# Need to deploy custom file to worker nodes **URL:** \ **Category:** AWX Project\ **Tags:** windows, awx, ee\ **Created:** [January 23, 2023, 8:11pm UTC](https://forum.ansible.com/t/need-to-deploy-custom-file-to-worker-nodes/37575 "2023-01-23T20:11:19Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Kevin\_Knox](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kevin_knox/32/3926_2.png) [@Kevin\_Knox](https://forum.ansible.com/u/Kevin_Knox)\ **Post date:** [January 23, 2023, 8:11pm UTC](https://forum.ansible.com/t/need-to-deploy-custom-file-to-worker-nodes/37575/1 "2023-01-23T20:11:19Z")
I need a custom /etc/krb5.conf on my AWX worker nodes so they can log into Windows boxes in my company. I could do this with other files by copying the file to localhost as an initial task. I cannot do this with krb5.conf, because it’s owned by root. Stymied. I assume my only path forward is to create a custom EE image with my file baked in. The admin I’m replacing could do this, but he left without documentation. Is there a guide somewhere on how to do this? Thank you. ---
**Author:** ![Kevin\_Knox](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kevin_knox/32/3926_2.png) [@Kevin\_Knox](https://forum.ansible.com/u/Kevin_Knox)\ **Post date:** [January 23, 2023, 9:00pm UTC](https://forum.ansible.com/t/need-to-deploy-custom-file-to-worker-nodes/37575/2 "2023-01-23T21:00:45Z")
I have a configmap with the contents of the krb5.conf I need, and that file is a part of the web, task, and ee running nodes. But it is not a part of the ephemeral worker nodes. I don’t know the process of modifying the worker nodes. ---
**Author:** ![Diego\_Rivera](https://avatars.discourse-cdn.com/v4/letter/d/ecd19e/32.png) [@Diego\_Rivera](https://forum.ansible.com/u/Diego_Rivera)\ **Post date:** [January 23, 2023, 9:26pm UTC](https://forum.ansible.com/t/need-to-deploy-custom-file-to-worker-nodes/37575/3 "2023-01-23T21:26:53Z")
As far as I know, you can only do this by referencing PVCs that can be bound to the containers using the extra\_volumes, web\_extra\_volume\_mounts, task\_extra\_volume\_mounts, and ee\_extra\_volume\_mounts directives, likes so: extra\_volumes: | - name: ssh-config persistentVolumeClaim: # This volume claim (and its matching volume) must be created manually claimName: ssh-config - name: static-data persistentVolumeClaim: # This volume claim (and its matching volume) must be created manually claimName: arkcase-static-data web\_extra\_volume\_mounts: | - name: ssh-config mountPath: /etc/ssh/ssh\_config.d - name: static-data mountPath: /var/lib/projects task\_extra\_volume\_mounts: | - name: ssh-config mountPath: /etc/ssh/ssh\_config.d ee\_extra\_volume\_mounts: | - name: ssh-config mountPath: /etc/ssh/ssh\_config.d This is what I ended up doing to distribute specific SSH configurations that were required (not keys, but rather configurations the ssh client should apply when attempting connections). I did look at the source code while researching this and I didn’t see a clean way to do more “arbitrary” volume mounts here. The issue stems from the schema for the AWXS definition file restricting the kinds of “magic” one can do with it. I have no doubt something like what you suggest could be supported, but it would definitely require quite a few changes in several places. Cheers! ---
**Author:** ![Kevin\_Knox](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kevin_knox/32/3926_2.png) [@Kevin\_Knox](https://forum.ansible.com/u/Kevin_Knox)\ **Post date:** [January 23, 2023, 9:38pm UTC](https://forum.ansible.com/t/need-to-deploy-custom-file-to-worker-nodes/37575/4 "2023-01-23T21:38:30Z")
Thank you! I have done this for the web, task, and ee nodes, but I don’t know how to do it for the worker nodes. web\_extra\_volume\_mounts: | - name: krb5 mountPath: /etc/krb5.conf subPath: krb5.conf task\_extra\_volume\_mounts: | - name: krb5 mountPath: /etc/krb5.conf subPath: krb5.conf ee\_extra\_volume\_mounts: | - name: krb5 mountPath: /etc/krb5.conf subPath: krb5.conf extra\_volumes: | - name: krb5 configMap: defaultMode: 420 items: - key: krb5.conf path: krb5.conf name: aep-krb5-conf-cm ---
**Author:** ![kurokobo1](https://avatars.discourse-cdn.com/v4/letter/k/f0a364/32.png) [@kurokobo1](https://forum.ansible.com/u/kurokobo1)\ **Post date:** [January 24, 2023, 12:32am UTC](https://forum.ansible.com/t/need-to-deploy-custom-file-to-worker-nodes/37575/5 "2023-01-24T00:32:21Z")
Hi, Have you tried to use Container Group? Here is my unofficial guide to use kerberos auth on the ephemeral automation job pod: [https://github.com/kurokobo/awx-on-k3s/blob/main/tips/use-kerberos.md](https://github.com/kurokobo/awx-on-k3s/blob/main/tips/use-kerberos.md) Regards, ---
**Author:** ![Diego\_Rivera](https://avatars.discourse-cdn.com/v4/letter/d/ecd19e/32.png) [@Diego\_Rivera](https://forum.ansible.com/u/Diego_Rivera)\ **Post date:** [January 24, 2023, 5:58pm UTC](https://forum.ansible.com/t/need-to-deploy-custom-file-to-worker-nodes/37575/6 "2023-01-24T17:58:29Z")
Yeah this is actually a good approach - a custom pod spec. It’s a shame there’s no simpler way to implement this b/c having to specify an entire pod for the automation group carries its own risks of misconfigurations (due to ignorance, mostly) leading the workers astray. But yes - this approach of customizing the pod for the group should definitely work. Cheers! ---
**Author:** ![Diego\_Rivera](https://avatars.discourse-cdn.com/v4/letter/d/ecd19e/32.png) [@Diego\_Rivera](https://forum.ansible.com/u/Diego_Rivera)\ **Post date:** [January 24, 2023, 6:38pm UTC](https://forum.ansible.com/t/need-to-deploy-custom-file-to-worker-nodes/37575/7 "2023-01-24T18:38:41Z")
Let me clarify: the risk of mucking up the pod spec is high, is what I meant 😃 ---
**Author:** ![Kevin\_Knox](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kevin_knox/32/3926_2.png) [@Kevin\_Knox](https://forum.ansible.com/u/Kevin_Knox)\ **Post date:** [January 24, 2023, 7:01pm UTC](https://forum.ansible.com/t/need-to-deploy-custom-file-to-worker-nodes/37575/8 "2023-01-24T19:01:57Z")
Thank you, @kurokobo! This looks like exactly what I need. I did a quick, naive implementation from your outline with my namespace and the pod in the worker node failed with: {“status”: “error”, “job\_explanation”: “Failed to JSON parse a line from transmit stream.”} {“eof”: true} I’ve been in meeting after meeting all day, and I have a couple more in front of me, so I doubt I’ll be able to push at this for a day or so, but it sure looks like exactly what I need. Thank you! I’ll dig in soonest. And thank you, Diego, for the confirmation. Kevin