The CyberLab uses AWX (upstream Ansible Automation Platform) to seed labs, verify student work, reset pods, advance students through the curriculum, and issue completion certificates. All six CMMC Level 1 families (AC, IA, SI, SC, MP, PE) are automated end to end.
| Guide | Description |
|---|---|
| AWX Lab Seeding Guide | Step-by-step guide for seeding, verifying, and resetting labs |
| Lab Families | What each family covers and how many labs it has |
| Training Tracker | How verify results reach the student dashboard |
| Property | Value |
|---|---|
| VM ID | 103 |
| Hostname | crc-awx-k8s-01 |
| IP | 192.168.1.103 |
| Platform | K3s (Kubernetes) |
| Version | AWX 24.6.1 |
| Web UI | http://192.168.1.103:30080 |
| API | http://192.168.1.103:30080/api/v2 |
| Host | PVE1 |
| Property | Value |
|---|---|
| Repository | https://github.com/tcecure/crc-awx-labops |
| Branch | main |
| AWX project used by all lab templates | crc-awx-labops (project ID 10) |
| Update revision on launch | Disabled on project 10 |
| Second project | CRC-LabOps (ID 8) — same repo, update-on-launch enabled, not used by the lab templates |
| Last synced revision | 8e62ba2 (Aug 2026) — includes the anti-lockout baseline and the SC M4-L1 log evidence; crc-awx-labops PR #39 (SC M3-L1/M3-L3 grading) is not in it |
Important: because project 10 does not update on launch, merging a fix to
maindoes not change what AWX runs. After merging, open Projects → crc-awx-labops → Sync (orPOST /api/v2/projects/10/update/) before launching the affected template.
| Inventory | Hosts | Contents |
|---|---|---|
CRC-LabPods |
62 | See the groups below |
CRC-Proxmox |
1 | PVE1 for VM-level operations |
| Group | Hosts | Contents |
|---|---|---|
crc_pod_servers |
20 | pod01-srv … pod20-srv (10.50.XX.20) — the student session hosts, and the target for member-server seed/verify/reset |
crc_pod_gateways |
20 | pod01-gw … pod20-gw (10.51.XX.1), pfSense over SSH |
crc_shared_dcs |
2 | dc01 (10.50.1.10), dc02 (10.50.1.11) — the legacy session-host path, kept for rollback |
crc_workstations |
10 | Unused placeholders |
Windows hosts are reached over WinRM; pfSense pod gateways over SSH.
| Family | Labs | Seed | Verify | Reset |
|---|---|---|---|---|
| Access Control (AC) | 12 | 12 Seed CMMC AC Labs | 13 Verify CMMC AC Labs | 14 Reset AC Labs (AD-Level) |
| Identification & Auth (IA) | 12 | 15 Seed CMMC IA Labs | 16 CRC Auto-Verify IA Labs | 17 Reset IA Labs (AD-Level) |
| System & Info Integrity (SI) | 12 | 18 Seed CMMC SI Labs | 19 Verify CMMC SI Labs | 20 Reset SI Labs (AD-Level) |
| System & Comms Protection (SC) | 12 | 21 Seed CMMC SC Labs | 22 Verify CMMC SC Labs | 23 Reset SC Labs (AD-Level) |
| Media Protection (MP) | 3 | 27 Seed - MP Family | 28 Verify - MP Family | 29 Reset - MP Family |
| Physical Protection (PE) | 6 | 30 Seed - PE Family | 31 Verify - PE Family | 32 Reset - PE Family |
PODXX-SRV)Templates 12–32 above run host-local work on crc_shared_dcs and remain the
rollback path. The templates below do the same work on crc_pod_servers, one
evidence tree per student server:
| Family | Seed | Verify | Reset |
|---|---|---|---|
| Access Control (AC) | 59 | 58 | 60 |
| Identification & Auth (IA) | 62 | 61 | 63 |
| System & Info Integrity (SI) | 53 | 54 | 55 |
| Media Protection (MP) | 64 | 65 | 66 |
| Physical Protection (PE) | 67 | 68 | 69 |
SC is unchanged — templates 21/22/23 target each pod's pfSense gateway over SSH,
not a Windows host.
Seed and reset templates accept pod_id; a verify template looping over every pod
must be launched without pod_id. Pass crc_publish_tracker: false for a
rehearsal that must not write tracker records — that is how all five families were
verified fleet-wide during the migration.
| ID | Template | Purpose |
|---|---|---|
| 43 | Setup Domain Join Account | Least-privilege account used for the offline domain join |
| 44 | Provision Pod Member Server | Clone, first-boot injection, static IP, rename, WinRM, domain join |
| 46 | Setup Pod Management Account | Host management account used by AWX over WinRM |
| 47 | Patch Pod Member Server | Windows Update over the temporary maintenance NIC |
| 48 | Harden Pod Member Server | Local admin/RDU scoping, RDP+NLA, cached-credential and artifact removal |
| 49–51 | Setup Pod Server LAPS (AD / Clients) | Managed local administrator passwords |
| 52 | License Pod Member Server | slmgr /ipk + /ato per host |
| 56 | Setup Pod Evidence Drop | Creates C:\CyberLab\PodXX with the student's Modify rights |
| 57 | Sync Pod Evidence (Session Host) | Copies evidence between the legacy DC tree and the member server |
| 70 | Reset Student Identities | Between-cohort AD and Guacamole password rotation |
| ID | Template | Purpose |
|---|---|---|
| 24 | Auto-Advance Families | Marks a completed family and unlocks/seeds the next one in AC → IA → SI → SC → MP → PE |
| 36 | Generate Completion Certificate | Issues a certificate for a completed family |
| 37 | Setup Certificate System | One-time certificate infrastructure setup |
| 9 | Reset to Baseline (AD-Level) | Full rollback of pod AD state |
| 11 | CRC Auto-Verify (All Labs) | Legacy AC-only verify template — prefer 13 |
| ID | Schedule | Frequency | Enabled |
|---|---|---|---|
| 8 | CRC Auto-Verify AC (30m) | every 30 min | Yes |
| 9 | CRC Auto-Verify IA (30m) | every 30 min | Yes |
| 10 | CRC Auto-Verify SI (30m) | every 30 min | Yes |
| 11 | CRC Auto-Verify SC (30m) | every 30 min | Yes |
| 12 | CRC Auto-Verify MP (30m) | every 30 min | Yes |
| 13 | CRC Auto-Verify PE (30m) | every 30 min | Yes |
| 7 | Auto-Advance every 30m | every 30 min | Yes |
Verification therefore runs continuously — instructors do not have to launch verify jobs for students to see progress. Launch them manually only when you need an immediate refresh.
Open item: schedules 8–13 still point at the shared-DC verify templates
(13, 16, 19, 22, 28, 31). They are repointed at the member-server verify
templates (58, 61, 54, 22, 65, 68) as part of the student cutover, so that
tracker records for Cohort 2 are graded from each student's own server.
Seed jobs place each pod in a known FAIL state and write the evidence artifacts students work with (C:\CyberLab\PodXX\<FAMILY>-Artifacts\) — on PODXX-SRV for the member-server templates, on DC01 for the legacy ones. Cohort 1's evidence is archived on DC01 at C:\CohortArchive\COHORT1-20260902 and the member-server evidence trees start empty.
Do not re-run AC, IA, SI or SC seed templates while a class is in progress — they overwrite student work. Use the reset templates instead.
Run MP seeding as its own job per host: it attaches VHDX media and drive-letter assignment is machine-global.
A blank
podssurvey answer means "all pods"; supplypods=1,2,3(orpod_id) to target specific pods.
Students work in Guacamole against the shared domain and their own pfSense gateway.
Verify jobs check each objective and emit per-pod, per-lab PASS/FAIL artifacts, which the Training Tracker reads through the AWX API.
Auto-Advance Families (template 24) checks the latest verify results; when a family is fully passed it records completion, unlocks the next family and triggers certificate generation. Controlled by advance_enabled and certificates_enabled.
Reset templates return AD objects, artifacts and pfSense configuration to the seeded state — for a retry or the next cohort.
| Credential | Type | Purpose |
|---|---|---|
| CRC WinRM Verifier | Machine (Administrator) |
WinRM to the domain controllers |
| crc-awx-to-pve1 | Machine (crc-awx) |
SSH to PVE1 |
| CRC pfSense SSH | Machine (admin) |
SSH to the per-pod pfSense gateways |
| CRC AWX API Token | Token | AWX API access for the tracker/MCP backend |
| DRCC Portal Progress API | Token | Publishing verifier progress to the portal |