The CyberLab uses AWX (upstream Ansible Automation Platform) to seed labs, verify student work, reset pods, advance students through the curriculum, and issue completion certificates. All six CMMC Level 1 families (AC, IA, SI, SC, MP, PE) are automated end to end.
| Guide | Description |
|---|---|
| AWX Lab Seeding Guide | Step-by-step guide for seeding, verifying, and resetting labs |
| Lab Families | What each family covers and how many labs it has |
| Training Tracker | How verify results reach the student dashboard |
| Property | Value |
|---|---|
| VM ID | 103 |
| Hostname | crc-awx-k8s-01 |
| IP | 192.168.1.103 |
| Platform | K3s (Kubernetes) |
| Version | AWX 24.6.1 |
| Web UI | http://192.168.1.103:30080 |
| API | http://192.168.1.103:30080/api/v2 |
| Host | PVE1 |
| Property | Value |
|---|---|
| Repository | https://github.com/tcecure/crc-awx-labops |
| Branch | main |
| AWX project used by all lab templates | crc-awx-labops (project ID 10) |
| Update revision on launch | Disabled on project 10 |
| Second project | CRC-LabOps (ID 8) — same repo, update-on-launch enabled, not used by the lab templates |
| Last synced revision | 8e62ba2 (Aug 2026) — includes the anti-lockout baseline and the SC M4-L1 log evidence; crc-awx-labops PR #39 (SC M3-L1/M3-L3 grading) is not in it |
Important: because project 10 does not update on launch, merging a fix to
maindoes not change what AWX runs. After merging, open Projects → crc-awx-labops → Sync (orPOST /api/v2/projects/10/update/) before launching the affected template.
| Inventory | Hosts | Contents |
|---|---|---|
CRC-LabPods |
62 | See the groups below |
CRC-Proxmox |
1 | PVE1 for VM-level operations |
| Group | Hosts | Contents |
|---|---|---|
crc_pod_servers |
20 | pod01-srv … pod20-srv (10.50.XX.20) — the student session hosts, and the target for member-server seed/verify/reset |
crc_pod_gateways |
20 | pod01-gw … pod20-gw (10.51.XX.1), pfSense over SSH |
crc_shared_dcs |
2 | dc01 (10.50.1.10), dc02 (10.50.1.11) — the legacy session-host path, kept for rollback |
crc_workstations |
10 | Unused placeholders |
Windows hosts are reached over WinRM; pfSense pod gateways over SSH.
| Family | Labs | Seed | Verify | Reset |
|---|---|---|---|---|
| Access Control (AC) | 12 | 12 Seed CMMC AC Labs | 13 Verify CMMC AC Labs | 14 Reset AC Labs (AD-Level) |
| Identification & Auth (IA) | 12 | 15 Seed CMMC IA Labs | 16 CRC Auto-Verify IA Labs | 17 Reset IA Labs (AD-Level) |
| System & Info Integrity (SI) | 12 | 18 Seed CMMC SI Labs | 19 Verify CMMC SI Labs | 20 Reset SI Labs (AD-Level) |
| System & Comms Protection (SC) | 12 | 21 Seed CMMC SC Labs | 22 Verify CMMC SC Labs | 23 Reset SC Labs (AD-Level) |
| Media Protection (MP) | 3 | 27 Seed - MP Family | 28 Verify - MP Family | 29 Reset - MP Family |
| Physical Protection (PE) | 6 | 30 Seed - PE Family | 31 Verify - PE Family | 32 Reset - PE Family |
PODXX-SRV)Templates 12–32 above run host-local work on crc_shared_dcs and remain the
rollback path. The templates below do the same work on crc_pod_servers, one
evidence tree per student server:
| Family | Seed | Verify | Reset |
|---|---|---|---|
| Access Control (AC) | 59 | 58 | 60 |
| Identification & Auth (IA) | 62 | 61 | 63 |
| System & Info Integrity (SI) | 53 | 54 | 55 |
| Media Protection (MP) | 64 | 65 | 66 |
| Physical Protection (PE) | 67 | 68 | 69 |
SC is unchanged — templates 21/22/23 target each pod's pfSense gateway over SSH,
not a Windows host.
Seed and reset templates accept pod_id; a verify template looping over every pod
must be launched without pod_id. Pass crc_publish_tracker: false for a
rehearsal that must not write tracker records — that is how all five families were
verified fleet-wide during the migration.
| ID | Template | Purpose |
|---|---|---|
| 43 | Setup Domain Join Account | Least-privilege account used for the offline domain join |
| 44 | Provision Pod Member Server | Clone, first-boot injection, static IP, rename, WinRM, domain join |
| 46 | Setup Pod Management Account | Host management account used by AWX over WinRM |
| 47 | Patch Pod Member Server | Windows Update over the temporary maintenance NIC |
| 48 | Harden Pod Member Server | Local admin/RDU scoping, RDP+NLA, cached-credential and artifact removal |
| 49–51 | Setup Pod Server LAPS (AD / Clients) | Managed local administrator passwords |
| 52 | License Pod Member Server | slmgr /ipk + /ato per host |
| 56 | Setup Pod Evidence Drop | Creates C:\CyberLab\PodXX with the student's Modify rights |
| 57 | Sync Pod Evidence (Session Host) | Copies evidence between the legacy DC tree and the member server |
| 70 | Reset Student Identities | Between-cohort AD and Guacamole password rotation |
| ID | Template | Purpose |
|---|---|---|
| 24 | Auto-Advance Families | Marks a completed family and unlocks/seeds the next one in AC → IA → SI → SC → MP → PE |
| 36 | Generate Completion Certificate | Issues a certificate for a completed family |
| 37 | Setup Certificate System | One-time certificate infrastructure setup |
| 9 | Reset to Baseline (AD-Level) | Full rollback of pod AD state |
| 11 | CRC Auto-Verify (All Labs) | Legacy AC-only verify template — prefer 13 |
| ID | Schedule | Frequency | Enabled |
|---|---|---|---|
| 8 | CRC Auto-Verify AC (30m) | every 30 min | Yes |
| 9 | CRC Auto-Verify IA (30m) | every 30 min | Yes |
| 10 | CRC Auto-Verify SI (30m) | every 30 min | Yes |
| 11 | CRC Auto-Verify SC (30m) | every 30 min | Yes |
| 12 | CRC Auto-Verify MP (30m) | every 30 min | Yes |
| 13 | CRC Auto-Verify PE (30m) | every 30 min | Yes |
| 7 | Auto-Advance every 30m | every 30 min | Yes |
Verification therefore runs continuously — instructors do not have to launch verify jobs for students to see progress. Launch them manually only when you need an immediate refresh.
Open item: schedules 8–13 still point at the shared-DC verify templates
(13, 16, 19, 22, 28, 31). They are repointed at the member-server verify
templates (58, 61, 54, 22, 65, 68) as part of the student cutover, so that
tracker records are graded from each student's own server.
Seed jobs place each pod in a known FAIL state and write the evidence artifacts students work with (C:\CyberLab\PodXX\<FAMILY>-Artifacts\) — on PODXX-SRV for the member-server templates, on DC01 for the legacy ones. Cohort 1's evidence is archived on DC01 at C:\CohortArchive\COHORT1-20260902 and the member-server evidence trees start empty.
Do not re-run AC, IA, SI or SC seed templates while a class is in progress — they overwrite student work. Use the reset templates instead.
Run MP seeding as its own job per host: it attaches VHDX media and drive-letter assignment is machine-global.
A blank
podssurvey answer means "all pods"; supplypods=1,2,3(orpod_id) to target specific pods.
Students work in Guacamole against the shared domain and their own pfSense gateway.
Verify jobs check each objective and emit per-pod, per-lab PASS/FAIL artifacts, which the Training Tracker reads through the AWX API.
Auto-Advance Families (template 24) checks the latest verify results; when a family is fully passed it records completion, unlocks the next family and triggers certificate generation. Controlled by advance_enabled and certificates_enabled.
Reset templates return AD objects, artifacts and pfSense configuration to the seeded state — for a retry or the next cohort.
| Credential | Type | Purpose |
|---|---|---|
| CRC WinRM Verifier | Machine (Administrator) |
WinRM to the domain controllers |
| crc-awx-to-pve1 | Machine (crc-awx) |
SSH to PVE1 |
| CRC pfSense SSH | Machine (admin) |
SSH to the per-pod pfSense gateways |
| CRC AWX API Token | Token | AWX API access for the tracker/MCP backend |
| DRCC Portal Progress API | Token | Publishing verifier progress to the portal |