5 ms·

We use ansible-pull to decentralize our Ansible runs as much as possible, but we also use Hashicorp Vault's SSH Key Certificates functionality to make sure our

We use ansible-pull to decentralize our Ansible runs as much as possible, but we also use Hashicorp Vault's SSH Key Certificates functionality to make sure our SSH keys are short-lived when we run it from CI. The last thing we want is CI with a bunch of root level keys on it!

samvimes 7y ago
you seem to be a big proponent of ansible-pull. are any of your use cases/implementations publicly available, I'm really interested to see how people are using ansible-pull in production. I'd like to do something similar, currently we use a mix of ansible tower (which I don't love) and ansible runs from local machines to manage the infrastructure. I'd rather it all be tied into terraform though, so that we have a single place to manage changes from
- jturpin 7y ago
  We don't have anything publicly available unfortunately, but we call ansible-pull the instance userdata to configure the host on startup. IAM Policies and Vault integration are used to grant the host access to certain secrets needed by the ansible run.
gopaz 7y ago
Also interested in this, we have a fairly large setup and always interesting to see how others use it. Especially around Vault, it never really clicked for me, I fail to see how it helps most of the times, if a user can trigger X that will generate a key on the fly, what prevents a hacker from doing the same, etc...
- pas 7y ago
  You can audit access/key-genesis, easily revoke keys, have stricter rules for giving out keys. It's a complexity-compartmentalization trade off, that is usually recommended for better IT sec posture. Allows other stuff [IDS - intrusion detection system] to be built on top more easily. Basically leads to the secrets in the secret vault mentality, so any time you see a secret not in the vault, you can sound the alarm.

5 ms·

We use ansible-pull to decentralize our Ansible runs as much as possible, but we also use Hashicorp Vault's SSH Key Certificates functionality to make sure our

by jturpin 7y ago

samvimes 7y ago
you seem to be a big proponent of ansible-pull. are any of your use cases/implementations publicly available, I'm really interested to see how people are using ansible-pull in production. I'd like to do something similar, currently we use a mix of ansible tower (which I don't love) and ansible runs from local machines to manage the infrastructure. I'd rather it all be tied into terraform though, so that we have a single place to manage changes from
- jturpin 7y ago
  We don't have anything publicly available unfortunately, but we call ansible-pull the instance userdata to configure the host on startup. IAM Policies and Vault integration are used to grant the host access to certain secrets needed by the ansible run.
gopaz 7y ago
Also interested in this, we have a fairly large setup and always interesting to see how others use it. Especially around Vault, it never really clicked for me, I fail to see how it helps most of the times, if a user can trigger X that will generate a key on the fly, what prevents a hacker from doing the same, etc...
- pas 7y ago
  You can audit access/key-genesis, easily revoke keys, have stricter rules for giving out keys. It's a complexity-compartmentalization trade off, that is usually recommended for better IT sec posture. Allows other stuff [IDS - intrusion detection system] to be built on top more easily. Basically leads to the secrets in the secret vault mentality, so any time you see a secret not in the vault, you can sound the alarm.