212

Ansible casually administering hundreds or thousands of devices (lemmy.zip)

submitted 6 months ago by possiblylinux127@lemmy.zip to c/linuxmemes@lemmy.world

53 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[-] CosmicTurtle@lemmy.world 3 points 6 months ago

Yup. I used ansible for a good year, maybe two, and found myself asking, "Why the fuck am I maintaining some abstract thing when I can just write a shell script and deploy that?"

Cloud orchestration is better done with other tooling. Honestly don't see a use case for ansible beyond physical data center deployments.

[-] timbuck2themoon@sh.itjust.works 11 points 6 months ago* (last edited 6 months ago)

There is a reason ansible exists and is widely used. Shell scripts are brittle and don't account for a ton of use cases.

For instance- are you going to write a shell script to determine the OS family of a server? Are you then going to do a bunch of if statements for things you want run on Debian hosts vs RedHat ones vs. Alpine? Are you going to manually make templates yourself or just use jinja templates and the template module in ansible (and use variables easily gathered by the setup module)? Are you going to manually select which hosts you're going to target or are you just going to use your ansible inventory that categorizes your machines based on location or purpose or whatever other arbitrary thing and use tags? Are you going to manually dig in and find out how many NICs are in a box, what IPs they have, what CPU, how many cores so you can set some service to use "X" amount of threads, define service templates using those machine variables, etc. etc. etc.? Are you going to make such well defined shell scripts that they can be reused over and over again against a variety of machines without breaking things and make it easy to include them in parent shell scripts?

This is all stuff ansible does quite easily.

It's not the end all be all of course. Some would argue (maybe rightfully) that Puppet or Salt can maintain config drift a bit better. I would argue it's not the tool to use for containerization really either. But it definitely has a real purpose in initial and maintained configuration management and in both cloud and on-prem deployments.

[-] azvasKvklenko@sh.itjust.works 3 points 6 months ago

Building custom images for cloud can be one. Builtins have a lot of ready to use logic that you might want in your scripts anyway

[-] darganon@lemmy.world 2 points 6 months ago

They installed it for us at work as part of a project, and we went to ask the ansible guy wtf we could use it for in a windows world, and he couldn't articulate how it would be an improvement in any way over a scheduled task.

[-] taladar@sh.itjust.works 6 points 6 months ago

To be fair it is not Ansible's fault that Windows does pretty much everything differently from the systems Ansible was designed for.

[-] darganon@lemmy.world 2 points 6 months ago

Agreed entirely.

[-] moonpiedumplings@programming.dev 4 points 6 months ago* (last edited 6 months ago)

It appeals to me for management of a windows machine for a few things:

Lots of machines at once, over winrm. Although ssh is the default, as ansible is linux first.
I don't have to learn powershell - the shared language means the windows teams and the linux team don't have to learn eachother's language. In ansible, it's very easy to avoid the footguns that come with something like bash, especially after you install the red hat linter, ansible-lint, which warns of ansible's own footguns.
easy to version control it
premade stuff: the official "modules" are massive and do a lot. There are also community packages: https://galaxy.ansible.com - of course, you should probably check any stuff you run first. But ansible is very easy to read.
built in secret management. Encrypt secrets, but still be able to use them smoothly with the automation framework.

For just one machine? Task scheduler is probably good enough. 2-3 machines, managed remotely? Ansible is at least worth looking at.

Edit: also, really good docs. Like, check out this active directory module with examples: https://docs.ansible.com/ansible/latest/collections/microsoft/ad/object_info_module.html#ansible-collections-microsoft-ad-object-info-module

The examples are very helpful, with things like getting a list of ad users. I used that to create a ansible script to shuffle all ad user passwords - while being a a linux lover who hates windows and has literally never touched ad before this.

https://github.com/CSUN-CCDC/CCDC-2023/blob/main/windows/ansible/testing/users.yml

https://github.com/CSUN-CCDC/CCDC-2023/blob/main/windows/ansible/roles/domain/tasks/main.yml