Wiz is flagging Quay because it’s built on RHEL 8.9, which went EOL on 2024-05-31 (closest supported is 8.10). This is the awx-manager controller-manager pod.
How we deploy: EKS, Helmfile-managed, using the community awx-operator-helm chart (currently 3.2.0, planning to move to 3.2.1). appVersion is pinned to 2.19.1 on both chart versions, and upstream
ansible/awx-operator hasn’t tagged a release since 2024-07-02 — so there’s no newer image to pull.
A couple of questions:
Is a rebuild on UBI 8.10 / 9 planned? Even a no-code-change 2.19.2 retag would unblock compliance-gated deployments.
If not, what’s the recommended path — rebuild locally from the upstream Dockerfile, or move to Red Hat’s supported AAP Operator?
Is the community AWX Operator still actively maintained, or should orgs with compliance requirements plan a migration?
Happy to file a GitHub issue on ansible/awx-operator if that’s the better channel.
In short, AWX is being refactored, but the progress and state is pretty much unknown within the community. If you look at the GitHub page of Ansible AWX and the AWX operator, you see (a lot of) activity. So, both are currently being worked on, but it remains unknown when a new release will be done. Both projects did their last release on the 2nd of July, 2024. If a migration should be planned is up to the organization, of course. Though, IMHO, if compliance is a hard requirement, I’d highly consider looking for a paid solution, to have support covered. Ansible AWX remains a FOSS that can hang up their gloves any second they want.
TLDR;
Yes, it’s actively maintained, however due to a project refactoring, no new releases have been done since the 2nd of July 2024, and there is no end-date known regarding the refactoring.