AWX alternative

The AWX workflow, on one binary.
Without the Kubernetes bill.

AWX needs a Kubernetes cluster, an operator, Postgres, Redis, and Receptor before it runs a single playbook, and it has not shipped a release since July 2024. SwitchTender is one Go binary. Download it, run it, and you have job templates, schedules, RBAC, surveys, workflows, and approvals, with directory sign-in on Pro, plus a live host-by-task matrix AWX never had. Your AWX export imports in one command.

Here because the operator install path stopped working, an upgrade stalled, or nobody has owned the cluster since the last reorg? That is the usual reason people arrive on this page, and it is a fine reason to move.

Get started Read the migration guide

Why teams look for an AWX alternative

Three complaints come up every time, and 2024 added a fourth: whether AWX ships at all. SwitchTender was built around them.

The platform tax

Running AWX means running Kubernetes, the AWX Operator, Postgres, and Redis, then keeping all of it patched. That's ongoing platform work every month, keeping the cluster, operator, and datastores patched, just to run playbooks. SwitchTender is one process and one database. Upgrading is replacing a binary. We measured both: a 293.9 MiB SwitchTender image, Terraform and OpenTofu included, against about 1.5 GiB of images across AWX's four long-lived containers, before the first job runs.

Ansible-only

Real fleets also run Terraform, scripts, and one-off tooling. AWX runs Ansible. SwitchTender runs Ansible, Terraform, OpenTofu, Bash, PowerShell, Python, and Go through one engine, one UI, and one audit trail. Ansible check mode and a Terraform or OpenTofu plan preview a change before it runs. A Bash, PowerShell, Python, or Go dry run only checks the script without running it, so it previews nothing.

A summary, not a matrix

AWX shows a host status bar with per-event drill-down, a summary of the run. SwitchTender paints every run as a live host-by-task matrix, one cell per host and task, with the failed host highlighted and per-task drill-down. You read a run like a dashboard, not a log.

The state of AWX, with dates and sources

Every line links to its source, and AWX still works where it already runs. The question is what you stand up next.

Frozen since July 2024

AWX 24.6.1, released July 2, 2024, is still the latest release. Red Hat paused releases for a refactor that has shipped no release and no date since.

Fresh installs break

The last released operator depends on a retired container image, so a new install fails to pull until you patch it by hand.

Security fixes stopped

The 24.6.1 images carry two years of unpatched CVEs. One is CVE-2026-12564, which Red Hat rates 9.6 for the Vault credential plugin in Ansible Automation Platform. AWX 24.6.1 ships the same kubernetes_auth function in its Vault plugin, and no AWX release has followed. Teams report those images failing security audits with nothing patched to move to.

Sign-in is moving out of core

On AWX's development branch, external authentication has moved out of core into a shared library. No released AWX has dropped LDAP, SAML, or OIDC. SwitchTender ships all three in the same binary you already downloaded, unlocked by Pro at $500 a year, flat per organization.

In Red Hat's words

"Our goal isn't to offer an exact replica of our commercial product for free," from the AWX modernization update. The direction is a subscription.

Feature for feature

The enterprise checklist, side by side. The full three-way table including Semaphore is on the comparison page.

CapabilitySwitchTenderAWX
Approval bound to the content that runs: inventory, image, commit, plan a digest recomputed before executionWorkflow node records a decision, not a digest
Hard ceiling on AI agents: cannot approve its own run or touch identity or secrets agents are principals capped below adminNo AI feature
Evidence a third party verifies offline, without trusting the server signed hash chain, Apache-2.0 verifier
DeployOne binary, SQLite or Postgres creating a new Postgres schema is Team, opening an existing one is never gatedKubernetes + operator + Postgres + Redis
Release cadenceActively releasedFrozen since July 2024
Live host-by-task matrix
ToolsAnsible, Terraform, OpenTofu, Bash, PowerShell, Python, GoAnsible only
Job templates, surveys, schedules
Smart and constructed inventories AWX filter syntax
Provisioning callbacks also at the AWX address, given the AWX template list
Drag-and-drop workflow editor
RBAC, teams, per-object grants
LDAP, SAML, OIDC sign-in Pro, $500/yrYes. Moved out of core on the development branch
Execution environmentsAll seven tools, Docker or PodmanAnsible only, run as pods on Kubernetes
Instance groups worker queues, Team
High availabilityActive-active on Postgres creating the schema is Team, opening an existing one is never gatedVia Kubernetes
Duration-balanced job splittingRound-robin slicing
Flaky-host detection and duration trendsPer-host job summaries, neither of these
Tamper-evident, signed audit
Drift detection and reconcile, Ansible and Terraform detection free, one-click reconcile TeamCheck-mode jobs, no drift report or reconcile
Notification channelsEleven, each with per-template targetsA similar set, attached to organizations, projects, inventory sources, and templates
Advisory AI triage and fleet answers
Drop-in Go plugins: tools, secrets, AI, notifiers
Import from other toolsOne commandAWX format only, through awxkit

Checked against AWX's own documentation on 2026-08-10, for AWX 24.6.1, still current at 24.6.1 on 2026-09-07. A comparison decays the day it is written, so check a row against the current release before you rely on it. Full table and sources.

Where AWX is still ahead

AWX has years in production at large organizations, a deep ecosystem of credential types and inventory plugins, and a large community. The ecosystem gap is real, but any team can add a tool, a secret engine, an AI provider, or a channel as a drop-in Go plugin binary, no fork and no rebuild of the server.

The other options

Ascender is a support-backed fork of the same frozen codebase, with the same Kubernetes-shaped footprint. Oracle Linux Automation Manager repackages AWX 24.6.1 for Oracle Linux hosts. Semaphore is light, but a run is a text log, custom roles sit in its paid tier, and its workflows are limited to task chaining. The full comparison is here. Moving to CI pipelines works until you need RBAC, schedules, approvals, and an audit trail, at which point you have rebuilt a worse control plane. SwitchTender keeps AWX's capabilities without its architecture.

Move in one command

Export from AWX, import into SwitchTender. Projects, inventories (smart and constructed included), templates, workflows with their approval steps, surveys, schedules, notification templates, and the organizations those belong to come across, with a dry run first so you see the plan before anything is written. A workflow the importer cannot carry over as it stands is named in the plan and left out: one with a node that runs another workflow or a sync, a path taken on failure, nodes from more than one project, or an always path and a success path on the same node. Password survey fields arrive as secret fields. Credential secrets never come across, because AWX will not export a vault password, SSH key, or cloud secret in the clear, and neither do the defaults of password fields. Teams, organization memberships, and projects on anything but git are named in the plan as not imported, so you re-enter what is needed once against the imported credential shells. The import lists exactly which ones need it. A template that took provisioning callbacks answers at its old AWX callback address too, once the import knows its AWX id, so the boot scripts and cloud-init data that carry it keep working once the AWX hostname points here. awx export strips ids, so save GET /api/v2/job_templates/ as JSON and pass it with --awx-template-ids to keep those addresses. Smart inventories keep AWX's host_filter syntax, and a static inventory is read inside the binary exactly as Ansible reads it, checked against every ansible-core minor from 2.16 to 2.21.

  1. 1

    Preview the import

    switchtender import awx awx-export.json --db switchtender.db
  2. 2

    Apply it

    # Keep both values: the server must start with this same pair.
export SWITCHTENDER_ENCRYPTION_KEY=$(openssl rand -hex 32)
export SWITCHTENDER_ENCRYPTION_SALT=$(openssl rand -hex 16)
switchtender import awx awx-export.json --db switchtender.db --apply

The switching guide maps every AWX concept to its SwitchTender equivalent, and the migration reference covers the details.

Common questions

The four asked most often when somebody is comparing this against what they already run.

Does it need an agent on each host?

No. It reaches the machines it manages over SSH, the same way Ansible does, and installs no agent on them. There is no per-host daemon to deploy, patch, or account for. You run the one server binary. Worker processes for extra throughput are a Team feature, and they are pool members rather than agents belonging to a host.

Can it read secrets from AWS Secrets Manager, Azure Key Vault, or Vault?

All three, resolved at launch rather than copied into this database. Vault dynamic secrets go further: a short-lived credential is minted for each run and revoked when the run ends. Azure authenticates from the attached managed identity with no stored key, AWS takes an access key from the credential or the standard AWS environment variables, and anything else resolves through a command whose output is the secret.

Can I run a Terraform plan, hold it for approval, then run Ansible?

Yes, and it is what pipelines are for here. Steps mix tools freely on a dependency graph with parallel branches, built on a drag-and-drop canvas, and an approval step holds the pipeline for a person before the steps after it run. A policy decides which runs are held, and an agent's run is held unless a written policy exempts it. When the approval has to bind an exact Terraform plan, run the apply on its own: it plans first, and the approval binds the saved plan, so it cannot be approved as one thing and executed as another. By default an admin may approve a run they launched. Requiring a different person is a Team rule.

What happens if KordLoom stops?

An install keeps running as it is. There is no license server and no phone-home, a paid license keeps verifying offline through its term, and your data and receipts stay yours, checked by an open verifier that does not depend on us. Every release converts to Apache 2.0 two years after it ships, and at once if KordLoom ceases business.

Time to make the switch.

Get started View on GitHub