Add create_superuser option to skip admin user creation#2109
Open
TheRealHaoLiu wants to merge 1 commit intoansible:develfrom
Open
Add create_superuser option to skip admin user creation#2109TheRealHaoLiu wants to merge 1 commit intoansible:develfrom
TheRealHaoLiu wants to merge 1 commit intoansible:develfrom
Conversation
When deploying AWX as part of AAP where all authentication is centralized through the AAP Gateway, the component-level admin user is not needed. Add a boolean `create_superuser` field (default: true) to allow operators to opt out of admin user creation. When create_superuser=false: - admin_password_configuration is skipped (no K8s Secret created) - createsuperuser and update_password management commands are skipped Relates-to: AAP-68980 Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
TheRealHaoLiu
force-pushed
the
aap-68980/no-create-admin-user
branch
from
1e3f877 to
7d32e8f
Compare
AlanCoding
approved these changes
Mar 18, 2026
Member
AlanCoding
left a comment
AlanCoding
left a comment
There was a problem hiding this comment.
Seems to be failing on a line length violation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When deploying AWX as part of AAP where all authentication goes through the AAP Gateway, the component-level admin user is not needed. This PR adds a boolean
create_superuserfield (default:true) that allows operators to opt out of creating the admin superuser during installation.Changes
roles/installer/defaults/main.yml— addcreate_superuser: truedefaultroles/installer/tasks/install.yml— skipadmin_password_configurationwhencreate_superuser=falseroles/installer/tasks/initialize_django.yml— wrapcreatesuperuser+update_passwordin a block gated bycreate_superuser | boolBehavior
When
create_superuser: false:<name>-admin-passwordK8s Secret is not createdawx-manage createsuperuseris not runawx-manage update_passwordis not runWhen
create_superuser: true(default): no change to existing behavior.Context
In AAP 2.7, direct API access to platform components (Controller, Hub, EDA) is being removed. All authentication is centralized through the AAP Gateway. The component-level admin user was previously needed for installer post-install tasks (license upload, postinstall config), but those have since been updated to use gateway credentials. There is no remaining post-creation caller for the controller admin user in the installer or operator.
Relates-to: AAP-68980
🤖 Generated with Claude Code