3 ms·

Highly recommend avoiding this--it's needlessly complicated abstraction on top of Ansible. Just write your own playbooks using the network modules in Ansible,

Highly recommend avoiding this--it's needlessly complicated abstraction on top of Ansible. Just write your own playbooks using the network modules in Ansible, they're really easy to use and will be a lot cleaner than this. You can manage as little or as much of the config for your network devices as you want, and the real beauty of Ansible shines when you do event-based network changes like new VLAN propagation or responding to security threats by blocking addresses.

vbernat 5y ago
Hey! I am one of the author of the article. This is not really an abstraction on top of Ansible. Just a tool to generate configuration files from templates as Ansible is pretty bad at this (slow, not providing a line number in case of problem, variable lookup quite rigid). Then, it's just regular Ansible using network modules to deploy the result. We push the opinion you need to manage the whole configuration to avoid getting out-of-sync with their expected state or putting the state inside your device. Once you are able to manage the whole configuration, the things you describe are possible: propagate a VLAN, adding IP to an access-list, etc. The other way around is not true.
- c0l0 5y ago
  Template rendering performance has always been one of my gripes with ansible. Have you ever taken up the challenge to debug/profile it, and get to the bottom of that seemingly obscene slowness? (It's one of those things I always plan to finally do whenever it affects me, but tend to forget or "postpone" as soon as I move beyond that one particularly slow task...)
  - vbernat 5y ago
    No, I didn't try. For me, the fact that modules serialize Python code into a zipfile then execute it makes it really hard to have something efficient. I also don't understand why RedHat is not helping Mitogen which could help solve this without breaking everything (as it suppresses a lot of the steps, even on localhost).

vbernat 5y ago

Hey! I am one of the author of the article. This is not really an abstraction on top of Ansible. Just a tool to generate configuration files from templates as Ansible is pretty bad at this (slow, not providing a line number in case of problem, variable lookup quite rigid). Then, it's just regular Ansible using network modules to deploy the result. We push the opinion you need to manage the whole configuration to avoid getting out-of-sync with their expected state or putting the state inside your device. Once you are able to manage the whole configuration, the things you describe are possible: propagate a VLAN, adding IP to an access-list, etc. The other way around is not true.

c0l0 5y ago
Template rendering performance has always been one of my gripes with ansible. Have you ever taken up the challenge to debug/profile it, and get to the bottom of that seemingly obscene slowness? (It's one of those things I always plan to finally do whenever it affects me, but tend to forget or "postpone" as soon as I move beyond that one particularly slow task...)
- vbernat 5y ago
  No, I didn't try. For me, the fact that modules serialize Python code into a zipfile then execute it makes it really hard to have something efficient. I also don't understand why RedHat is not helping Mitogen which could help solve this without breaking everything (as it suppresses a lot of the steps, even on localhost).