pods.
 # Specify as literal block. E.g.:
-# tower_postgres_tolerations: |
+# postgres_tolerations: |
 #   - key: "dedicated"
 #     operator: "Equal"
 #     value: "AWX"
 #     effect: "NoSchedule"
-tower_postgres_tolerations: ''
-tower_postgres_storage_requirements:
+postgres_tolerations: ''
+postgres_storage_requirements:
   requests:
     storage: 8Gi
-tower_postgres_resource_requirements: {}
-tower_postgres_storage_class: ''
-tower_postgres_data_path: '/var/lib/postgresql/data/pgdata'
+postgres_resource_requirements: {}
+postgres_data_path: '/var/lib/postgresql/data/pgdata'
 
 # Persistence to the AWX project data folder
 # Whether or not the /var/lib/projects directory will be persistent
-tower_projects_persistence: false
+projects_persistence: false
 #
 # Define an existing PersistentVolumeClaim to use
-tower_projects_existing_claim: ''
+projects_existing_claim: ''
 #
 # Define the storage_class, size and access_mode
 # when not using an existing claim
-tower_projects_storage_class: ''
-tower_projects_storage_size: 8Gi
-tower_projects_storage_access_mode: ReadWriteMany
-
-# Secret to lookup that provide the PostgreSQL configuration
-#
-tower_postgres_configuration_secret: ''
+projects_storage_size: 8Gi
+projects_storage_access_mode: ReadWriteMany
 
 ca_trust_bundle: "/etc/pki/tls/certs/ca-bundle.crt"
 
@@ -182,4 +224,12 @@ ca_trust_bundle: "/etc/pki/tls/certs/ca-bundle.crt"
 #
 ldap_cacert_secret: ''
 
+# Secret to lookup that provides the custom CA trusted bundle
+bundle_cacert_secret: ''
+
+# Whether secrets should be garbage collected
+# on teardown
+#
+garbage_collect_secrets: false
+
 development_mode: false

roles/installer/meta/main.yml

@@ -28,5 +28,5 @@ galaxy_info:
 dependencies: []
 
 collections:
-  - community.kubernetes
+  - kubernetes.core
   - operator_sdk.util

roles/installer/tasks/admin_password_configuration.yml

@@ -3,9 +3,10 @@
   k8s_info:
     kind: Secret
     namespace: '{{ meta.namespace }}'
-    name: '{{ tower_admin_password_secret }}'
+    name: '{{ admin_password_secret }}'
   register: _custom_admin_password
-  when: tower_admin_password_secret | length
+  no_log: true
+  when: admin_password_secret | length
 
 - name: Check for default admin password configuration
   k8s_info:
@@ -13,16 +14,19 @@
     namespace: '{{ meta.namespace }}'
     name: '{{ meta.name }}-admin-password'
   register: _default_admin_password
+  no_log: true
 
 - name: Set admin password secret
   set_fact:
     _admin_password_secret: '{{ _custom_admin_password["resources"] | default([]) | length | ternary(_custom_admin_password, _default_admin_password) }}'
+  no_log: true
 
 - block:
     - name: Create admin password secret
       k8s:
         apply: true
-        definition: "{{ lookup('template', 'tower_admin_password_secret.yaml.j2') }}"
+        definition: "{{ lookup('template', 'admin_password_secret.yaml.j2') }}"
+      no_log: true
 
     - name: Read admin password secret
       k8s_info:
@@ -30,13 +34,16 @@
         namespace: '{{ meta.namespace }}'
         name: '{{ meta.name }}-admin-password'
       register: _generated_admin_password
+      no_log: true
 
   when: not _admin_password_secret['resources'] | default([]) | length
 
 - name: Set admin password secret
   set_fact:
-    admin_password_secret: '{{ _generated_admin_password["resources"] | default([]) | length | ternary(_generated_admin_password, _admin_password_secret) }}'
+    __admin_password_secret: '{{ _generated_admin_password["resources"] | default([]) | length | ternary(_generated_admin_password, _admin_password_secret) }}'
+  no_log: true
 
 - name: Store admin password
   set_fact:
-    tower_admin_password: "{{ admin_password_secret['resources'][0]['data']['password'] | b64decode }}"
+    admin_password: "{{ __admin_password_secret['resources'][0]['data']['password'] | b64decode }}"
+  no_log: true

roles/installer/tasks/broadcast_websocket_configuration.yml

@@ -3,9 +3,10 @@
   k8s_info:
     kind: Secret
     namespace: '{{ meta.namespace }}'
-    name: '{{ tower_broadcast_websocket_secret }}'
+    name: '{{ broadcast_websocket_secret }}'
   register: _custom_broadcast_websocket
-  when: tower_broadcast_websocket_secret | length
+  no_log: true
+  when: broadcast_websocket_secret | length
 
 - name: Check for default broadcast websocket secret configuration
   k8s_info:
@@ -13,17 +14,20 @@
     namespace: '{{ meta.namespace }}'
     name: '{{ meta.name }}-broadcast-websocket'
   register: _default_broadcast_websocket
+  no_log: true
 
 - name: Set broadcast websocket secret
   set_fact:
     # yamllint disable-line rule:line-length
     _broadcast_websocket_secret: '{{ _custom_broadcast_websocket["resources"] | default([]) | length | ternary(_custom_broadcast_websocket, _default_broadcast_websocket) }}'  # noqa 204
+  no_log: true
 
 - block:
     - name: Create broadcast websocket secret
       k8s:
         apply: true
-        definition: "{{ lookup('template', 'tower_broadcast_websocket_secret.yaml.j2') }}"
+        definition: "{{ lookup('template', 'broadcast_websocket_secret.yaml.j2') }}"
+      no_log: true
 
     - name: Read broadcast websocket secret
       k8s_info:
@@ -31,14 +35,17 @@
         namespace: '{{ meta.namespace }}'
         name: '{{ meta.name }}-broadcast-websocket'
       register: _generated_broadcast_websocket
+      no_log: true
 
   when: not _broadcast_websocket_secret['resources'] | default([]) | length
 
 - name: Set broadcast websocket secret
   set_fact:
     # yamllint disable-line rule:line-length
-    broadcast_websocket_secret: '{{ _generated_broadcast_websocket["resources"] | default([]) | length | ternary(_generated_broadcast_websocket, _broadcast_websocket_secret)  }}'  # noqa 204
+    __broadcast_websocket_secret: '{{ _generated_broadcast_websocket["resources"] | default([]) | length | ternary(_generated_broadcast_websocket, _broadcast_websocket_secret)  }}'  # noqa 204
+  no_log: true
 
 - name: Store broadcast websocket secret name
   set_fact:
-    broadcast_websocket_secret_value: "{{ broadcast_websocket_secret['resources'][0]['data']['secret'] | b64decode }}"
+    broadcast_websocket_secret_value: "{{ __broadcast_websocket_secret['resources'][0]['data']['secret'] | b64decode }}"
+  no_log: true

roles/installer/tasks/cleanup.yml

@@ -0,0 +1,28 @@
+---
+- block:
+    - name: Define secrets name
+      set_fact:
+        _admin_password: '{{ admin_password_secret | length | ternary(admin_password_secret, meta.name + "-admin-password") }}'
+        _secret_key: '{{ secret_key_secret | length | ternary(secret_key_secret, meta.name + "-secret-key") }}'
+        # yamllint disable-line rule:line-length
+        _broadcast_websocket_secret: '{{ broadcast_websocket_secret | length | ternary(broadcast_websocket_secret, meta.name + "-broadcast-websocket") }}'  # noqa 204
+        # yamllint disable-line rule:line-length
+        _postgres_configuration: '{{ postgres_configuration_secret | length | ternary(postgres_configuration_secret, meta.name + "-postgres-configuration") }}'  # noqa 204
+
+    - name: Remove ownerReferences reference
+      k8s:
+        definition:
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: '{{ item }}'
+            namespace: '{{ meta.namespace }}'
+            ownerReferences: null
+      loop:
+        - '{{ _admin_password }}'
+        - '{{ _secret_key }}'
+        - '{{ _postgres_configuration }}'
+        - '{{ _broadcast_websocket_secret }}'
+      no_log: true
+
+  when: not garbage_collect_secrets | bool

roles/installer/tasks/database_configuration.yml

@@ -3,9 +3,10 @@
   k8s_info:
     kind: Secret
     namespace: '{{ meta.namespace }}'
-    name: '{{ tower_postgres_configuration_secret }}'
+    name: '{{ postgres_configuration_secret }}'
   register: _custom_pg_config_resources
-  when: tower_postgres_configuration_secret | length
+  when: postgres_configuration_secret | length
+  no_log: true
 
 - name: Check for default PostgreSQL configuration
   k8s_info:
@@ -13,14 +14,16 @@
     namespace: '{{ meta.namespace }}'
     name: '{{ meta.name }}-postgres-configuration'
   register: _default_pg_config_resources
+  no_log: true
 
 - name: Check for specified old PostgreSQL configuration secret
   k8s_info:
     kind: Secret
     namespace: '{{ meta.namespace }}'
-    name: '{{ tower_old_postgres_configuration_secret }}'
+    name: '{{ old_postgres_configuration_secret }}'
   register: _custom_old_pg_config_resources
-  when: tower_old_postgres_configuration_secret | length
+  when: old_postgres_configuration_secret | length
+  no_log: true
 
 - name: Check for default old PostgreSQL configuration
   k8s_info:
@@ -28,6 +31,7 @@
     namespace: '{{ meta.namespace }}'
     name: '{{ meta.name }}-old-postgres-configuration'
   register: _default_old_pg_config_resources
+  no_log: true
 
 - name: Set old PostgreSQL configuration
   set_fact:
@@ -41,16 +45,19 @@
   when:
     - old_pg_config['resources'] is defined
     - old_pg_config['resources'] | length
+  no_log: true
 
 - name: Set PostgreSQL configuration
   set_fact:
     _pg_config: '{{ _custom_pg_config_resources["resources"] | default([]) | length | ternary(_custom_pg_config_resources, _default_pg_config_resources) }}'
+  no_log: true
 
 - block:
     - name: Create Database configuration
       k8s:
         apply: true
-        definition: "{{ lookup('template', 'tower_postgres_secret.yaml.j2') }}"
+        definition: "{{ lookup('template', 'postgres_secret.yaml.j2') }}"
+      no_log: true
 
     - name: Read Database Configuration
       k8s_info:
@@ -58,17 +65,23 @@
         namespace: '{{ meta.namespace }}'
         name: '{{ meta.name }}-postgres-configuration'
       register: _generated_pg_config_resources
+      no_log: true
   when: not _pg_config['resources'] | default([]) | length
 
 - name: Set PostgreSQL Configuration
   set_fact:
     pg_config: '{{ _generated_pg_config_resources["resources"] | default([]) | length | ternary(_generated_pg_config_resources, _pg_config) }}'
+  no_log: true
+
+- name: Set actual postgres configuration secret used
+  set_fact:
+    __postgres_configuration_secret: "{{ pg_config['resources'][0]['metadata']['name'] }}"
 
 - block:
     - name: Create Database if no database is specified
       k8s:
         apply: true
-        definition: "{{ lookup('template', 'tower_postgres.yaml.j2') }}"
+        definition: "{{ lookup('template', 'postgres.yaml.j2') }}"
       register: create_statefulset_result
 
   rescue:
@@ -76,7 +89,7 @@
       include_tasks: scale_down_deployment.yml
 
     - name: Scale down PostgreSQL statefulset for migration
-      community.kubernetes.k8s_scale:
+      kubernetes.core.k8s_scale:
         api_version: apps/v1
         kind: StatefulSet
         name: "{{ meta.name }}-postgres"
@@ -97,10 +110,9 @@
     - name: Recreate PostgreSQL statefulset with updated values
       k8s:
         apply: true
-        definition: "{{ lookup('template', 'tower_postgres.yaml.j2') }}"
+        definition: "{{ lookup('template', 'postgres.yaml.j2') }}"
   when: pg_config['resources'][0]['data']['type'] | default('') | b64decode == 'managed'
 
-
 - name: Store Database Configuration
   set_fact:
     awx_postgres_user: "{{ pg_config['resources'][0]['data']['username'] | b64decode }}"
@@ -109,11 +121,12 @@
     awx_postgres_port: "{{ pg_config['resources'][0]['data']['port'] | b64decode }}"
     awx_postgres_host: "{{ pg_config['resources'][0]['data']['host'] | b64decode }}"
     awx_postgres_sslmode: "{{ pg_config['resources'][0]['data']['sslmode'] |  default('prefer'|b64encode) | b64decode }}"
+  no_log: true
 
 - name: Look up details for this deployment
   k8s_info:
-    api_version: 'v1beta1'  # TODO: How to parameterize this?
-    kind: "AWX"  #  TODO: How to parameterize this?
+    api_version: "{{ api_version }}"
+    kind: "{{ kind }}"
     name: "{{ meta.name }}"
     namespace: "{{ meta.namespace }}"
   register: this_awx
@@ -123,4 +136,4 @@
   when:
     - old_pg_config['resources'] is defined
     - old_pg_config['resources'] | length
-    - this_awx['resources'][0]['status']['towerMigratedFromSecret'] is not defined
+    - this_awx['resources'][0]['status']['migratedFromSecret'] is not defined

roles/installer/tasks/initialize_django.yml

@@ -1,31 +1,44 @@
 ---
 - name: Check if there are any super users defined.
-  community.kubernetes.k8s_exec:
+  k8s_exec:
     namespace: "{{ meta.namespace }}"
     pod: "{{ tower_pod_name }}"
     container: "{{ meta.name }}-task"
     command: >-
       bash -c "echo 'from django.contrib.auth.models import User;
-      nsu = User.objects.filter(is_superuser=True).count();
+      nsu = User.objects.filter(is_superuser=True, username=\"{{ admin_user }}\").count();
       exit(0 if nsu > 0 else 1)'
       | awx-manage shell"
   ignore_errors: true
   register: users_result
   changed_when: users_result.return_code > 0
 
+- name: Update super user password via Django if it does exist (same password is a noop)
+  k8s_exec:
+    namespace: "{{ meta.namespace }}"
+    pod: "{{ tower_pod_name }}"
+    container: "{{ meta.name }}-task"
+    command: >-
+      bash -c "awx-manage update_password --username '{{ admin_user }}' --password '{{ admin_password }}'"
+  register: update_pw_result
+  changed_when: users_result.stdout == 'Password not updated'
+  no_log: true
+  when: users_result.return_code == 0
+
 - name: Create super user via Django if it doesn't exist.
-  community.kubernetes.k8s_exec:
+  k8s_exec:
     namespace: "{{ meta.namespace }}"
     pod: "{{ tower_pod_name }}"
     container: "{{ meta.name }}-task"
     command: >-
       bash -c "echo \"from django.contrib.auth.models import User;
-      User.objects.create_superuser('{{ tower_admin_user }}', '{{ tower_admin_email }}', '{{ tower_admin_password }}')\"
+      User.objects.create_superuser('{{ admin_user }}', '{{ admin_email }}', '{{ admin_password }}')\"
       | awx-manage shell"
+  no_log: true
   when: users_result.return_code > 0
 
 - name: Create preload data if necessary.  # noqa 305
-  community.kubernetes.k8s_exec:
+  k8s_exec:
     namespace: "{{ meta.namespace }}"
     pod: "{{ tower_pod_name }}"
     container: "{{ meta.name }}-task"
@@ -33,4 +46,75 @@
       bash -c "awx-manage create_preload_data"
   register: cdo
   changed_when: "'added' in cdo.stdout"
-  when: tower_create_preload_data | bool
+  when: create_preload_data | bool
+
+- name: Check if legacy queue is present
+  k8s_exec:
+    namespace: "{{ meta.namespace }}"
+    pod: "{{ tower_pod_name }}"
+    container: "{{ meta.name }}-task"
+    command: >-
+      bash -c "awx-manage list_instances | grep '^\[tower capacity=[0-9]*\]'"
+  register: legacy_queue
+  changed_when: false
+
+- name: Unregister legacy queue
+  k8s_exec:
+    namespace: "{{ meta.namespace }}"
+    pod: "{{ tower_pod_name }}"
+    container: "{{ meta.name }}-task"
+    command: >-
+      bash -c "awx-manage unregister_queue --queuename=tower"
+  when: "'[tower capacity=' in legacy_queue.stdout"
+
+- name: Check for specified default execution environment pull credentials
+  k8s_info:
+    kind: Secret
+    namespace: '{{ meta.namespace }}'
+    name: '{{ ee_pull_credentials_secret }}'
+  register: _custom_execution_environments_pull_credentials
+  when: ee_pull_credentials_secret | length
+
+- name: Set execution environment pull credential secret
+  set_fact:
+    _execution_environments_pull_credentials: >-
+      {{ _custom_execution_environments_pull_credentials["resources"] | default([]) | length
+      | ternary(_custom_execution_environments_pull_credentials, []) }}
+  no_log: true
+
+- name: Register default execution environments (without authentication)
+  k8s_exec:
+    namespace: "{{ meta.namespace }}"
+    pod: "{{ tower_pod_name }}"
+    container: "{{ meta.name }}-task"
+    command: >-
+      bash -c "awx-manage register_default_execution_environments"
+  register: ree
+  changed_when: "'changed: True' in ree.stdout"
+  when: not _execution_environments_pull_credentials['resources'] | default([]) | length
+
+- block:
+    - name: Store default execution environment pull credentials
+      set_fact:
+        default_execution_environment_pull_credentials_user: "{{ _execution_environments_pull_credentials['resources'][0]['data']['username'] | b64decode }}"
+        default_execution_environment_pull_credentials_pass: "{{ _execution_environments_pull_credentials['resources'][0]['data']['password'] | b64decode }}"
+        default_execution_environment_pull_credentials_url: "{{ _execution_environments_pull_credentials['resources'][0]['data']['url'] | b64decode }}"
+        default_execution_environment_pull_credentials_url_verify: >-
+          {{ _execution_environments_pull_credentials['resources'][0]['data']['ssl_verify'] | default("True"|b64encode) | b64decode }}
+      no_log: true
+
+    - name: Register default execution environments (with authentication)
+      k8s_exec:
+        namespace: "{{ meta.namespace }}"
+        pod: "{{ tower_pod_name }}"
+        container: "{{ meta.name }}-task"
+        command: >-
+          bash -c "awx-manage register_default_execution_environments
+          --registry-username='{{ default_execution_environment_pull_credentials_user }}'
+          --registry-password='{{ default_execution_environment_pull_credentials_pass }}'
+          --registry-url='{{ default_execution_environment_pull_credentials_url }}'
+          --verify-ssl='{{ default_execution_environment_pull_credentials_url_verify }}'"
+      register: ree
+      changed_when: "'changed: True' in ree.stdout"
+      no_log: true
+  when: _execution_environments_pull_credentials['resources'] | default([]) | length

roles/installer/tasks/load_bundle_cacert_secret.yml

@@ -0,0 +1,14 @@
+---
+- name: Retrieve bundle Certificate Authority Secret
+  k8s_info:
+    kind: Secret
+    namespace: '{{ meta.namespace }}'
+    name: '{{ bundle_cacert_secret }}'
+  register: bundle_cacert
+  no_log: true
+
+- name: Load bundle Certificate Authority Secret content
+  set_fact:
+    bundle_ca_crt: '{{ bundle_cacert["resources"][0]["data"]["bundle-ca.crt"] | b64decode }}'
+  no_log: true
+  when: '"bundle-ca.crt" in bundle_cacert["resources"][0]["data"]'

roles/installer/tasks/load_ldap_cacert_secret.yml

@@ -1,12 +1,14 @@
 ---
 - name: Retrieve LDAP CA Certificate Secret
-  community.kubernetes.k8s_info:
+  k8s_info:
     kind: Secret
     namespace: '{{ meta.namespace }}'
     name: '{{ ldap_cacert_secret }}'
   register: ldap_cacert
+  no_log: true
 
 - name: Load LDAP CA Certificate Secret content
   set_fact:
     ldap_cacert_ca_crt: '{{ ldap_cacert["resources"][0]["data"]["ldap-ca.crt"] | b64decode }}'
+  no_log: true
   when: '"ldap-ca.crt" in ldap_cacert["resources"][0]["data"]'

roles/installer/tasks/load_route_tls_secret.yml

@@ -1,17 +1,20 @@
 ---
 - name: Retrieve Route TLS Secret
-  community.kubernetes.k8s_info:
+  k8s_info:
     kind: Secret
     namespace: '{{ meta.namespace }}'
-    name: '{{ tower_route_tls_secret }}'
+    name: '{{ route_tls_secret }}'
   register: route_tls
+  no_log: true
 
 - name: Load Route TLS Secret content
   set_fact:
-    tower_route_tls_key: '{{ route_tls["resources"][0]["data"]["tls.key"] | b64decode }}'
-    tower_route_tls_crt: '{{ route_tls["resources"][0]["data"]["tls.crt"] | b64decode }}'
+    route_tls_key: '{{ route_tls["resources"][0]["data"]["tls.key"] | b64decode }}'
+    route_tls_crt: '{{ route_tls["resources"][0]["data"]["tls.crt"] | b64decode }}'
+  no_log: true
 
 - name: Load Route TLS Secret content
   set_fact:
-    tower_route_ca_crt: '{{ route_tls["resources"][0]["data"]["ca.crt"] | b64decode }}'
+    route_ca_crt: '{{ route_tls["resources"][0]["data"]["ca.crt"] | b64decode }}'
+  no_log: true
   when: '"ca.crt" in route_tls["resources"][0]["data"]'

roles/installer/tasks/main.yml

@@ -15,6 +15,7 @@
           app.kubernetes.io/part-of: '{{ meta.name }}'
           app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
           app.kubernetes.io/component: '{{ deployment_type }}'
+          app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
 
 - name: Include secret key configuration tasks
   include_tasks: secret_key_configuration.yml
@@ -24,6 +25,11 @@
   when:
     - ldap_cacert_secret != ''
 
+- name: Load bundle certificate authority certificate
+  include_tasks: load_bundle_cacert_secret.yml
+  when:
+    - bundle_cacert_secret != ''
+
 - name: Include admin password configuration tasks
   include_tasks: admin_password_configuration.yml
 
@@ -36,8 +42,8 @@
 - name: Load Route TLS certificate
   include_tasks: load_route_tls_secret.yml
   when:
-    - tower_ingress_type | lower == 'route'
-    - tower_route_tls_secret != ''
+    - ingress_type | lower == 'route'
+    - route_tls_secret != ''
 
 - name: Include resources configuration tasks
   include_tasks: resources_configuration.yml
@@ -69,3 +75,6 @@
 
 - name: Update status variables
   include_tasks: update_status.yml
+
+- name: Cleanup & Set garbage collection refs
+  include_tasks: cleanup.yml

roles/installer/tasks/migrate_data.yml

@@ -1,12 +1,22 @@
 ---
 
+- name: Set actual old postgres configuration secret name
+  set_fact:
+    old_postgres_configuration_name: "{{ old_pg_config['resources'][0]['metadata']['name'] }}"
+
 - name: Store Database Configuration
   set_fact:
-    tower_old_postgres_user: "{{ old_pg_config['resources'][0]['data']['username'] | b64decode }}"
-    tower_old_postgres_pass: "{{ old_pg_config['resources'][0]['data']['password'] | b64decode }}"
-    tower_old_postgres_database: "{{ old_pg_config['resources'][0]['data']['database'] | b64decode }}"
-    tower_old_postgres_port: "{{ old_pg_config['resources'][0]['data']['port'] | b64decode }}"
-    tower_old_postgres_host: "{{ old_pg_config['resources'][0]['data']['host'] | b64decode }}"
+    awx_old_postgres_user: "{{ old_pg_config['resources'][0]['data']['username'] | b64decode }}"
+    awx_old_postgres_pass: "{{ old_pg_config['resources'][0]['data']['password'] | b64decode }}"
+    awx_old_postgres_database: "{{ old_pg_config['resources'][0]['data']['database'] | b64decode }}"
+    awx_old_postgres_port: "{{ old_pg_config['resources'][0]['data']['port'] | b64decode }}"
+    awx_old_postgres_host: "{{ old_pg_config['resources'][0]['data']['host'] | b64decode }}"
+  no_log: true
+
+- name: Default label selector to custom resource generated postgres
+  set_fact:
+    postgres_label_selector: "app.kubernetes.io/instance=postgres-{{ meta.name }}"
+  when: postgres_label_selector is not defined
 
 - name: Get the postgres pod information
   k8s_info:
@@ -16,7 +26,9 @@
     field_selectors:
       - status.phase=Running
   register: postgres_pod
-  until: postgres_pod['resources'] | length
+  until:
+    - "postgres_pod['resources'] | length"
+    - "postgres_pod['resources'][0]['status']['phase'] == 'Running'"
   delay: 5
   retries: 60
 
@@ -30,32 +42,36 @@
 - name: Set pg_dump command
   set_fact:
     pgdump: >-
-      pg_dump --clean --create
-      -h {{ tower_old_postgres_host }}
-      -U {{ tower_old_postgres_user }}
-      -d {{ tower_old_postgres_database }}
-      -p {{ tower_old_postgres_port }}
+      pg_dump
+      -h {{ awx_old_postgres_host }}
+      -U {{ awx_old_postgres_user }}
+      -d {{ awx_old_postgres_database }}
+      -p {{ awx_old_postgres_port }}
+      -F custom
+  no_log: true
 
 - name: Set pg_restore command
   set_fact:
-    psql_restore: >-
-      psql -U {{ database_username }}
-      -d template1
-      -p {{ awx_postgres_port }}
+    pg_restore: >-
+      pg_restore --clean --if-exists
+      -U {{ database_username }}
+      -d {{ database_name }}
+  no_log: true
 
 - name: Stream backup from pg_dump to the new postgresql container
-  community.kubernetes.k8s_exec:
+  k8s_exec:
     namespace: "{{ meta.namespace }}"
     pod: "{{ postgres_pod_name }}"
     command: |
       bash -c """
       set -e -o pipefail
-      PGPASSWORD={{ tower_old_postgres_pass }} {{ pgdump }} | PGPASSWORD={{ awx_postgres_pass }} {{ psql_restore }}
+      PGPASSWORD={{ awx_old_postgres_pass }} {{ pgdump }} | PGPASSWORD={{ awx_postgres_pass }} {{ pg_restore }}
       echo 'Successful'
       """
+  no_log: true
   register: data_migration
   failed_when: "'Successful' not in data_migration.stdout"
 
 - name: Set flag signifying that this instance has been migrated
   set_fact:
-    tower_migrated_from_secret: "{{ tower_old_postgres_configuration_secret }}"
+    tower_migrated_from_secret: "{{ old_postgres_configuration_name }}"

roles/installer/tasks/resources_configuration.yml

@@ -24,17 +24,18 @@
     wait: yes
   register: tower_resources_result
   loop:
-    - 'tower_config'
-    - 'tower_app_credentials'
-    - 'tower_service_account'
-    - 'tower_persistent'
-    - 'tower_service'
-    - 'tower_ingress'
+    - 'config'
+    - 'app_credentials'
+    - 'service_account'
+    - 'persistent'
+    - 'service'
+    - 'ingress'
+  no_log: true
 
 - name: Apply deployment resources
   k8s:
     apply: yes
-    definition: "{{ lookup('template', 'tower_deployment.yaml.j2') }}"
+    definition: "{{ lookup('template', 'deployment.yaml.j2') }}"
     wait: yes
   register: tower_deployment_result
 

roles/installer/tasks/scale_down_deployment.yml

@@ -9,7 +9,7 @@
   register: tower_deployment
 
 - name: Scale down Deployment for migration
-  community.kubernetes.k8s_scale:
+  kubernetes.core.k8s_scale:
     api_version: v1
     kind: Deployment
     name: "{{ meta.name }}"

roles/installer/tasks/secret_key_configuration.yml

@@ -3,9 +3,10 @@
   k8s_info:
     kind: Secret
     namespace: '{{ meta.namespace }}'
-    name: '{{ tower_secret_key_secret }}'
+    name: '{{ secret_key_secret }}'
   register: _custom_secret_key
-  when: tower_secret_key_secret | length
+  no_log: true
+  when: secret_key_secret | length
 
 - name: Check for default secret key configuration
   k8s_info:
@@ -13,16 +14,19 @@
     namespace: '{{ meta.namespace }}'
     name: '{{ meta.name }}-secret-key'
   register: _default_secret_key
+  no_log: true
 
 - name: Set secret key secret
   set_fact:
     _secret_key_secret: '{{ _custom_secret_key["resources"] | default([]) | length | ternary(_custom_secret_key, _default_secret_key) }}'
+  no_log: true
 
 - block:
     - name: Create secret key secret
       k8s:
         apply: true
-        definition: "{{ lookup('template', 'tower_secret_key.yaml.j2') }}"
+        definition: "{{ lookup('template', 'secret_key.yaml.j2') }}"
+      no_log: true
 
     - name: Read secret key secret
       k8s_info:
@@ -30,13 +34,16 @@
         namespace: '{{ meta.namespace }}'
         name: '{{ meta.name }}-secret-key'
       register: _generated_secret_key
+      no_log: true
 
   when: not _secret_key_secret['resources'] | default([]) | length
 
 - name: Set secret key secret
   set_fact:
-    secret_key_secret: '{{ _generated_secret_key["resources"] | default([]) | length | ternary(_generated_secret_key, _secret_key_secret)  }}'
+    __secret_key_secret: '{{ _generated_secret_key["resources"] | default([]) | length | ternary(_generated_secret_key, _secret_key_secret)  }}'
+  no_log: true
 
 - name: Store secret key secret name
   set_fact:
-    secret_key_secret_name: "{{ secret_key_secret['resources'][0]['metadata']['name'] }}"
+    secret_key_secret_name: "{{ __secret_key_secret['resources'][0]['metadata']['name'] }}"
+  no_log: true

roles/installer/tasks/update_status.yml

@@ -6,7 +6,7 @@
     name: "{{ meta.name }}"
     namespace: "{{ meta.namespace }}"
     status:
-      towerAdminPasswordSecret: "{{ admin_password_secret['resources'][0]['metadata']['name'] }}"
+      adminPasswordSecret: "{{ __admin_password_secret['resources'][0]['metadata']['name'] }}"
 
 - name: Update admin user status
   operator_sdk.util.k8s_status:
@@ -15,10 +15,37 @@
     name: "{{ meta.name }}"
     namespace: "{{ meta.namespace }}"
     status:
-      towerAdminUser: "{{ tower_admin_user }}"
+      adminUser: "{{ admin_user }}"
+
+- name: Update postgres configuration status
+  operator_sdk.util.k8s_status:
+    api_version: '{{ api_version }}'
+    kind: "{{ kind }}"
+    name: "{{ meta.name }}"
+    namespace: "{{ meta.namespace }}"
+    status:
+      postgresConfigurationSecret: "{{ pg_config['resources'][0]['metadata']['name'] }}"
+
+- name: Update broadcast websocket status
+  operator_sdk.util.k8s_status:
+    api_version: '{{ api_version }}'
+    kind: "{{ kind }}"
+    name: "{{ meta.name }}"
+    namespace: "{{ meta.namespace }}"
+    status:
+      broadcastWebsocketSecret: "{{ __broadcast_websocket_secret['resources'][0]['metadata']['name'] }}"
+
+- name: Update secret key status
+  operator_sdk.util.k8s_status:
+    api_version: '{{ api_version }}'
+    kind: "{{ kind }}"
+    name: "{{ meta.name }}"
+    namespace: "{{ meta.namespace }}"
+    status:
+      secretKeySecret: "{{ secret_key_secret_name }}"
 
 - name: Retrieve instance version
-  community.kubernetes.k8s_exec:
+  k8s_exec:
     namespace: "{{ meta.namespace }}"
     pod: "{{ tower_pod_name }}"
     container: "{{ meta.name }}-task"
@@ -34,7 +61,7 @@
     name: "{{ meta.name }}"
     namespace: "{{ meta.namespace }}"
     status:
-      towerVersion: "{{ instance_version.stdout | trim }}"
+      version: "{{ instance_version.stdout | trim }}"
 
 - name: Update image status
   operator_sdk.util.k8s_status:
@@ -43,11 +70,12 @@
     name: "{{ meta.name }}"
     namespace: "{{ meta.namespace }}"
     status:
-      towerImage: "{{ tower_image }}"
+      image: "{{ image }}"
 
 - block:
     - name: Retrieve route URL
-      community.kubernetes.k8s_info:
+      k8s_info:
+        api_version: 'route.openshift.io/v1'
         kind: Route
         namespace: '{{ meta.namespace }}'
         name: '{{ meta.name }}'
@@ -60,16 +88,16 @@
         name: "{{ meta.name }}"
         namespace: "{{ meta.namespace }}"
         status:
-          towerURL: "https://{{ route_url['resources'][0]['status']['ingress'][0]['host'] }}"
+          URL: "https://{{ route_url['resources'][0]['status']['ingress'][0]['host'] }}"
 
-  when: tower_ingress_type | lower == 'route'
+  when: ingress_type | lower == 'route'
 
-- name: Update towerMigratedFromSecret status
+- name: Update migratedFromSecret status
   operator_sdk.util.k8s_status:
     api_version: '{{ api_version }}'
     kind: "{{ kind }}"
     name: "{{ meta.name }}"
     namespace: "{{ meta.namespace }}"
     status:
-      towerMigratedFromSecret: "{{ tower_migrated_from_secret }}"
+      migratedFromSecret: "{{ tower_migrated_from_secret }}"
   when: tower_migrated_from_secret is defined

roles/installer/templates/admin_password_secret.yaml.j2

@@ -9,5 +9,6 @@ metadata:
     app.kubernetes.io/part-of: '{{ meta.name }}'
     app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
     app.kubernetes.io/component: '{{ deployment_type }}'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
 stringData:
   password: '{{ lookup('password', '/dev/null length=32 chars=ascii_letters,digits') }}'

roles/installer/templates/app_credentials.yaml.j2

@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/part-of: '{{ meta.name }}'
     app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
     app.kubernetes.io/component: '{{ deployment_type }}'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
 data:
   credentials.py: "{{ lookup('template', 'credentials.py.j2') | b64encode }}"
   ldap.py: "{{ lookup('template', 'ldap.py.j2') | b64encode }}"

roles/installer/templates/broadcast_websocket_secret.yaml.j2

@@ -9,5 +9,6 @@ metadata:
     app.kubernetes.io/part-of: '{{ meta.name }}'
     app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
     app.kubernetes.io/component: '{{ deployment_type }}'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
 stringData:
   secret: '{{ lookup('password', '/dev/null length=32 chars=ascii_letters,digits') }}'

roles/installer/templates/config.yaml.j2

@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/part-of: '{{ meta.name }}'
     app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
     app.kubernetes.io/component: '{{ deployment_type }}'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
 data:
   environment: |
     AWX_SKIP_MIGRATIONS=true
@@ -45,7 +46,7 @@ data:
     AWX_AUTO_DEPROVISION_INSTANCES = True
     
     CLUSTER_HOST_ID = socket.gethostname()
-    SYSTEM_UUID = '00000000-0000-0000-0000-000000000000'
+    SYSTEM_UUID = os.environ.get('MY_POD_UID', '00000000-0000-0000-0000-000000000000')
     
     CSRF_COOKIE_SECURE = False
     SESSION_COOKIE_SECURE = False
@@ -129,7 +130,7 @@ data:
         }
     
 
-        {% if tower_route_tls_termination_mechanism | lower == 'passthrough' %}
+        {% if route_tls_termination_mechanism | lower == 'passthrough' %}
         server {
             listen 8052 default_server;
             server_name _;
@@ -140,11 +141,16 @@ data:
         {% endif %}
 
         server {
-        {% if tower_route_tls_termination_mechanism | lower == 'passthrough' %}
+        {% if route_tls_termination_mechanism | lower == 'passthrough' %}
             listen 8053 ssl;
 
             ssl_certificate /etc/nginx/pki/web.crt;
             ssl_certificate_key /etc/nginx/pki/web.key;
+            ssl_session_cache shared:SSL:50m;
+            ssl_session_timeout 1d;
+            ssl_session_tickets off;
+            ssl_ciphers PROFILE=SYSTEM;
+            ssl_prefer_server_ciphers on;
         {% else %}
             listen 8052 default_server;
         {% endif %}
@@ -155,8 +161,6 @@ data:
     
             # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
             add_header Strict-Transport-Security max-age=15768000;
-            add_header Content-Security-Policy "default-src 'self'; connect-src 'self' ws: wss:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' *.pendo.io; img-src 'self' *.pendo.io data:; report-uri /csp-violation/";
-            add_header X-Content-Security-Policy "default-src 'self'; connect-src 'self' ws: wss:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' *.pendo.io; img-src 'self' *.pendo.io data:; report-uri /csp-violation/";
     
             # Protect against click-jacking https://www.owasp.org/index.php/Testing_for_Clickjacking_(OTG-CLIENT-009)
             add_header X-Frame-Options "DENY";
@@ -173,7 +177,7 @@ data:
             }
     
             location /favicon.ico {
-                alias /var/lib/awx/public/static/favicon.ico;
+                alias /var/lib/awx/public/static/media/favicon.ico;
             }
     
             location /websocket {
@@ -209,6 +213,13 @@ data:
                 {%- endif %}
                 proxy_set_header X-Forwarded-Port 443;
                 uwsgi_param HTTP_X_FORWARDED_PORT 443;
+
+                add_header Strict-Transport-Security max-age=15768000;
+                # Protect against click-jacking https://www.owasp.org/index.php/Testing_for_Clickjacking_(OTG-CLIENT-009)
+                add_header X-Frame-Options "DENY";
+                add_header Cache-Control "no-cache, no-store, must-revalidate";
+                add_header Expires "0";
+                add_header Pragma "no-cache";
             }
         }
     }

roles/installer/templates/deployment.yaml.j2

@@ -7,12 +7,13 @@ metadata:
   namespace: '{{ meta.namespace }}'
   labels:
     app.kubernetes.io/name: '{{ meta.name }}'
-    app.kubernetes.io/version: '{{ tower_image_version }}'
+    app.kubernetes.io/version: '{{ image_version }}'
     app.kubernetes.io/part-of: '{{ meta.name }}'
     app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
     app.kubernetes.io/component: '{{ deployment_type }}'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
 spec:
-  replicas: {{ tower_replicas }}
+  replicas: {{ replicas }}
   selector:
     matchLabels:
       app.kubernetes.io/name: '{{ meta.name }}'
@@ -22,19 +23,56 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: '{{ meta.name }}'
-        app.kubernetes.io/version: '{{ tower_image_version }}'
+        app.kubernetes.io/version: '{{ image_version }}'
         app.kubernetes.io/part-of: '{{ meta.name }}'
         app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
         app.kubernetes.io/component: '{{ deployment_type }}'
     spec:
       serviceAccountName: '{{ meta.name }}'
-{% if tower_image_pull_secret %}
+{% if image_pull_secret %}
       imagePullSecrets:
-        - name: {{ tower_image_pull_secret }}
+        - name: {{ image_pull_secret }}
+{% endif %}
+{% if bundle_ca_crt or projects_persistence|bool or init_container_extra_commands %}
+      initContainers:
+        - name: init
+          image: '{{ init_container_image }}:{{ init_container_image_version }}'
+          imagePullPolicy: '{{ image_pull_policy }}'
+          command:
+            - /bin/sh
+            - -c
+            - |
+{% if bundle_ca_crt  %}
+              mkdir -p /etc/pki/ca-trust/extracted/{java,pem,openssl,edk2}
+              update-ca-trust
+{% endif %}
+{% if projects_persistence|bool %}
+              chmod 775 /var/lib/awx/projects
+              chgrp 1000 /var/lib/awx/projects
+{% endif %}
+{% if init_container_extra_commands %}
+              {{ init_container_extra_commands | indent(width=14) }}
+{% endif %}
+          volumeMounts:
+{% if bundle_ca_crt  %}
+            - name: "ca-trust-extracted"
+              mountPath: "/etc/pki/ca-trust/extracted"
+            - name: "{{ meta.name }}-bundle-cacert"
+              mountPath: /etc/pki/ca-trust/source/anchors/bundle-ca.crt
+              subPath: bundle-ca.crt
+              readOnly: true
+{% endif %}
+{% if projects_persistence|bool %}
+            - name: "{{ meta.name }}-projects"
+              mountPath: "/var/lib/awx/projects"
+{% endif %}
+{% if init_container_extra_volume_mounts -%}
+            {{ init_container_extra_volume_mounts | indent(width=12, indentfirst=True) }}
+{% endif %}
 {% endif %}
       containers:
-        - image: '{{ tower_redis_image }}:{{ tower_redis_image_version }}'
-          imagePullPolicy: '{{ tower_image_pull_policy }}'
+        - image: '{{ redis_image }}:{{ redis_image_version }}'
+          imagePullPolicy: '{{ image_pull_policy }}'
           name: redis
           args: ["redis-server", "/etc/redis.conf"]
           volumeMounts:
@@ -46,21 +84,29 @@ spec:
               mountPath: "/var/run/redis"
             - name: "{{ meta.name }}-redis-data"
               mountPath: "/data"
-        - image: '{{ tower_image }}:{{ tower_image_version }}'
+        - image: '{{ image }}:{{ image_version }}'
           name: '{{ meta.name }}-web'
-{% if tower_web_command %}
-          command: {{ tower_web_command }}
+{% if web_command %}
+          command: {{ web_command }}
 {% endif %}
-{% if tower_web_args %}
-          args: {{ tower_web_args }}
+{% if web_args %}
+          args: {{ web_args }}
 {% endif %}
-          imagePullPolicy: '{{ tower_image_pull_policy }}'
+          imagePullPolicy: '{{ image_pull_policy }}'
           ports:
             - containerPort: 8052
-{% if tower_ingress_type | lower == 'route' and tower_route_tls_termination_mechanism | lower == 'passthrough' %}
+{% if ingress_type | lower == 'route' and route_tls_termination_mechanism | lower == 'passthrough' %}
             - containerPort: 8053
 {% endif %}
           volumeMounts:
+{% if bundle_ca_crt %}
+            - name: "ca-trust-extracted"
+              mountPath: "/etc/pki/ca-trust/extracted"
+            - name: "{{ meta.name }}-bundle-cacert"
+              mountPath: /etc/pki/ca-trust/source/anchors/bundle-ca.crt
+              subPath: bundle-ca.crt
+              readOnly: true
+{% endif %}
             - name: "{{ meta.name }}-application-credentials"
               mountPath: "/etc/tower/conf.d/execution_environments.py"
               subPath: execution_environments.py
@@ -73,7 +119,7 @@ spec:
               mountPath: "/etc/tower/conf.d/ldap.py"
               subPath: ldap.py
               readOnly: true
-{% if tower_ingress_type | lower == 'route' and tower_route_tls_termination_mechanism | lower == 'passthrough' %}
+{% if ingress_type | lower == 'route' and route_tls_termination_mechanism | lower == 'passthrough' %}
             - name: "{{ meta.name }}-nginx-certs"
               mountPath: "/etc/nginx/pki"
               readOnly: true
@@ -110,8 +156,8 @@ spec:
             - name: awx-devel
               mountPath: "/awx_devel"
 {% endif %}
-{% if tower_web_extra_volume_mounts -%}
-            {{ tower_web_extra_volume_mounts | indent(width=12, indentfirst=True) }}
+{% if web_extra_volume_mounts -%}
+            {{ web_extra_volume_mounts | indent(width=12, indentfirst=True) }}
 {% endif %}
           env:
             - name: MY_POD_NAMESPACE
@@ -122,24 +168,32 @@ spec:
             - name: AWX_KUBE_DEVEL
               value: "1"
 {% endif %}
-{% if tower_web_extra_env -%}
-            {{ tower_web_extra_env | indent(width=12, indentfirst=True) }}
+{% if web_extra_env -%}
+            {{ web_extra_env | indent(width=12, indentfirst=True) }}
 {% endif %}
-          resources: {{ tower_web_resource_requirements }}
-        - image: '{{ tower_image }}:{{ tower_image_version }}'
+          resources: {{ web_resource_requirements }}
+        - image: '{{ image }}:{{ image_version }}'
           name: '{{ meta.name }}-task'
-          imagePullPolicy: '{{ tower_image_pull_policy }}'
-{% if tower_task_privileged == true %}
+          imagePullPolicy: '{{ image_pull_policy }}'
+{% if task_privileged == true %}
           securityContext:
             privileged: true
 {% endif %}
-{% if tower_task_command %}
-          command: {{ tower_task_command }}
+{% if task_command %}
+          command: {{ task_command }}
 {% endif %}
-{% if tower_task_args %}
-          args: {{ tower_task_args }}
+{% if task_args %}
+          args: {{ task_args }}
 {% endif %}
           volumeMounts:
+{% if bundle_ca_crt %}
+            - name: "ca-trust-extracted"
+              mountPath: "/etc/pki/ca-trust/extracted"
+            - name: "{{ meta.name }}-bundle-cacert"
+              mountPath: /etc/pki/ca-trust/source/anchors/bundle-ca.crt
+              subPath: bundle-ca.crt
+              readOnly: true
+{% endif %}
             - name: "{{ meta.name }}-application-credentials"
               mountPath: "/etc/tower/conf.d/execution_environments.py"
               subPath: execution_environments.py
@@ -176,8 +230,8 @@ spec:
             - name: awx-devel
               mountPath: "/awx_devel"
 {% endif %}
-{% if tower_task_extra_volume_mounts -%}
-            {{ tower_task_extra_volume_mounts | indent(width=12, indentfirst=True) }}
+{% if task_extra_volume_mounts -%}
+            {{ task_extra_volume_mounts | indent(width=12, indentfirst=True) }}
 {% endif %}
           env:
             - name: SUPERVISOR_WEB_CONFIG_PATH
@@ -200,15 +254,24 @@ spec:
             - name: AWX_KUBE_DEVEL
               value: "1"
 {% endif %}
-{% if tower_task_extra_env -%}
-            {{ tower_task_extra_env | indent(width=12, indentfirst=True) }}
+{% if task_extra_env -%}
+            {{ task_extra_env | indent(width=12, indentfirst=True) }}
 {% endif %}
-          resources: {{ tower_task_resource_requirements }}
-        - image: '{{ tower_ee_images[0].image }}'
+          resources: {{ task_resource_requirements }}
+        - image: '{{ control_plane_ee_image }}'
           name: '{{ meta.name }}-ee'
-          imagePullPolicy: '{{ tower_image_pull_policy }}'
+          imagePullPolicy: '{{ image_pull_policy }}'
+          resources: {{ ee_resource_requirements }}
           args: ['receptor', '--config', '/etc/receptor.conf']
           volumeMounts:
+{% if bundle_ca_crt %}
+            - name: "ca-trust-extracted"
+              mountPath: "/etc/pki/ca-trust/extracted"
+            - name: "{{ meta.name }}-bundle-cacert"
+              mountPath: /etc/pki/ca-trust/source/anchors/bundle-ca.crt
+              subPath: bundle-ca.crt
+              readOnly: true
+{% endif %}
             - name: "{{ meta.name }}-receptor-config"
               mountPath: "/etc/receptor.conf"
               subPath: receptor.conf
@@ -217,29 +280,46 @@ spec:
               mountPath: "/var/run/receptor"
             - name: "{{ meta.name }}-projects"
               mountPath: "/var/lib/awx/projects"
-{% if tower_ee_extra_volume_mounts -%}
-            {{ tower_ee_extra_volume_mounts | indent(width=12, indentfirst=True) }}
+{% if ee_extra_volume_mounts -%}
+            {{ ee_extra_volume_mounts | indent(width=12, indentfirst=True) }}
 {% endif %}
-{% if development_mode | bool %}
           env:
+{% if development_mode | bool %}
             - name: SDB_NOTIFY_HOST
               valueFrom:
                 fieldRef:
                   fieldPath: status.podIP
 {% endif %}
-{% if tower_node_selector %}
-      nodeSelector:
-        {{ tower_node_selector | indent(width=8) }}
+{% if ee_extra_env -%}
+            {{ ee_extra_env | indent(width=12, indentfirst=True) }}
 {% endif %}
-{% if tower_tolerations %}
+{% if node_selector %}
+      nodeSelector:
+        {{ node_selector | indent(width=8) }}
+{% endif %}
+{% if tolerations %}
       tolerations:
-        {{ tower_tolerations | indent(width=8) }}
+        {{ tolerations | indent(width=8) }}
+{% endif %}
+{% if projects_persistence|bool %}
+      securityContext:
+        fsGroup: 1000
 {% endif %}
       volumes:
-{% if tower_ingress_type | lower == 'route' and tower_route_tls_termination_mechanism | lower == 'passthrough' %}
+{% if bundle_ca_crt %}
+        - name: "ca-trust-extracted"
+          emptyDir: {}
+        - name: "{{ meta.name }}-bundle-cacert"
+          secret:
+            secretName: "{{ bundle_cacert_secret }}"
+            items:
+              - key: bundle-ca.crt
+                path: 'bundle-ca.crt'
+{% endif %}
+{% if ingress_type | lower == 'route' and route_tls_termination_mechanism | lower == 'passthrough' %}
         - name: "{{ meta.name }}-nginx-certs"
           secret:
-            secretName: "{{ tower_route_tls_secret }}"
+            secretName: "{{ route_tls_secret }}"
             items:
               - key: tls.key
                 path: 'web.key'
@@ -307,10 +387,10 @@ spec:
               - key: receptor_conf
                 path: receptor.conf
         - name: "{{ meta.name }}-projects"
-{% if tower_projects_persistence|bool %}
+{% if projects_persistence|bool %}
           persistentVolumeClaim:
-{% if tower_projects_existing_claim %}
-            claimName: {{ tower_projects_existing_claim }}
+{% if projects_existing_claim %}
+            claimName: {{ projects_existing_claim }}
 {% else %}
             claimName: '{{ meta.name }}-projects-claim'
 {% endif %}
@@ -322,6 +402,6 @@ spec:
           hostPath:
             path: /awx_devel
 {% endif %}
-{% if tower_extra_volumes -%}
-        {{ tower_extra_volumes | indent(width=8, indentfirst=True) }}
+{% if extra_volumes -%}
+        {{ extra_volumes | indent(width=8, indentfirst=True) }}
 {% endif %}

roles/installer/templates/execution_environments.py.j2

@@ -1,5 +1,6 @@
-DEFAULT_EXECUTION_ENVIRONMENTS = [
-{% for item in tower_ee_images %}
+GLOBAL_JOB_EXECUTION_ENVIRONMENTS = [
+{% for item in ee_images %}
     {'name': '{{ item.name }}' , 'image': '{{ item.image }}'},
 {% endfor %}
 ]
+CONTROL_PLANE_EXECUTION_ENVIRONMENT = '{{ control_plane_ee_image }}'

roles/installer/templates/ingress.yaml.j2

@@ -1,4 +1,4 @@
-{% if 'ingress' == tower_ingress_type|lower %}
+{% if ingress_type|lower == "ingress" %}
 ---
 apiVersion: extensions/v1beta1
 kind: Ingress
@@ -10,28 +10,29 @@ metadata:
     app.kubernetes.io/part-of: '{{ meta.name }}'
     app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
     app.kubernetes.io/component: '{{ deployment_type }}'
-{% if tower_ingress_annotations %}
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
+{% if ingress_annotations %}
   annotations:
-    {{ tower_ingress_annotations | indent(width=4) }}
+    {{ ingress_annotations | indent(width=4) }}
 {% endif %}
 spec:
   rules:
-    - host: '{{ tower_hostname }}'
+    - host: '{{ hostname }}'
       http:
         paths:
-          - path: /
+          - path: '{{ ingress_path }}'
             backend:
               serviceName: '{{ meta.name }}-service'
               servicePort: 80
-{% if tower_ingress_tls_secret %}
+{% if ingress_tls_secret %}
   tls:
     - hosts:
-        - {{ tower_hostname }}
-      secretName: {{ tower_ingress_tls_secret }}
+        - {{ hostname }}
+      secretName: {{ ingress_tls_secret }}
 {% endif %}
 {% endif %}
 
-{% if 'route' == tower_ingress_type|lower %}
+{% if ingress_type|lower == "route" %}
 ---
 apiVersion: route.openshift.io/v1
 kind: Route
@@ -43,23 +44,24 @@ metadata:
     app.kubernetes.io/part-of: '{{ meta.name }}'
     app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
     app.kubernetes.io/component: '{{ deployment_type }}'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
 spec:
-{% if tower_route_host != '' %}
-  host: {{ tower_route_host }}
+{% if route_host != '' %}
+  host: {{ route_host }}
 {% endif %}
   port:
-    targetPort: '{{ (tower_route_tls_termination_mechanism | lower == "passthrough") | ternary("https", "http") }}'
+    targetPort: '{{ (route_tls_termination_mechanism | lower == "passthrough") | ternary("https", "http") }}'
   tls:
     insecureEdgeTerminationPolicy: Redirect
-    termination: {{ tower_route_tls_termination_mechanism | lower }}
-{% if tower_route_tls_termination_mechanism | lower == 'edge' and tower_route_tls_secret != '' %}
+    termination: {{ route_tls_termination_mechanism | lower }}
+{% if route_tls_termination_mechanism | lower == 'edge' and route_tls_secret != '' %}
     key: |-
-{{ tower_route_tls_key | indent(width=6, indentfirst=True) }}
+{{ route_tls_key | indent(width=6, indentfirst=True) }}
     certificate: |-
-{{ tower_route_tls_crt | indent(width=6, indentfirst=True) }}
-{% if tower_route_ca_crt is defined %}
+{{ route_tls_crt | indent(width=6, indentfirst=True) }}
+{% if route_ca_crt is defined %}
     caCertificate: |-
-{{ tower_route_ca_crt | indent(width=6, indentfirst=True) }}
+{{ route_ca_crt | indent(width=6, indentfirst=True) }}
 {% endif %}
 {% endif %}
   to:

roles/installer/templates/persistent.yaml.j2

@@ -0,0 +1,22 @@
+{% if projects_persistence|bool and projects_existing_claim == '' %}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ meta.name }}-projects-claim'
+  namespace: '{{ meta.namespace }}'
+  labels:
+    app.kubernetes.io/name: '{{ meta.name }}'
+    app.kubernetes.io/part-of: '{{ meta.name }}'
+    app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
+    app.kubernetes.io/component: '{{ deployment_type }}'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
+spec:
+  accessModes:
+    - {{ projects_storage_access_mode }}
+  resources:
+    requests:
+      storage: {{ projects_storage_size }}
+{% if projects_storage_class is defined %}
+  storageClassName: {{ projects_storage_class }}
+{% endif %}
+{% endif %}

roles/installer/templates/postgres.yaml.j2

@@ -6,16 +6,20 @@ metadata:
   name: '{{ meta.name }}-postgres'
   namespace: '{{ meta.namespace }}'
   labels:
-    app.kubernetes.io/name: '{{ meta.name }}-postgres'
+    app.kubernetes.io/name: 'postgres'
+    app.kubernetes.io/instance: 'postgres-{{ meta.name }}'
+    app.kubernetes.io/component: 'database'
     app.kubernetes.io/part-of: '{{ meta.name }}'
     app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
     app.kubernetes.io/component: database
 spec:
   selector:
     matchLabels:
-      app.kubernetes.io/name: '{{ meta.name }}-postgres'
+      app.kubernetes.io/name: 'postgres'
+      app.kubernetes.io/instance: 'postgres-{{ meta.name }}'
+      app.kubernetes.io/component: 'database'
       app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
-      app.kubernetes.io/component: database
   serviceName: '{{ meta.name }}'
   replicas: 1
   updateStrategy:
@@ -23,69 +27,75 @@ spec:
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: '{{ meta.name }}-postgres'
+        app.kubernetes.io/name: 'postgres'
+        app.kubernetes.io/instance: 'postgres-{{ meta.name }}'
+        app.kubernetes.io/component: 'database'
         app.kubernetes.io/part-of: '{{ meta.name }}'
-        app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
-        app.kubernetes.io/component: database
+        app.kubernetes.io/managed-by: '{{ deployment_type }}-operator' 
     spec:
+{% if image_pull_secret %}
+      imagePullSecrets:
+        - name: {{ image_pull_secret }}
+{% endif %}
       containers:
-        - image: '{{ tower_postgres_image }}:{{ tower_postgres_image_version }}'
+        - image: '{{ postgres_image }}:{{ postgres_image_version }}'
+          imagePullPolicy: '{{ image_pull_policy }}'
           name: postgres
           env:
-            # For tower_postgres_image based on rhel8/postgresql-12
+            # For postgres_image based on rhel8/postgresql-12
             - name: POSTGRESQL_DATABASE
               valueFrom:
                 secretKeyRef:
-                  name: '{{ meta.name }}-postgres-configuration'
+                  name: '{{ __postgres_configuration_secret }}'
                   key: database
             - name: POSTGRESQL_USER
               valueFrom:
                 secretKeyRef:
-                  name: '{{ meta.name }}-postgres-configuration'
+                  name: '{{ __postgres_configuration_secret }}'
                   key: username
             - name: POSTGRESQL_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: '{{ meta.name }}-postgres-configuration'
+                  name: '{{ __postgres_configuration_secret }}'
                   key: password
 
-            # For tower_postgres_image based on postgres
+            # For postgres_image based on postgres
             - name: POSTGRES_DB
               valueFrom:
                 secretKeyRef:
-                  name: '{{ meta.name }}-postgres-configuration'
+                  name: '{{ __postgres_configuration_secret }}'
                   key: database
             - name: POSTGRES_USER
               valueFrom:
                 secretKeyRef:
-                  name: '{{ meta.name }}-postgres-configuration'
+                  name: '{{ __postgres_configuration_secret }}'
                   key: username
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: '{{ meta.name }}-postgres-configuration'
+                  name: '{{ __postgres_configuration_secret }}'
                   key: password
             - name: PGDATA
-              value: '{{ tower_postgres_data_path }}'
+              value: '{{ postgres_data_path }}'
             - name: POSTGRES_INITDB_ARGS
               value: '{{ postgres_initdb_args }}'
             - name: POSTGRES_HOST_AUTH_METHOD
               value: '{{ postgres_host_auth_method }}'
           ports:
-            - containerPort: 5432
+            - containerPort: {{ awx_postgres_port | default('5432')}}
               name: postgres
           volumeMounts:
             - name: postgres
-              mountPath: '{{ tower_postgres_data_path | dirname }}'
-              subPath: '{{ tower_postgres_data_path | dirname | basename }}'
-          resources: {{ tower_postgres_resource_requirements }}
-{% if tower_postgres_selector %}
+              mountPath: '{{ postgres_data_path | dirname }}'
+              subPath: '{{ postgres_data_path | dirname | basename }}'
+          resources: {{ postgres_resource_requirements }}
+{% if postgres_selector %}
       nodeSelector:
-        {{ tower_postgres_selector | indent(width=8) }}
+        {{ postgres_selector | indent(width=8) }}
 {% endif %}
-{% if tower_postgres_tolerations %}
+{% if postgres_tolerations %}
       tolerations:
-        {{ tower_postgres_tolerations | indent(width=8) }}
+        {{ postgres_tolerations | indent(width=8) }}
 {% endif %}
   volumeClaimTemplates:
     - metadata:
@@ -93,10 +103,10 @@ spec:
       spec:
         accessModes:
           - ReadWriteOnce
-{% if tower_postgres_storage_class != '' %}
-        storageClassName: '{{ tower_postgres_storage_class }}'
+{% if postgres_storage_class is defined %}
+        storageClassName: '{{ postgres_storage_class }}'
 {% endif %}
-        resources: {{ tower_postgres_storage_requirements }}
+        resources: {{ postgres_storage_requirements }}
 
 # Postgres Service.
 ---
@@ -106,15 +116,20 @@ metadata:
   name: '{{ meta.name }}-postgres'
   namespace: '{{ meta.namespace }}'
   labels:
-    app.kubernetes.io/name: '{{ meta.name }}-postgres'
+    app.kubernetes.io/name: 'postgres'
+    app.kubernetes.io/instance: 'postgres-{{ meta.name }}'
+    app.kubernetes.io/component: 'database'
     app.kubernetes.io/part-of: '{{ meta.name }}'
     app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
     app.kubernetes.io/component: database
 spec:
   ports:
     - port: 5432
   clusterIP: None
   selector:
-    app.kubernetes.io/name: '{{ meta.name }}-postgres'
+    app.kubernetes.io/name: 'postgres'
+    app.kubernetes.io/instance: 'postgres-{{ meta.name }}'
+    app.kubernetes.io/component: 'database'
+    app.kubernetes.io/part-of: '{{ meta.name }}'
     app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
-    app.kubernetes.io/component: database

roles/installer/templates/postgres_secret.yaml.j2

@@ -10,6 +10,7 @@ metadata:
     app.kubernetes.io/part-of: '{{ meta.name }}'
     app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
     app.kubernetes.io/component: '{{ deployment_type }}'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
 stringData:
   password: '{{ lookup('password', '/dev/null length=32 chars=ascii_letters,digits') }}'
   username: '{{ database_username }}'

roles/installer/templates/secret_key.yaml.j2

@@ -9,5 +9,6 @@ metadata:
     app.kubernetes.io/part-of: '{{ meta.name }}'
     app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
     app.kubernetes.io/component: '{{ deployment_type }}'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
 stringData:
   secret_key: '{{ lookup('password', '/dev/null length=32 chars=ascii_letters,digits') }}'

roles/installer/templates/service.yaml.j2

@@ -9,31 +9,33 @@ metadata:
     app.kubernetes.io/part-of: '{{ meta.name }}'
     app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
     app.kubernetes.io/component: '{{ deployment_type }}'
-{% if tower_ingress_type | lower == 'loadbalancer' and tower_loadbalancer_annotations %}
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
+    {{ service_labels | indent(width=4) }}
+{% if service_type | lower == 'loadbalancer' and loadbalancer_annotations %}
   annotations:
-    {{ tower_loadbalancer_annotations | indent(width=4) }}
+    {{ loadbalancer_annotations | indent(width=4) }}
 {% endif %}
 spec:
   ports:
-{% if tower_ingress_type | lower != 'loadbalancer' and tower_loadbalancer_protocol | lower != 'https' %}
+{% if service_type | lower != 'loadbalancer' and loadbalancer_protocol | lower != 'https' %}
     - port: 80
       protocol: TCP
       targetPort: 8052
       name: http
 {% endif %}
-{% if tower_ingress_type | lower == 'route' and tower_route_tls_termination_mechanism | lower == 'passthrough' %}
+{% if ingress_type | lower == 'route' and route_tls_termination_mechanism | lower == 'passthrough' %}
     - port: 443
       protocol: TCP
       targetPort: 8053
       name: https
 {% endif %}
-{% if tower_ingress_type | lower == 'loadbalancer' and tower_loadbalancer_protocol | lower == 'https' %}
-    - port: {{ tower_loadbalancer_port }}
+{% if service_type | lower == 'loadbalancer' and loadbalancer_protocol | lower == 'https' %}
+    - port: {{ loadbalancer_port }}
       protocol: TCP
       targetPort: 8052
       name: https
-{% elif tower_ingress_type | lower == 'loadbalancer' and tower_loadbalancer_protocol | lower != 'https' %}
-    - port: {{ tower_loadbalancer_port }}
+{% elif service_type | lower == 'loadbalancer' and loadbalancer_protocol | lower != 'https' %}
+    - port: {{ loadbalancer_port }}
       protocol: TCP
       targetPort: 8052
       name: http
@@ -42,9 +44,9 @@ spec:
     app.kubernetes.io/name: '{{ meta.name }}'
     app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
     app.kubernetes.io/component: '{{ deployment_type }}'
-{% if tower_ingress_type | lower == "loadbalancer" %}
+{% if service_type | lower == "loadbalancer" %}
   type: LoadBalancer
-{% elif tower_ingress_type != "none" %}
+{% elif service_type | lower == "nodeport" %}
   type: NodePort
 {% else %}
   type: ClusterIP

roles/installer/templates/service_account.yaml.j2

@@ -9,6 +9,11 @@ metadata:
     app.kubernetes.io/part-of: '{{ meta.name }}'
     app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
     app.kubernetes.io/component: '{{ deployment_type }}'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
+{% if service_account_annotations %}
+  annotations:
+    {{ service_account_annotations | indent(width=4) }}
+{% endif %}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -25,6 +30,9 @@ rules:
 - apiGroups: [""]
   resources: ["pods/attach"]
   verbs: ["create"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "create", "delete"]
 
 ---
 kind: RoleBinding

roles/installer/templates/tower_persistent.yaml.j2

@@ -1,21 +0,0 @@
-{% if tower_projects_persistence|bool and tower_projects_existing_claim == '' %}
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: '{{ meta.name }}-projects-claim'
-  namespace: '{{ meta.namespace }}'
-  labels:
-   app.kubernetes.io/name: '{{ meta.name }}'
-   app.kubernetes.io/part-of: '{{ meta.name }}'
-   app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
-   app.kubernetes.io/component: '{{ deployment_type }}'
-spec:
-  accessModes:
-    - {{ tower_projects_storage_access_mode }}
-  resources:
-    requests:
-      storage: {{ tower_projects_storage_size }}
-{% if tower_projects_storage_class != '' %}
-  storageClassName: {{ tower_projects_storage_class }}
-{% endif %}
-{% endif %}

roles/installer/vars/main.yml

@@ -2,4 +2,5 @@
 postgres_initdb_args: '--auth-host=scram-sha-256'
 postgres_host_auth_method: 'scram-sha-256'
 ldap_cacert_ca_crt: ''
-tower_projects_existing_claim: ''
+bundle_ca_crt: ''
+projects_existing_claim: ''

roles/restore/README.md

@@ -0,0 +1,121 @@
+Restore Role
+=========
+
+The purpose of this role is to restore your AWX deployment from an existing PVC backup. The backup includes:
+  - custom deployment specific values in the spec section of the AWX custom resource object
+  - backup of the postgresql database
+  - secret_key, admin_password, and broadcast_websocket secrets
+  - database configuration
+
+
+
+Requirements
+------------
+
+This role assumes you are authenticated with an Openshift or Kubernetes cluster:
+  - The awx-operator has been deployed to the cluster
+  - AWX is deployed to via the operator
+  - An AWX backup is available on a PVC in your cluster (see the backup [README.md](../backup/README.md))
+
+
+Usage
+----------------
+
+Then create a file named `restore-awx.yml` with the following contents:
+
+```yaml
+---
+apiVersion: awx.ansible.com/v1beta1
+kind: AWXRestore
+metadata:
+  name: restore1
+  namespace: my-namespace
+spec:
+  deployment_name: mytower
+  backup_name: awxbackup-2021-04-22
+  backup_pvc_namespace: 'old-awx-namespace'
+```
+
+Note that the `deployment_name` above is the name of the AWX deployment you intend to create and restore to.  
+
+The namespace specified is the namespace the resulting AWX deployment will be in.  The namespace you specified must be pre-created.  
+
+```
+kubectl create ns my-namespace
+```
+
+Finally, use `kubectl` to create the restore object in your cluster:
+
+```bash
+$ kubectl apply -f restore-awx.yml
+```
+
+This will create a new deployment and restore your backup to it.
+
+> :warning: admin_password_secret value will replace the password for the `admin_user` user (by default, this is the `admin` user).
+
+
+Role Variables
+--------------
+
+The name of the backup directory can be found as a status on your AWXBackup object.  This can be found in your cluster's console, or with the client as shown below.  
+
+```bash
+$ kubectl get awxbackup awxbackup1 -o jsonpath="{.items[0].status.backupDirectory}"
+/backups/tower-openshift-backup-2021-04-02-03:25:08
+```
+
+```
+backup_dir: '/backups/tower-openshift-backup-2021-04-02-03:25:08'
+```
+
+
+The name of the PVC can also be found by looking at the backup object.  
+
+```bash
+$ kubectl get awxbackup awxbackup1 -o jsonpath="{.items[0].status.backupClaim}"
+awx-backup-volume-claim
+```
+
+```
+backup_pvc: 'awx-backup-volume-claim'
+```
+
+By default, the backup pvc will be created in the same namespace the awxbackup object is created in. This namespace must be specified using the `backup_pvc_namespace` variable.
+
+```
+backup_pvc_namespace: 'custom-namespace'
+```
+
+If a custom postgres configuration secret was used when deploying AWX, it must be set:
+
+```
+postgres_configuration_secret: 'awx-postgres-configuration'
+```
+
+If the awxbackup object no longer exists, it is still possible to restore from the backup it created by specifying the pvc name and the back directory.
+
+```
+backup_pvc: myoldtower-backup-claim
+backup_dir: /backups/tower-openshift-backup-2021-04-02-03:25:08
+```
+
+
+Testing
+----------------
+
+You can test this role directly by creating and running the following playbook with the appropriate variables:
+
+```
+---
+- name: Restore AWX
+  hosts: localhost
+  gather_facts: false
+  roles:
+    - restore
+```
+
+License
+-------
+
+MIT

roles/restore/defaults/main.yml

@@ -0,0 +1,12 @@
+---
+# Required: specify name of tower deployment to restore to
+deployment_name: ''
+kind: 'AWXRestore'
+api_version: '{{ deployment_type }}.ansible.com/v1beta1'
+
+# Required: specify a pre-created PVC (name) to restore from
+backup_pvc: ''
+backup_pvc_namespace: '{{ meta.namespace }}'
+
+# Required: backup name, found on the awxbackup object
+backup_dir: ''

roles/restore/meta/main.yml

@@ -0,0 +1,31 @@
+---
+galaxy_info:
+  author: Ansible
+  description: AWX role for AWX Operator for Kubernetes.
+  company: Red Hat, Inc.
+
+  license: MIT
+
+  min_ansible_version: 2.8
+
+  platforms:
+    - name: EL
+      versions:
+        - all
+    - name: Debian
+      versions:
+        - all
+
+  galaxy_tags:
+    - tower
+    - controller
+    - awx
+    - ansible
+    - restore
+    - automation
+
+dependencies: []
+
+collections:
+  - kubernetes.core
+  - operator_sdk.util

roles/restore/tasks/cleanup.yml

@@ -0,0 +1,37 @@
+---
+
+- name: Delete any existing management pod
+  k8s:
+    name: "{{ meta.name }}-db-management"
+    kind: Pod
+    namespace: "{{ backup_pvc_namespace }}"
+    state: absent
+    force: true
+
+- name: Remove ownerReferences from secrets to avoid garbage collection
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Secret
+      metadata:
+        name: '{{ item }}'
+        namespace: '{{ meta.namespace }}'
+        ownerReferences: null
+  loop:
+    - '{{ secret_key_secret }}'
+    - '{{ admin_password_secret }}'
+    - '{{ broadcast_websocket_secret }}'
+    - '{{ postgres_configuration_secret }}'
+  no_log: true
+
+- name: Cleanup temp spec file
+  file:
+    path: "{{ tmp_spec.path }}"
+    state: absent
+  when: tmp_spec.path is defined
+
+- name: Cleanup temp secret vars file
+  file:
+    path: "{{ secret_vars.path }}"
+    state: absent
+  when: secret_vars.path is defined

roles/restore/tasks/deploy_awx.yml

@@ -0,0 +1,44 @@
+---
+
+- name: Get AWX object definition from pvc
+  k8s_exec:
+    namespace: "{{ backup_pvc_namespace }}"
+    pod: "{{ meta.name }}-db-management"
+    command: >-
+      bash -c "cat '{{ backup_dir }}/awx_object'"
+  register: awx_object
+
+- name: Create temp file for spec dict
+  tempfile:
+    state: file
+  register: tmp_spec
+
+- name: Write spec vars to temp file
+  copy:
+    content: "{{ awx_object.stdout }}"
+    dest: "{{ tmp_spec.path }}"
+    mode: '0644'
+
+- name: Include spec vars to save them as a dict
+  include_vars: "{{ tmp_spec.path }}"
+
+- name: Deploy AWX
+  k8s:
+    state: "{{ state | default('present') }}"
+    namespace: "{{ meta.namespace }}"
+    apply: yes
+    definition: "{{ lookup('template', 'awx_object.yml.j2') }}"
+    wait: true
+    wait_condition:
+      type: "Running"
+      status: "True"
+
+- name: Remove ownerReferences to prevent garbage collection of new AWX CRO
+  k8s:
+    definition:
+      apiVersion: '{{ api_version }}'
+      kind: AWX
+      metadata:
+        name: '{{ deployment_name }}'
+        namespace: '{{ meta.namespace }}'
+        ownerReferences: null

roles/restore/tasks/error_handling.yml

@@ -0,0 +1,11 @@
+---
+
+- name: Determine the timestamp
+  set_fact:
+    now: '{{ lookup("pipe", "date +%FT%TZ") }}'
+
+- name: Emit ocp event with error
+  k8s:
+    kind: Event
+    namespace: "{{ meta.namespace }}"
+    template: "event.yml.j2"

roles/restore/tasks/init.yml

@@ -0,0 +1,104 @@
+---
+
+- name: Set variables from awxbackup object statuses if provided
+  block:
+  - name: Look up details for the backup
+    k8s_info:
+      api_version: "{{ backup_api_version }}"
+      kind: "{{ backup_kind }}"
+      name: "{{ backup_name }}"
+      namespace: "{{ backup_pvc_namespace }}"
+    register: this_backup
+
+  - name: Surface error to user
+    block:
+      - name: Set error message
+        set_fact:
+          error_msg: "Cannot read the backup status variables for {{ backup_kind }} {{ backup_name  }}."
+
+      - name: Handle error
+        import_tasks: error_handling.yml
+
+      - name: Fail early if pvc is defined but does not exist
+        fail:
+          msg: "{{ error_msg }}"
+    when:
+      - this_backup['resources'] | length == 0
+      - this_backup['resources'][0] is not defined
+      - this_backup['resources'][0]['status'] is not defined
+      - this_backup['resources'][0]['status']['backupClaim'] is not defined
+      - this_backup['resources'][0]['status']['backupDirectory'] is not defined
+
+  - name: Set backup facts
+    set_fact:
+      backup_pvc: "{{ this_backup['resources'][0]['status']['backupClaim'] }}"
+      backup_dir: "{{ this_backup['resources'][0]['status']['backupDirectory'] }}"
+  when:
+    - backup_name != '' or backup_name is defined
+
+# Check to make sure provided pvc exists, error loudly if not.  Otherwise, the management pod will just stay in pending state forever.
+- name: Check provided PVC exists
+  k8s_info:
+    name: "{{ backup_pvc }}"
+    kind: PersistentVolumeClaim
+    namespace: "{{ backup_pvc_namespace }}"
+  register: provided_pvc
+  when:
+    - backup_pvc != ''
+
+- name: Surface error to user
+  block:
+    - name: Set error message
+      set_fact:
+        error_msg: "{{ backup_pvc }} does not exist, please create this pvc first."
+
+    - name: Handle error
+      import_tasks: error_handling.yml
+
+    - name: Fail early if pvc is defined but does not exist
+      fail:
+        msg: "{{ error_msg }}"
+  when:
+    - backup_pvc != ''
+    - provided_pvc.resources | length == 0
+
+- name: Delete any existing management pod
+  k8s:
+    name: "{{ meta.name }}-db-management"
+    kind: Pod
+    namespace: "{{ backup_pvc_namespace }}"
+    state: absent
+    force: true
+    wait: true
+
+- name: Create management pod from templated deployment config
+  k8s:
+    name: "{{ meta.name }}-db-management"
+    kind: Deployment
+    state: present
+    template: "management-pod.yml.j2"
+    wait: true
+
+- name: Check to make sure backup directory exists on PVC
+  k8s_exec:
+    namespace: "{{ backup_pvc_namespace }}"
+    pod: "{{ meta.name }}-db-management"
+    command: >-
+      bash -c "stat {{ backup_dir }}"
+  register: stat_backup_dir
+
+- name: Error if backup dir is missing
+  block:
+    - name: Set error message
+      set_fact:
+        error_msg: "{{ backup_dir }} does not exist, see the backupDirectory status on your AWXBackup for the correct backup_dir."
+
+    - name: Handle error
+      import_tasks: error_handling.yml
+
+    - name: Fail early if backup dir provided does not exist
+      fail:
+        msg: "{{ error_msg }}"
+  when:
+    - backup_dir != ''
+    - stat_backup_dir.return_code != 0

roles/restore/tasks/main.yml

@@ -0,0 +1,47 @@
+---
+- name: Patching labels to {{ kind }} kind
+  k8s:
+    state: present
+    definition:
+      apiVersion: '{{ api_version }}'
+      kind: '{{ kind }}'
+      name: '{{ meta.name }}'
+      namespace: '{{ meta.namespace }}'
+      metadata:
+        name: '{{ meta.name }}'
+        namespace: '{{ meta.namespace }}'
+        labels:
+          app.kubernetes.io/name: '{{ meta.name }}'
+          app.kubernetes.io/part-of: '{{ meta.name }}'
+          app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
+          app.kubernetes.io/component: '{{ deployment_type }}'
+          app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
+
+- name: Look up details for this restore object
+  k8s_info:
+    api_version: "{{ api_version }}"
+    kind: "{{ kind }}"
+    name: "{{ meta.name }}"
+    namespace: "{{ meta.namespace }}"
+  register: this_restore
+
+- block:
+    - include_tasks: init.yml
+
+    - include_tasks: secrets.yml
+
+    - include_tasks: deploy_awx.yml
+
+    - include_tasks: postgres.yml
+
+    - name: Set flag signifying this restore was successful
+      set_fact:
+        tower_restore_complete: True
+
+    - include_tasks: cleanup.yml
+
+  when:
+    - this_restore['resources'][0]['status']['restoreComplete'] is not defined
+
+- name: Update status variables
+  include_tasks: update_status.yml

roles/restore/tasks/postgres.yml

@@ -0,0 +1,94 @@
+---
+
+- name: Set Postgres Configuration Secret name
+  set_fact:
+    postgres_configuration_secret: "{{ spec['postgres_configuration_secret'] | default(postgres_configuration_secret) }}"
+
+- name: Check for specified PostgreSQL configuration
+  k8s_info:
+    kind: Secret
+    namespace: '{{ meta.namespace }}'
+    name: '{{ postgres_configuration_secret }}'
+  register: pg_config
+  no_log: true
+
+- name: Store Database Configuration
+  set_fact:
+    awx_postgres_user: "{{ pg_config['resources'][0]['data']['username'] | b64decode }}"
+    awx_postgres_pass: "{{ pg_config['resources'][0]['data']['password'] | b64decode }}"
+    awx_postgres_database: "{{ pg_config['resources'][0]['data']['database'] | b64decode }}"
+    awx_postgres_port: "{{ pg_config['resources'][0]['data']['port'] | b64decode }}"
+    awx_postgres_host: "{{ pg_config['resources'][0]['data']['host'] | b64decode }}"
+    awx_postgres_type: "{{ pg_config['resources'][0]['data']['type'] | b64decode | default('unmanaged') }}"
+  no_log: true
+
+- name: Default label selector to custom resource generated postgres
+  set_fact:
+    postgres_label_selector: "app.kubernetes.io/instance=postgres-{{ deployment_name }}"
+  when: postgres_label_selector is not defined
+
+- name: Get the postgres pod information
+  k8s_info:
+    kind: Pod
+    namespace: '{{ meta.namespace }}'
+    label_selectors:
+      - "{{ postgres_label_selector }}"
+  register: postgres_pod
+  until:
+    - "postgres_pod['resources'] | length"
+    - "postgres_pod['resources'][0]['status']['phase'] == 'Running'"
+  delay: 5
+  retries: 60
+
+- name: Set the resource pod name as a variable.
+  set_fact:
+    postgres_pod_name: "{{ postgres_pod['resources'][0]['metadata']['name'] }}"
+
+- name: Check for presence of AWX Deployment
+  k8s_info:
+    api_version: v1
+    kind: Deployment
+    name: "{{ deployment_name }}"
+    namespace: "{{ meta.namespace }}"
+  register: this_deployment
+
+- name: Scale down Deployment for migration
+  k8s_scale:
+    api_version: v1
+    kind: Deployment
+    name: "{{ deployment_name }}"
+    namespace: "{{ meta.namespace }}"
+    replicas: 0
+    wait: yes
+  when: this_deployment['resources'] | length
+
+- name: Set full resolvable host name for postgres pod
+  set_fact:
+    resolvable_db_host: "{{ awx_postgres_host }}.{{ meta.namespace }}.svc.cluster.local"
+  no_log: true
+  when: awx_postgres_type == 'managed'
+
+- name: Set pg_restore command
+  set_fact:
+    pg_restore: >-
+      pg_restore --clean --if-exists
+      -U {{ awx_postgres_user }}
+      -h {{ resolvable_db_host }}
+      -U {{ awx_postgres_user }}
+      -d {{ awx_postgres_database }}
+      -p {{ awx_postgres_port }}
+  no_log: true
+
+- name: Restore database dump to the new postgresql container
+  k8s_exec:
+    namespace: "{{ backup_pvc_namespace }}"
+    pod: "{{ meta.name }}-db-management"
+    command: |
+      bash -c """
+      set -e -o pipefail
+      cat {{ backup_dir }}/tower.db | PGPASSWORD={{ awx_postgres_pass }} {{ pg_restore }}
+      echo 'Successful'
+      """
+  register: data_migration
+  no_log: true
+  failed_when: "'Successful' not in data_migration.stdout"

roles/restore/tasks/secrets.yml

@@ -0,0 +1,76 @@
+---
+
+- name: Get secret definition from pvc
+  k8s_exec:
+    namespace: "{{ backup_pvc_namespace }}"
+    pod: "{{ meta.name }}-db-management"
+    command: >-
+      bash -c "cat '{{ backup_dir }}/secrets.yml'"
+  register: _secrets
+  no_log: true
+
+- name: Create Temporary secrets file
+  tempfile:
+    state: file
+    suffix: .json
+  register: tmp_secrets
+
+- name: Write vars to file locally
+  copy:
+    dest: "{{ tmp_secrets.path }}"
+    content: "{{ _secrets.stdout }}"
+    mode: 0640
+  no_log: true
+
+- name: Include secret vars from backup
+  include_vars: "{{ tmp_secrets.path }}"
+  no_log: true
+
+- name: If deployment is managed, set the database_host in the pg config secret
+  block:
+    - name: Set new database host
+      set_fact:
+        database_host: "{{ deployment_name }}-postgres"
+      no_log: true
+
+    - name: Set tmp postgres secret dict
+      set_fact:
+        _pg_secret: "{{ secrets['postgresConfigurationSecret'] }}"
+      no_log: true
+
+    - name: Change postgres host value
+      set_fact:
+        _pg_data: "{{ _pg_secret['data'] | combine({'host': database_host | b64encode }) }}"
+      no_log: true
+
+    - name: Create a postgres secret with the new host value
+      set_fact:
+        _pg_secret: "{{ _pg_secret | combine({'data': _pg_data}) }}"
+      no_log: true
+
+    - name: Create a new dict of secrets with the new postgres secret
+      set_fact:
+        secrets: "{{ secrets | combine({'postgresConfigurationSecret': _pg_secret}) }}"
+      no_log: true
+  when: secrets['postgresConfigurationSecret']['data']['type'] | b64decode == 'managed'
+
+- name: Apply secret
+  k8s:
+    state: present
+    namespace: "{{ meta.namespace }}"
+    apply: yes
+    wait: yes
+    template: "secrets.yml.j2"
+  no_log: true
+
+- name: Remove ownerReference on restored secrets
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Secret
+      metadata:
+        name: "{{ item.value.name }}"
+        namespace: '{{ meta.namespace }}'
+        ownerReferences: null
+  loop: "{{ secrets | dict2items }}"
+  no_log: true

roles/restore/tasks/update_status.yml

@@ -0,0 +1,11 @@
+---
+
+- name: Update CR Restore status
+  operator_sdk.util.k8s_status:
+    api_version: '{{ api_version }}'
+    kind: "{{ kind }}"
+    name: "{{ meta.name }}"
+    namespace: "{{ meta.namespace }}"
+    status:
+      restoreComplete: true
+  when: tower_restore_complete is defined

roles/restore/templates/awx_object.yml.j2

@@ -0,0 +1,8 @@
+---
+apiVersion: '{{ api_version }}'
+kind: AWX
+metadata:
+  name: '{{ deployment_name }}'
+  namespace: '{{ meta.namespace }}'
+spec:
+  {{ spec | to_yaml | indent(2) }}

roles/restore/templates/event.yml.j2

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Event
+metadata:
+  name: restore-error.{{ now }}
+  namespace: {{ meta.namespace }}
+involvedObject:
+  apiVersion: awx.ansible.com/v1beta1
+  kind: {{ kind }}
+  name: {{ meta.name }}
+  namespace: {{ meta.namespace }}
+message: {{ error_msg }}
+reason: RestoreFailed
+type: Warning
+firstTimestamp: {{ now }}
+lastTimestamp: {{ now }}
+count: 1

roles/restore/templates/management-pod.yml.j2

@@ -0,0 +1,28 @@
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: {{ meta.name }}-db-management
+  namespace: {{ backup_pvc_namespace }}
+  labels:
+    app.kubernetes.io/name: '{{ meta.name }}'
+    app.kubernetes.io/part-of: '{{ meta.name }}'
+    app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
+    app.kubernetes.io/component: '{{ deployment_type }}'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
+spec:
+  containers:
+  - name: {{ meta.name }}-db-management
+    image: "{{ postgres_image }}:{{ postgres_image_version }}"
+    imagePullPolicy: Always
+    command: ["sleep", "infinity"]
+    volumeMounts:
+    - name: {{ meta.name }}-backup
+      mountPath: /backups
+      readOnly: false
+  volumes:
+    - name: {{ meta.name }}-backup
+      persistentVolumeClaim:
+        claimName: {{ backup_pvc }}
+        readOnly: false
+  restartPolicy: Never