AWX needs a Kubernetes cluster, an operator, Postgres, Redis, and Receptor before it runs a single playbook, and it has not shipped a release since July 2024. SwitchTender is one Go binary. Download it, run it, and you have job templates, schedules, RBAC, surveys, SSO, workflows, and approvals, plus a live host-by-task matrix AWX never had. Your AWX export imports in one command.
Three complaints come up every time, and 2024 added a fourth: whether AWX ships at all. SwitchTender was built around them.
Running AWX means running Kubernetes, the AWX Operator, Postgres, and Redis, then keeping all of it patched. That's ongoing platform work every month, keeping the cluster, operator, and datastores patched, just to run playbooks. SwitchTender is one process and one file. Upgrading is replacing a binary. We measured both: a 40 MiB image against roughly 1.6 GiB across four containers, before the first job runs.
Real fleets also run Terraform, scripts, and one-off tooling. AWX runs Ansible. SwitchTender runs Ansible, Terraform, OpenTofu, Bash, PowerShell, Python, and Go through one engine, one UI, and one audit trail, each with a dry-run mode.
AWX shows a text stream. SwitchTender paints every run as a live host-by-task matrix, one cell per host and task, with the failed host highlighted and per-task drill-down. You read a run like a dashboard, not a log.
Every line links to its source, and AWX still works where it already runs. The question is what you stand up next.
AWX 24.6.1, released July 2, 2024, is still the latest release. Red Hat paused releases for a refactor that has shipped no release and no date since.
The last released operator depends on a retired container image, so a new install fails to pull until you patch it by hand.
The 24.6.1 images are two years of CVEs old, and teams report them failing security audits with no patched release to move to.
On AWX's development branch, LDAP, SAML, and OIDC are removed from core. The replacement lives in the paid platform. SwitchTender ships all three in the binary.
"Our goal isn't to offer an exact replica of our commercial product for free," from the AWX modernization update. The direction is a subscription.
The awx.awx collection was removed from the Ansible 14 community package mid-refactor.
The enterprise checklist, side by side. The full three-way table including Semaphore is on the comparison page.
| Capability | SwitchTender | AWX |
|---|---|---|
| Deploy | One binary, SQLite or Postgres | Kubernetes + operator + Postgres + Redis |
| Release cadence | Actively released | Frozen since July 2024 |
| Live host-by-task matrix | ||
| Tools | Ansible, Terraform, OpenTofu, Bash, PowerShell, Python, Go | Ansible only |
| Job templates, surveys, schedules | ||
| Drag-and-drop workflow editor | ||
| RBAC, teams, per-object grants | ||
| LDAP, SAML, OIDC sign-in | Today, yes. Removed on the development branch | |
| Execution environments | All seven tools, Docker or Podman | Ansible only, Podman |
| Instance groups | ||
| High availability | Active-active on Postgres | Via Kubernetes |
| Duration-balanced job splitting | Round-robin slicing | |
| Fleet memory: flaky hosts, trends | ||
| Tamper-evident, signed audit | ||
| Drift detection and reconcile, Ansible and Terraform | ||
| Notification channels | Eleven, each with per-template targets | About ten, per job template |
| Advisory AI triage and fleet answers | ||
| Drop-in Go plugins: tools, secrets, AI, notifiers | ||
| Import from the other side | One command |
AWX has years in production at large organizations, a deep ecosystem of credential types and inventory plugins, and a large community. SwitchTender is new. Every claim on this page is backed by a test you can run, but it doesn't have AWX's years in production yet. That track record only comes from teams running it, starting with the ones who want the capability without the platform. The ecosystem gap is real, but any team can add a tool, a secret engine, an AI provider, or a channel as a drop-in Go plugin binary, no fork and no rebuild of the server.
Ascender is a support-backed fork of the same frozen codebase, with the same Kubernetes-shaped footprint. Oracle Linux Automation Manager repackages AWX 24.6.1 for Oracle Linux hosts. Semaphore is light, but a run is a text log, RBAC sits in its paid tier, and there are no workflows. The full comparison is here. Moving to CI pipelines works until you need RBAC, schedules, approvals, and an audit trail, at which point you have rebuilt a worse control plane. SwitchTender keeps AWX's capabilities without its architecture.
Export from AWX, import into SwitchTender. Projects, inventories, templates, surveys, and schedules come across, with a dry run first so you see the plan before anything is written. Credential secrets are the one thing that does not: AWX will not export a vault password, SSH key, or cloud secret in the clear, which is the behavior you want, so you re-enter those once against the imported credential shells. The import lists exactly which ones need it.
switchtender import awx awx-export.json --db switchtender.dbswitchtender import awx awx-export.json --db switchtender.db --applyThe switching guide maps every AWX concept to its SwitchTender equivalent, and the migration reference covers the details.
The three asked most often when somebody is comparing this against what they already run.
No. It reaches the machines it manages over SSH, the same way Ansible does, and installs nothing on them. There is no per-host daemon to deploy, patch, or account for. You run the one server binary, and optionally a few more worker processes against the same store for throughput, which are pool members rather than agents belonging to a host.
All three, resolved at launch rather than copied into this database. Vault dynamic secrets go further: a short-lived credential is minted for each run and revoked when the run ends. AWS and Azure both authenticate from an instance role or managed identity with no stored key, and anything else resolves through a command whose output is the secret.
Yes, and it is what pipelines are for here. Steps mix tools freely on a dependency graph with parallel branches, built on a drag-and-drop canvas. The approval is not a convention somebody can skip: a policy decides which runs are held, the core enforces the hold, and the approval binds to the exact plan reviewed, so a run cannot be approved as one thing and executed as another.