6 ms·

Pretty cool but Ansible just seems too slow to me. I'm just comparing this against like native scripting, Terraform, etc. I guess Ansible is still the best opti

Pretty cool but Ansible just seems too slow to me. I'm just comparing this against like native scripting, Terraform, etc. I guess Ansible is still the best option for configuration management, but I keep hoping someone will come out with a new tool, preferably built with Go or Rust.

grosswait 5y ago
I doubt building ansible in go or rust we save more than a few ms in the average playbook run.
blcknight 5y ago
mgmt config is written in go and has a lot of interesting concepts.
- purpleidea 5y ago
  Thanks for looking out for us =D Link for any who's interested: https://github.com/purpleidea/mgmt/ https://github.com/purpleidea/mgmt/ I and others have been working quite hard on it, so please come join us =D
  - kungfufrog 5y ago
    Hey there, I've been following "mgmt" for years, hoping it was going to be the next big thing. I did see a while ago that you made a significant investment in developing mgmt full-time but then didn't see much news out of the community afterwards. I'm curious whether there's a status update you could provide? I'd love to get involved as I think it truly represents a next generation style config management system, but I also had fears it was dead in the water or not being actively developed!
nerdbaggy 5y ago
salt has been great for me. SSH is just so slow compared to always on zeromq
- yjftsjthsd-h 5y ago
  Maybe, but I feel safe exposing openssh to the open internet, which is more than I can say for salt.
  - takeda 5y ago
    In properly set up environment things like that should never been exposed outside.
    - yjftsjthsd-h 5y ago
      Not every environment can provide an internal network.
      - takeda 5y ago
        Actually you always have an option to properly secure. If you have own data center and more than one machine you do have a LAN. I'm guessing you're talking about public cloud like AWS. Similarly you can have private subnets (which is the best practice). If you have a single instance that's only public, you can place definitions on local S3 and have instance pull it. You can secure everything so it's not accessible from outside, and you don't need service to be available from the outside. If you have multiple instances and all are on public subnets and talk to each other over the Internet, you should rethink your design, but at very least have firewall configured. Security groups that list themselves could help. Let me know if you have some other scenario.
        yjftsjthsd-h 5y ago
        In a word: Hetzner. Dedicated servers scattered across data centers, sufficiently numerous to make IPAM too painful to manually tie them together with wireguard. It's possible that some sort of overlay network or VPN could be made to work, but I could also just expose port 22 with only public key auth enabled, use ansible, and be done.
purpleidea 5y ago
Um, you've seen https://github.com/purpleidea/mgmt/ https://github.com/purpleidea/mgmt/ right ;) Join us!
- candiddevmike 5y ago
  Red Hatters keep leaving the company and building config management tools =D. For mgmt, I don't see anything particularly novel that it brings to the space. It doesnt use YAML, but if I'm going to write pseudocode I may as well reach for Pulumi or python. Why would you recommend mgmt over Ansible or Terraform? Since this can use Consul, why wouldn't I just use Consul for event driven changes?
tundrax 5y ago
Puthon doesn't seem to be the performance issue here, but remote operations on target hosts.
dralley 5y ago
While I don't have any hard numbers, I would bet a lot of money that any "slowness" of ansible has nothing to do with the use of Python. Everything happens over SSH, that's a lot of network roundtrips.
- deadbunny 5y ago
  Indeed. See saltstack for something that does the same thing, witten in python that runs much faster.
- Fizzadar 5y ago
  SSH can be quicker, I believe ansibles use of SSH processes is more the issue. An old but still relevant benchmark exists in my pyinfra project which uses SSH (amongst other protocols) but a Python implementation, and its significantly quicker and more scalable than ansible: http://docs.pyinfra.com/en/1.x/performance.html http://docs.pyinfra.com/en/1.x/performance.html
stevekemp 5y ago
I wrote a proof-of-concept tool, inspired by puppet more than anything, but since it runs locally it is perhaps comparable to ansible too: https://github.com/skx/marionette/ https://github.com/skx/marionette/ It turns out that three operations suffice for almost 90% of my needs: * Populate a file, from a template with variable expansion. * Run a shell-command. * Install a package. I added support for pulling a docker container too, just for fun. Although I never made the effort to pimp/promote it, the tool is stable and useful as-is.
0xbadcafebee 5y ago
> I guess Ansible is still the best option for configuration management Ansible is perhaps the worst option, next to CFEngine and some other legacy ones. It's just the one everyone goes for because nobody wants to maintain a puppet/chef/salt/etc server, and encoding a bastardized DSL in YAML seems easier than writing Ruby.
apple4ever 5y ago
I run Mitogen which makes it super fast. There was some discussion of merging them. But the Ansible side got all grumpy and refused. It was a bad decision, because it hurts Ansible being so slow.

grosswait 5y ago

I doubt building ansible in go or rust we save more than a few ms in the average playbook run.

blcknight 5y ago

mgmt config is written in go and has a lot of interesting concepts.

purpleidea 5y ago
Thanks for looking out for us =D Link for any who's interested: https://github.com/purpleidea/mgmt/ https://github.com/purpleidea/mgmt/ I and others have been working quite hard on it, so please come join us =D
- kungfufrog 5y ago
  Hey there, I've been following "mgmt" for years, hoping it was going to be the next big thing. I did see a while ago that you made a significant investment in developing mgmt full-time but then didn't see much news out of the community afterwards. I'm curious whether there's a status update you could provide? I'd love to get involved as I think it truly represents a next generation style config management system, but I also had fears it was dead in the water or not being actively developed!

nerdbaggy 5y ago

salt has been great for me. SSH is just so slow compared to always on zeromq

yjftsjthsd-h 5y ago
Maybe, but I feel safe exposing openssh to the open internet, which is more than I can say for salt.
- takeda 5y ago
  In properly set up environment things like that should never been exposed outside.
  - yjftsjthsd-h 5y ago
    Not every environment can provide an internal network.
    - takeda 5y ago
      Actually you always have an option to properly secure. If you have own data center and more than one machine you do have a LAN. I'm guessing you're talking about public cloud like AWS. Similarly you can have private subnets (which is the best practice). If you have a single instance that's only public, you can place definitions on local S3 and have instance pull it. You can secure everything so it's not accessible from outside, and you don't need service to be available from the outside. If you have multiple instances and all are on public subnets and talk to each other over the Internet, you should rethink your design, but at very least have firewall configured. Security groups that list themselves could help. Let me know if you have some other scenario.
      - yjftsjthsd-h 5y ago
        In a word: Hetzner. Dedicated servers scattered across data centers, sufficiently numerous to make IPAM too painful to manually tie them together with wireguard. It's possible that some sort of overlay network or VPN could be made to work, but I could also just expose port 22 with only public key auth enabled, use ansible, and be done.

purpleidea 5y ago

Um, you've seen https://github.com/purpleidea/mgmt/ https://github.com/purpleidea/mgmt/ right ;) Join us!

candiddevmike 5y ago
Red Hatters keep leaving the company and building config management tools =D. For mgmt, I don't see anything particularly novel that it brings to the space. It doesnt use YAML, but if I'm going to write pseudocode I may as well reach for Pulumi or python. Why would you recommend mgmt over Ansible or Terraform? Since this can use Consul, why wouldn't I just use Consul for event driven changes?

tundrax 5y ago

Puthon doesn't seem to be the performance issue here, but remote operations on target hosts.

dralley 5y ago

While I don't have any hard numbers, I would bet a lot of money that any "slowness" of ansible has nothing to do with the use of Python. Everything happens over SSH, that's a lot of network roundtrips.

deadbunny 5y ago
Indeed. See saltstack for something that does the same thing, witten in python that runs much faster.
Fizzadar 5y ago
SSH can be quicker, I believe ansibles use of SSH processes is more the issue. An old but still relevant benchmark exists in my pyinfra project which uses SSH (amongst other protocols) but a Python implementation, and its significantly quicker and more scalable than ansible: http://docs.pyinfra.com/en/1.x/performance.html http://docs.pyinfra.com/en/1.x/performance.html

stevekemp 5y ago

I wrote a proof-of-concept tool, inspired by puppet more than anything, but since it runs locally it is perhaps comparable to ansible too: https://github.com/skx/marionette/ https://github.com/skx/marionette/ It turns out that three operations suffice for almost 90% of my needs: * Populate a file, from a template with variable expansion. * Run a shell-command. * Install a package. I added support for pulling a docker container too, just for fun. Although I never made the effort to pimp/promote it, the tool is stable and useful as-is.

0xbadcafebee 5y ago

> I guess Ansible is still the best option for configuration management Ansible is perhaps the worst option, next to CFEngine and some other legacy ones. It's just the one everyone goes for because nobody wants to maintain a puppet/chef/salt/etc server, and encoding a bastardized DSL in YAML seems easier than writing Ruby.

apple4ever 5y ago

I run Mitogen which makes it super fast. There was some discussion of merging them. But the Ansible side got all grumpy and refused. It was a bad decision, because it hurts Ansible being so slow.