Ansible Jewel — Centralized Auth Proxy for AWX Services

Introduction

Ansible Jewel is a centralized authentication, authorization, and proxy layer announced as part of the AWX modernization effort. It intercepts user requests, authenticates them, and routes traffic to the appropriate Ansible service — replacing the monolithic AWX architecture with a pluggable, microservices-friendly design.

This article covers what Jewel is, why it matters, and how it fits into the future of AWX.

What Is Ansible Jewel?

Jewel sits between users and Ansible services as a reverse proxy with built-in auth:

┌──────────┐     ┌──────────────┐     ┌──────────────────┐
│  Users   │────▶│  Jewel       │────▶│  AWX             │
│  (API/UI)│     │  (Auth+Proxy)│     │  (Job Scheduler) │
└──────────┘     │              │────▶│  Other Services   │
                 └──────────────┘     └──────────────────┘

Key responsibilities:

• Authentication — verifies user identity (SSO, tokens, OAuth)
• Authorization — checks permissions before forwarding requests
• Routing — directs traffic to the correct backend service
• Service discovery — connects pluggable Ansible services

Why Jewel Exists

The AWX modernization effort is decomposing AWX from a single Django application into smaller, focused services:

Architecture

                    ┌─────────────────────────────────────┐
                    │            Ansible Jewel             │
                    │                                     │
                    │  ┌─────────┐  ┌───────────────┐    │
    HTTP Request ──▶│  │  Auth    │  │  Route Rules  │    │
                    │  │  Module  │  │  & Policies   │    │
                    │  └────┬────┘  └───────┬───────┘    │
                    │       │               │             │
                    └───────┼───────────────┼─────────────┘
                            │               │
                   ┌────────▼──┐   ┌────────▼──────┐
                   │   AWX     │   │  Future       │
                   │  (Jobs)   │   │  Services     │
                   └───────────┘   └───────────────┘

Getting Started

The Jewel source code is available on GitHub under the ansible organization:

# Clone the Jewel repository
git clone https://github.com/ansible/jewel.git
cd jewel

# Follow the quickstart guide in the repository
# (Check README.md for current setup instructions)

What This Means for AWX Users

Short Term

• AWX continues to work as-is
• Jewel is an additional layer, not a replacement
• No immediate migration required

Medium Term

• New Ansible services will connect through Jewel
• AWX UI may start routing through Jewel
• Authentication can be centralized (SSO, LDAP, SAML in one place)

Long Term

• AWX becomes one of many pluggable services
• Jewel becomes the single entry point for all Ansible automation services
• Easier to add custom services to your automation platform

Jewel vs AAP Gateway

For Red Hat Ansible Automation Platform (AAP) users:

Jewel serves a similar architectural role in the community project as the Platform Gateway does in AAP — centralizing authentication and service routing.

Integration with Existing Ansible Playbooks

Jewel doesn't change how playbooks work. It affects how you access AWX:

# Before: Direct AWX API access
- name: Launch AWX job template
  ansible.controller.job_launch:
    controller_host: "https://awx.example.com"
    controller_username: admin
    controller_password: "{{ vault_awx_pass }}"
    name: "Deploy Web App"

# After: API requests route through Jewel
# (Same playbook, potentially different endpoint)
- name: Launch AWX job template
  ansible.controller.job_launch:
    controller_host: "https://jewel.example.com"  # Jewel proxy
    controller_oauthtoken: "{{ vault_oauth_token }}"
    name: "Deploy Web App"

Related AWX Modernization

Jewel is part of a broader AWX modernization effort:

1. Jewel — Auth and proxy layer (announced May 2026)
2. Service decomposition — Breaking AWX into smaller services
3. Pluggable architecture — Third-party services can integrate
4. Improved scalability — Services scale independently

Community Involvement

The Jewel project welcomes community contributions:

• Source code: github.com/ansible/jewel
• Discussion: Ansible Community Forum (AWX category)
• Chat: #awx on Matrix/Libera.Chat

Conclusion

Ansible Jewel represents a significant architectural shift in the AWX ecosystem — from a monolithic application to a service-oriented platform with centralized authentication. While it doesn't require immediate action from AWX users, understanding Jewel now prepares you for the future of community Ansible automation platforms. Watch the GitHub repository and forum discussions for updates as the project matures.