11 ms·

Ansible open-sources Ansible Tower with AWX

276 points by sciurus 9y ago

jlgaddis 9y ago
I'm curious to know how usage of AWX affects your ability to maintain everything (inventory, roles, playbooks, etc.) in version control. I'm guessing AWX wants to be the central "source of truth" for all of that stuff instead of just keeping it all in a single git repo.
- muxator 9y ago
  I have the same doubt. Does anyone have more information?
- atgreen 9y ago
  You hook AWX up to git or similar. It will pull playbooks, etc, from git before execution. I was a Tower sceptic at first, but it's actually really great. (edit: disclaimer .. I am a Red Hat employee!)
  - jlgaddis 9y ago
    Oh sweet, that's the best that I could have hoped for. Thanks!
- MrOwen 9y ago
  In Tower 3.2 (just released about a week ago), there is now the ability to specify inventory from source instead of having to define it using either the UI or API. See http://docs.ansible.com/ansible-tower/latest/html/userguide/inventories.html#add-source http://docs.ansible.com/ansible-tower/latest/html/userguide/... for more information on this. Hope this helps!
richardfontana 9y ago
"To be clear though, Ansible Tower itself will still be a licensed product offering from Red Hat, but the code that builds Ansible Tower releases is open sourced, and is available in the AWX Project." This is strictly speaking correct but I think the author is implying that AWX code will get proprietized in Ansible Tower, which is not correct. Normally, Red Hat does not alter upstream open source licenses in its product offerings.
- crymer11 9y ago
  As of today, there is at least one difference between AWX and Tower. One supports high availability (Tower) and the other does not (AWX).
alexnewman 9y ago
I am not sure, have they open sourced something i can even use
- sud0er 9y ago
  https://github.com/ansible/awx https://github.com/ansible/awx
  - alexnewman 9y ago
    Right but it's not clear how to deploy this
    - geerlingguy 9y ago
      I updated the original article linked from this post with a two-line instruction for running it from my Docker Hub images: curl -O https://raw.githubusercontent.com/geerlingguy/awx-container/master/docker-compose.yml docker-compose up -d
    - citruspi 9y ago
      The second sentence on that repository's readme is > To install AWX, please view the Install guide. which links to an installation guide[0] with information on setting it up with OpenShift or Docker. I'm not sure what part isn't clear. [0]: https://github.com/ansible/awx/blob/devel/INSTALL.md https://github.com/ansible/awx/blob/devel/INSTALL.md
Androider 9y ago
Maybe someone will finally offer a managed Ansible Tower service. I'm always surprised that Red Hat hasn't to date. Between managed git and CI with deployment to AWS, I have no desire to babysit, backup and patch a snowflake Tower instance.
- perlgeek 9y ago
  Red Hat mostly caters to large businesses, many of which still want most of their stuff on premise. Putting just the Ansible things in the cloud would be an undue security risk (if your mindset is that on-prem is more secure). And if you do use a cloud provider, you likely want to run Ansible in the same cloud, just for performance reasons.
- ghjm 9y ago
  Out of curiosity, would you be concerned with giving a managed service vendor all the passwords to everything in your infrastructure?
  - rmenr 9y ago
    Yes. I would. Which is why I love the idea of having AWX to run within my own infra, in the way that I'd want to run it. Arrogant as it may sound, I'd much prefer to take ownership of that, personally. I'd be happy to self-host it and take the operational pains that come with it, and sleep (at least slightly more happily at night) knowing that I'm managing my secrets myself.
lima 9y ago
If you're considering using this (or any similar) tool, please keep in mind that you're adding a lot of attack surface. Your Ansible master is one of the most critical (if not the most critical) machine in your network. It has unrestricted access to everything, including a very detailed list of what and where everything is. If it's compromised, it's over. Something like Ansible Tower adds a LOT of attack surface. Instead of a locked-down server exposing a public key-only SSH port, you suddenly have a whole web application stack in there. Your browser and every Chrome extension with full page access now has root access to your network (and don't get me started on potential CSRF or XSS vulnerabilities...). If you don't need any of the enterprise-ey features, just might be better off with plain Ansible and Ara[1], with the latter running on a separate machine. A "sudoers" rule is much more secure than any ACL in a web application backend. If you do want to use Tower, you need to think about these risks and how you mitigate them. Of course, this also applies to any similar tool like Jenkins, Rundeck, CircleCI or whatever if you give them production credentials. [1]: https://ara.readthedocs.io/en/latest/ https://ara.readthedocs.io/en/latest/
- crymer11 9y ago
  > It has unrestricted access to everything It only has unrestricted access to what you give it unrestricted access to. If your ansible playbooks use a user that doesn't have root access and limited sudo powers, then it's not much different from using Ara.
  - mikepurvis 9y ago
    That's fair, but Ansible culture is to do everything as sudo, and traditionally it was pretty painful to execute only portions of a playbook as the sudo. Though it looks like that's gotten better in more recent times: http://docs.ansible.com/ansible/latest/become.html http://docs.ansible.com/ansible/latest/become.html
    - emmelaich 9y ago
      The big improvement was the ability to turn sudo off/on for a particular task. Not sure when that was introduced. 1.9.something?
crymer11 9y ago
The one thing we're really missing from AWX (the open source version of Tower) is the high availability support. I've seen some discussion in GitHub issues about that; hoping we see it supported soon!
rmetzler 9y ago
I'm sorry, I need a video showing me, what Ansible Tower actually does. I use Ansible in my day-to-day job (I'm a full stack dev learning how to do sysadmin stuff in scale). We use Ansible in a custom webapp to orchestrate bare metal clouds. We build and operate custom High Performance Computation Clusters and this is our SaaS offering. But the code relies heavily on cron and legacy perl code. I wanted to rewrite the code and use a queue for a long time, but never found enough time to actually do it. It works good enough and we have customers relying on it.
- jlgaddis 9y ago
  > I'm sorry, I need a video showing me, what Ansible Tower actually does. Click on the first link in this article, "Ansible Tower" and you'll be taken to a page [0] where (above the fold) there are two videos: a two-minute overview and a 10-minute demo. [0]: https://www.ansible.com/tower https://www.ansible.com/tower
jlgaddis 9y ago
Since Jeff's book is mentioned a few times, I'd suggest going for the (updateable) "e-book" if you're interested in purchasing it. I have the hardcopy version of it (and another Ansible book or two) and, with the rate of Ansible development, it got kinda out-of-date pretty quickly.
- corford 9y ago
  Second this. I bought the PDF ebook years ago and still get an email once in a while with an updated version. Best $20 something I've spent in a long time (thanks Jeff!).
  - geerlingguy 9y ago
    You're welcome! Working on a chapter on Ansible Container right now :)
linsomniac 9y ago
I was pretty excited about AWX, we had finally deployed a few things to provide some of the functionality (Rundeck and some custom runners, also tried but decided against StackStorm since it has no role based task limits in the non-enterprise version). I gave Jeff's (author of this piece) Ansible role a try and had an AWX system up and running quickly. He's making some really nice Ansible roles. But I had no luck with AWX. I think if you are using entirely platforms that are supported directly by AWX (OpenStack/AWS/Azure), you might be fine. We run 80% of our stack on Ganeti, and have a custom inventory script that AWX seems entirely unable to use. Even distiling that dynamic inventory down into a static inventory isn't working in my testing because it wants our Vault password to load the inventory, and the inventory task doesn't allow for associating vault credentials. Nor does it seem to provide the boto credentials needed by our dynamic inventory script, even though it has a spot for providing AWS credentials. I want to try it one more time to see if I can find a combination of static inventory that doesn't need the Vault. But at the moment, the Rundeck weirdness with our inventory is less than the AWX weirdness, so that is our solution. I'm sure I'm just not getting something about AWX, but I've spent a day with the docs and made no real progress. It's awesome to have available as an option. I wanted to get Tower but could never secure the funding for it, largely because it was a big unknown.
- chucky_z 9y ago
  I ended up throwing our AWS credentials right into the dynamic inventory script itself. It sounds janky but I mean... it worked. You _should_ be able to pass in a vault password as well, as part of any job? Are you doing something with vault in your inventory?
  - linsomniac 9y ago
    I'm not doing anything with the vault in the inventory that I know of. After thinking some more on it, I think the problem is that I put the static inventory in the directory that also has group_vars in it, and that has vault files in it, so Ansible is wanting the vault password. I'm going to try putting it somewhere else, but I have to start from scratch with the new instance.
- 9y ago
amq 9y ago
What is the role of Ansible in the world of Docker, Kubernetes and Swarm?
- zerkten 9y ago
  I was wondering the same thing and found this recent video on Ansible Containers (https://www.ansible.com/ansible-roles-as-containers https://www.ansible.com/ansible-roles-as-containers). The project overview is https://www.ansible.com/ansible-container https://www.ansible.com/ansible-container. It'd be interesting to hear from others with experience combining these.
  - alexnewman 9y ago
    ansible and containers do not mix well. Don't even bother. They take totally different approaches. Use ansible for what it is good for. Using it to automate all the things ... in container world... I mean why have docker-compose or k8s at all. Just launch containers willy nilly and instead of - self healing - automatic failover - Docker centric tools You can have a python s*it show where you use containers like processes. In fact they are processes that probably can't handle signals or pipes. Maybe use tini and that at least works, but it misses the point. Ansible and docker are fundamentally at odds. When ansible was created it had the promise of a simple layer of abstraction over ssh. now It just does all the things because it jelly. Don't give into the h8
    - mi100hael 9y ago
      Ansible works quite well for automating docker deployments. Something still has to execute the docker commands to spin up a container/swarm/cluster/whatever. Better to have those commands be idempotent and checked in to version control. http://docs.ansible.com/ansible/latest/docker_container_module.html http://docs.ansible.com/ansible/latest/docker_container_modu...
      - geerlingguy 9y ago
        And if you control networking, Ansible can manage that... and if you control local workstation management, Ansible can manage that... and if you need something to manage things like CloudFormation with automation... Ansible fits all the automation gaps that exist between all the different infrastructure tools.
timwaagh 9y ago
I worked on setting up ansible for running a setup playbook on our new virtualised dev environments complete with VirtualBox bugs. Ansible has been a bit of a pita for me to set up. Try pulling in a git repo with it. It fails and does not even tell you what is up. Helpful error messages anyone? Maybe this tower could help debug some issues. Although it is basically more added complexity. I don't really understand the advantage over running a normal script either, but it was not really my idea. Somehow my team thinks they should not listen when I say something sucks and listen to this rude kid who likes to talk fast, likes to interrupt and call themselves the best ever instead. I might not look cool and my ways are not the latest in cool tech, but I sure as f am experienced and know things. It will be the others problem soon enough I guess. Maybe the advantage is that you get to run it on all servers at the same time. Not that this is a big one when you have like two. Oh well. I guess I'm not quite done with this software until my team realizes maybe I'm not entirely bullshit when I say we should use simple scripts or go straight to docker. Maybe this tower thing can help debug the mess.
- corford 9y ago
  Strange, http://docs.ansible.com/ansible/latest/git_module.html http://docs.ansible.com/ansible/latest/git_module.html is pretty robust. If you haven't already, try running the playbook with -vvv to get extra debug info printed. You might be running in to a (possibly obscure) local or remote SSH permission issue. You can use ansible.verbose="vvvv" if you're calling the play via vagrant's ansilbe provisioner.
  - timwaagh 9y ago
    Of course I tried -vvv and -vvvv. That did not tell me anything for this issue. I also tried the option where you get a bunch of python scripts. That told me a lot more than I wanted to know. The obvious option of seeing which commands it has run and their in and output just does not seem to be in there.
    - corford 9y ago
      No idea then, sorry. The only time the git module has failed with me is due to me fucking up my SSH settings in a convoluted environment (SSH Agent on windows workstation -> ansible controller on vagrant ubuntu box -> remote AWS bastion -> repo host with a very restrictive sshd config). In that case, running ansible verbosely gave enough info to point me in the direction of fixing what was wrong with my ssh setup (can't remember now what it was).
adictator 9y ago
I wonder if this move forebodes the end of products (& companies) like Chef, Puppet & Salt. Why would one want to pay for their enterprise products if AWX is readily available for free?
RRRA 9y ago
It'd be nice if there was a way to have ansible-pull verify GPG signatures (like some puppet setup people use). That way, it doesn't matter as much if AWX gets compromised.
yo-code-sucks 9y ago
Fucking Jeff this shit happened like a month ago and now at the top of HN?
mattjaynes 9y ago
Quick links: - Github Project: https://github.com/ansible/awx https://github.com/ansible/awx - Project FAQ: https://www.ansible.com/awx-project-faq https://www.ansible.com/awx-project-faq - Demo Video (10min): https://www.ansible.com/tower-demo https://www.ansible.com/tower-demo - Remove angry potato logo: https://github.com/nanobeep/awx-logos https://github.com/nanobeep/awx-logos I do the curation for the 'Ansible & Friends' newsletter and we've been following this closely for a few months... If you're interested in alternatives to Tower/AWX, see our listing in issue 64: https://hvops.com/news/ansible/64 https://hvops.com/news/ansible/64 Kudos to Jeff, he's quite prolific in the community. We've highlighted him recently in the "Community Heroes" section: https://hvops.com/news/ansible/64 https://hvops.com/news/ansible/64 And in our September issue, we had to give Jeff his own section because there were just too many great articles he had put out: https://hvops.com/news/ansible/67 https://hvops.com/news/ansible/67 (Full disclosure: Ansible Inc hired me a few years ago to update and automate the Tower documentation systems)
bubblethink 9y ago
Does someone have a quick summary of where this fits into Satellite/Katello v/s puppet, which is already included in Katello.
- MrOwen 9y ago
  Starting in Foreman 1.10 (Satellite 6.2 is based on Foreman 1.11[1]; Katello is now officially a Foreman plugin), Foreman introduced the Ansible plugin in a more/less primitive form. Essentially, the goal was/is to provide an Ansible alternative for provisioning where Puppet was used previously. Before, you could only specify Puppet classes to apply to initialized hosts but now specifying Ansible roles is possible. So in a very basic use case where you want to configure a new compute instance in your environment, there's not much difference. However, in cases when you need to do things like hardening enforcement and remediation, end-user self-provisioning with surveys, workflows involving disparate tools which Ansible can coordinate (which may not even involve your hosts), reviewing/analyzing results of a play across 100s or 1000s of hosts, or auditing/rbac controls, Tower/AWX will be your tool. These features will most likely not make their way into Satellite because that's not really the focus of Satellite. [1]: https://access.redhat.com/articles/1343683 https://access.redhat.com/articles/1343683 Quick correction: after looking at some docs on the RH site, it seems the Ansible Foreman plugin may not be included in Satellite at this time. I suspect this will change in the upcoming versions, but not really a way to tell at this point :( Edit 3!!: Ansible support is coming but not for a while. See discussion regarding the roadmap presentation from Summit here: https://www.reddit.com/r/redhat/comments/6lb460/satellite_63_dates_and_confirmed_features/ https://www.reddit.com/r/redhat/comments/6lb460/satellite_63...
lamby 9y ago
"Ansible" and "open source" don't go together that well in my head. I used to send a whole bunch of fixes to Ansible as they were so responsive in merging my stuff extremely quickly. But after they were bought (or /incredibly/ close to the same timing..) my PRs stopped being merged in a timely manner, often requiring many rounds of tedious rebasing as they looked at it 2 months after submission when the code had moved on. Naturally, I prefered to spend my time elsewhere...

276 points by sciurus 9y ago

I'm curious to know how usage of AWX affects your ability to maintain everything (inventory, roles, playbooks, etc.) in version control. I'm guessing AWX wants to be the central "source of truth" for all of that stuff instead of just keeping it all in a single git repo.

muxator 9y ago
I have the same doubt. Does anyone have more information?
atgreen 9y ago
You hook AWX up to git or similar. It will pull playbooks, etc, from git before execution. I was a Tower sceptic at first, but it's actually really great. (edit: disclaimer .. I am a Red Hat employee!)
- jlgaddis 9y ago
  Oh sweet, that's the best that I could have hoped for. Thanks!
MrOwen 9y ago
In Tower 3.2 (just released about a week ago), there is now the ability to specify inventory from source instead of having to define it using either the UI or API. See http://docs.ansible.com/ansible-tower/latest/html/userguide/inventories.html#add-source http://docs.ansible.com/ansible-tower/latest/html/userguide/... for more information on this. Hope this helps!

richardfontana 9y ago

"To be clear though, Ansible Tower itself will still be a licensed product offering from Red Hat, but the code that builds Ansible Tower releases is open sourced, and is available in the AWX Project." This is strictly speaking correct but I think the author is implying that AWX code will get proprietized in Ansible Tower, which is not correct. Normally, Red Hat does not alter upstream open source licenses in its product offerings.

crymer11 9y ago
As of today, there is at least one difference between AWX and Tower. One supports high availability (Tower) and the other does not (AWX).

alexnewman 9y ago

I am not sure, have they open sourced something i can even use

sud0er 9y ago
https://github.com/ansible/awx https://github.com/ansible/awx
- alexnewman 9y ago
  Right but it's not clear how to deploy this
  - geerlingguy 9y ago
    I updated the original article linked from this post with a two-line instruction for running it from my Docker Hub images: curl -O https://raw.githubusercontent.com/geerlingguy/awx-container/master/docker-compose.yml docker-compose up -d
  - citruspi 9y ago
    The second sentence on that repository's readme is > To install AWX, please view the Install guide. which links to an installation guide[0] with information on setting it up with OpenShift or Docker. I'm not sure what part isn't clear. [0]: https://github.com/ansible/awx/blob/devel/INSTALL.md https://github.com/ansible/awx/blob/devel/INSTALL.md

Androider 9y ago

Maybe someone will finally offer a managed Ansible Tower service. I'm always surprised that Red Hat hasn't to date. Between managed git and CI with deployment to AWS, I have no desire to babysit, backup and patch a snowflake Tower instance.

perlgeek 9y ago
Red Hat mostly caters to large businesses, many of which still want most of their stuff on premise. Putting just the Ansible things in the cloud would be an undue security risk (if your mindset is that on-prem is more secure). And if you do use a cloud provider, you likely want to run Ansible in the same cloud, just for performance reasons.
ghjm 9y ago
Out of curiosity, would you be concerned with giving a managed service vendor all the passwords to everything in your infrastructure?
- rmenr 9y ago
  Yes. I would. Which is why I love the idea of having AWX to run within my own infra, in the way that I'd want to run it. Arrogant as it may sound, I'd much prefer to take ownership of that, personally. I'd be happy to self-host it and take the operational pains that come with it, and sleep (at least slightly more happily at night) knowing that I'm managing my secrets myself.

lima 9y ago

If you're considering using this (or any similar) tool, please keep in mind that you're adding a lot of attack surface. Your Ansible master is one of the most critical (if not the most critical) machine in your network. It has unrestricted access to everything, including a very detailed list of what and where everything is. If it's compromised, it's over. Something like Ansible Tower adds a LOT of attack surface. Instead of a locked-down server exposing a public key-only SSH port, you suddenly have a whole web application stack in there. Your browser and every Chrome extension with full page access now has root access to your network (and don't get me started on potential CSRF or XSS vulnerabilities...). If you don't need any of the enterprise-ey features, just might be better off with plain Ansible and Ara[1], with the latter running on a separate machine. A "sudoers" rule is much more secure than any ACL in a web application backend. If you do want to use Tower, you need to think about these risks and how you mitigate them. Of course, this also applies to any similar tool like Jenkins, Rundeck, CircleCI or whatever if you give them production credentials. [1]: https://ara.readthedocs.io/en/latest/ https://ara.readthedocs.io/en/latest/

crymer11 9y ago
> It has unrestricted access to everything It only has unrestricted access to what you give it unrestricted access to. If your ansible playbooks use a user that doesn't have root access and limited sudo powers, then it's not much different from using Ara.
- mikepurvis 9y ago
  That's fair, but Ansible culture is to do everything as sudo, and traditionally it was pretty painful to execute only portions of a playbook as the sudo. Though it looks like that's gotten better in more recent times: http://docs.ansible.com/ansible/latest/become.html http://docs.ansible.com/ansible/latest/become.html
  - emmelaich 9y ago
    The big improvement was the ability to turn sudo off/on for a particular task. Not sure when that was introduced. 1.9.something?

crymer11 9y ago

The one thing we're really missing from AWX (the open source version of Tower) is the high availability support. I've seen some discussion in GitHub issues about that; hoping we see it supported soon!

rmetzler 9y ago

I'm sorry, I need a video showing me, what Ansible Tower actually does. I use Ansible in my day-to-day job (I'm a full stack dev learning how to do sysadmin stuff in scale). We use Ansible in a custom webapp to orchestrate bare metal clouds. We build and operate custom High Performance Computation Clusters and this is our SaaS offering. But the code relies heavily on cron and legacy perl code. I wanted to rewrite the code and use a queue for a long time, but never found enough time to actually do it. It works good enough and we have customers relying on it.

jlgaddis 9y ago
> I'm sorry, I need a video showing me, what Ansible Tower actually does. Click on the first link in this article, "Ansible Tower" and you'll be taken to a page [0] where (above the fold) there are two videos: a two-minute overview and a 10-minute demo. [0]: https://www.ansible.com/tower https://www.ansible.com/tower

jlgaddis 9y ago

Since Jeff's book is mentioned a few times, I'd suggest going for the (updateable) "e-book" if you're interested in purchasing it. I have the hardcopy version of it (and another Ansible book or two) and, with the rate of Ansible development, it got kinda out-of-date pretty quickly.

corford 9y ago
Second this. I bought the PDF ebook years ago and still get an email once in a while with an updated version. Best $20 something I've spent in a long time (thanks Jeff!).
- geerlingguy 9y ago
  You're welcome! Working on a chapter on Ansible Container right now :)

linsomniac 9y ago

I was pretty excited about AWX, we had finally deployed a few things to provide some of the functionality (Rundeck and some custom runners, also tried but decided against StackStorm since it has no role based task limits in the non-enterprise version). I gave Jeff's (author of this piece) Ansible role a try and had an AWX system up and running quickly. He's making some really nice Ansible roles. But I had no luck with AWX. I think if you are using entirely platforms that are supported directly by AWX (OpenStack/AWS/Azure), you might be fine. We run 80% of our stack on Ganeti, and have a custom inventory script that AWX seems entirely unable to use. Even distiling that dynamic inventory down into a static inventory isn't working in my testing because it wants our Vault password to load the inventory, and the inventory task doesn't allow for associating vault credentials. Nor does it seem to provide the boto credentials needed by our dynamic inventory script, even though it has a spot for providing AWS credentials. I want to try it one more time to see if I can find a combination of static inventory that doesn't need the Vault. But at the moment, the Rundeck weirdness with our inventory is less than the AWX weirdness, so that is our solution. I'm sure I'm just not getting something about AWX, but I've spent a day with the docs and made no real progress. It's awesome to have available as an option. I wanted to get Tower but could never secure the funding for it, largely because it was a big unknown.

chucky_z 9y ago
I ended up throwing our AWS credentials right into the dynamic inventory script itself. It sounds janky but I mean... it worked. You _should_ be able to pass in a vault password as well, as part of any job? Are you doing something with vault in your inventory?
- linsomniac 9y ago
  I'm not doing anything with the vault in the inventory that I know of. After thinking some more on it, I think the problem is that I put the static inventory in the directory that also has group_vars in it, and that has vault files in it, so Ansible is wanting the vault password. I'm going to try putting it somewhere else, but I have to start from scratch with the new instance.
9y ago

amq 9y ago

What is the role of Ansible in the world of Docker, Kubernetes and Swarm?

zerkten 9y ago
I was wondering the same thing and found this recent video on Ansible Containers (https://www.ansible.com/ansible-roles-as-containers https://www.ansible.com/ansible-roles-as-containers). The project overview is https://www.ansible.com/ansible-container https://www.ansible.com/ansible-container. It'd be interesting to hear from others with experience combining these.
- alexnewman 9y ago
  ansible and containers do not mix well. Don't even bother. They take totally different approaches. Use ansible for what it is good for. Using it to automate all the things ... in container world... I mean why have docker-compose or k8s at all. Just launch containers willy nilly and instead of - self healing - automatic failover - Docker centric tools You can have a python s*it show where you use containers like processes. In fact they are processes that probably can't handle signals or pipes. Maybe use tini and that at least works, but it misses the point. Ansible and docker are fundamentally at odds. When ansible was created it had the promise of a simple layer of abstraction over ssh. now It just does all the things because it jelly. Don't give into the h8
  - mi100hael 9y ago
    Ansible works quite well for automating docker deployments. Something still has to execute the docker commands to spin up a container/swarm/cluster/whatever. Better to have those commands be idempotent and checked in to version control. http://docs.ansible.com/ansible/latest/docker_container_module.html http://docs.ansible.com/ansible/latest/docker_container_modu...
    - geerlingguy 9y ago
      And if you control networking, Ansible can manage that... and if you control local workstation management, Ansible can manage that... and if you need something to manage things like CloudFormation with automation... Ansible fits all the automation gaps that exist between all the different infrastructure tools.

timwaagh 9y ago

I worked on setting up ansible for running a setup playbook on our new virtualised dev environments complete with VirtualBox bugs. Ansible has been a bit of a pita for me to set up. Try pulling in a git repo with it. It fails and does not even tell you what is up. Helpful error messages anyone? Maybe this tower could help debug some issues. Although it is basically more added complexity. I don't really understand the advantage over running a normal script either, but it was not really my idea. Somehow my team thinks they should not listen when I say something sucks and listen to this rude kid who likes to talk fast, likes to interrupt and call themselves the best ever instead. I might not look cool and my ways are not the latest in cool tech, but I sure as f am experienced and know things. It will be the others problem soon enough I guess. Maybe the advantage is that you get to run it on all servers at the same time. Not that this is a big one when you have like two. Oh well. I guess I'm not quite done with this software until my team realizes maybe I'm not entirely bullshit when I say we should use simple scripts or go straight to docker. Maybe this tower thing can help debug the mess.

corford 9y ago
Strange, http://docs.ansible.com/ansible/latest/git_module.html http://docs.ansible.com/ansible/latest/git_module.html is pretty robust. If you haven't already, try running the playbook with -vvv to get extra debug info printed. You might be running in to a (possibly obscure) local or remote SSH permission issue. You can use ansible.verbose="vvvv" if you're calling the play via vagrant's ansilbe provisioner.
- timwaagh 9y ago
  Of course I tried -vvv and -vvvv. That did not tell me anything for this issue. I also tried the option where you get a bunch of python scripts. That told me a lot more than I wanted to know. The obvious option of seeing which commands it has run and their in and output just does not seem to be in there.
  - corford 9y ago
    No idea then, sorry. The only time the git module has failed with me is due to me fucking up my SSH settings in a convoluted environment (SSH Agent on windows workstation -> ansible controller on vagrant ubuntu box -> remote AWS bastion -> repo host with a very restrictive sshd config). In that case, running ansible verbosely gave enough info to point me in the direction of fixing what was wrong with my ssh setup (can't remember now what it was).

adictator 9y ago

I wonder if this move forebodes the end of products (& companies) like Chef, Puppet & Salt. Why would one want to pay for their enterprise products if AWX is readily available for free?

RRRA 9y ago

It'd be nice if there was a way to have ansible-pull verify GPG signatures (like some puppet setup people use). That way, it doesn't matter as much if AWX gets compromised.

yo-code-sucks 9y ago

Fucking Jeff this shit happened like a month ago and now at the top of HN?

mattjaynes 9y ago

Quick links: - Github Project: https://github.com/ansible/awx https://github.com/ansible/awx - Project FAQ: https://www.ansible.com/awx-project-faq https://www.ansible.com/awx-project-faq - Demo Video (10min): https://www.ansible.com/tower-demo https://www.ansible.com/tower-demo - Remove angry potato logo: https://github.com/nanobeep/awx-logos https://github.com/nanobeep/awx-logos I do the curation for the 'Ansible & Friends' newsletter and we've been following this closely for a few months... If you're interested in alternatives to Tower/AWX, see our listing in issue 64: https://hvops.com/news/ansible/64 https://hvops.com/news/ansible/64 Kudos to Jeff, he's quite prolific in the community. We've highlighted him recently in the "Community Heroes" section: https://hvops.com/news/ansible/64 https://hvops.com/news/ansible/64 And in our September issue, we had to give Jeff his own section because there were just too many great articles he had put out: https://hvops.com/news/ansible/67 https://hvops.com/news/ansible/67 (Full disclosure: Ansible Inc hired me a few years ago to update and automate the Tower documentation systems)

bubblethink 9y ago

Does someone have a quick summary of where this fits into Satellite/Katello v/s puppet, which is already included in Katello.

MrOwen 9y ago
Starting in Foreman 1.10 (Satellite 6.2 is based on Foreman 1.11[1]; Katello is now officially a Foreman plugin), Foreman introduced the Ansible plugin in a more/less primitive form. Essentially, the goal was/is to provide an Ansible alternative for provisioning where Puppet was used previously. Before, you could only specify Puppet classes to apply to initialized hosts but now specifying Ansible roles is possible. So in a very basic use case where you want to configure a new compute instance in your environment, there's not much difference. However, in cases when you need to do things like hardening enforcement and remediation, end-user self-provisioning with surveys, workflows involving disparate tools which Ansible can coordinate (which may not even involve your hosts), reviewing/analyzing results of a play across 100s or 1000s of hosts, or auditing/rbac controls, Tower/AWX will be your tool. These features will most likely not make their way into Satellite because that's not really the focus of Satellite. [1]: https://access.redhat.com/articles/1343683 https://access.redhat.com/articles/1343683 Quick correction: after looking at some docs on the RH site, it seems the Ansible Foreman plugin may not be included in Satellite at this time. I suspect this will change in the upcoming versions, but not really a way to tell at this point :( Edit 3!!: Ansible support is coming but not for a while. See discussion regarding the roadmap presentation from Summit here: https://www.reddit.com/r/redhat/comments/6lb460/satellite_63_dates_and_confirmed_features/ https://www.reddit.com/r/redhat/comments/6lb460/satellite_63...

lamby 9y ago

"Ansible" and "open source" don't go together that well in my head. I used to send a whole bunch of fixes to Ansible as they were so responsive in merging my stuff extremely quickly. But after they were bought (or /incredibly/ close to the same timing..) my PRs stopped being merged in a timely manner, often requiring many rounds of tedious rebasing as they looked at it 2 months after submission when the code had moved on. Naturally, I prefered to spend my time elsewhere...