<story><title>Ansible open-sources Ansible Tower with AWX</title><url>https://www.jeffgeerling.com/blog/2017/ansible-open-sources-ansible-tower-awx</url></story><parent_chain><item><author>oblio</author><text>Does anyone actually use Ansible server-less? Can it even be done?&lt;p&gt;(Edit: my bad, ignore this comment, I misphrased my question; the real question should have been: can you run Ansible locally on the target server, just like chef-solo&amp;#x2F;chef-zero?)</text></item><item><author>eropple</author><text>Chef Server has a central server. Chef Zero doesn&amp;#x27;t, especially when using tools like cfn-init&amp;#x2F;cfn-hup and S3-backed minimart to self-bootstrap. This is the approach I take, and it&amp;#x27;s the approach I see becoming more and more common. Letting nodes figure out how to deal with their own problems (better able to auto-scale, more fault tolerant) is, to me, much better than having Jenkins or whatever have to SSH into them in the first place.&lt;p&gt;You can do it with Ansible, if you&amp;#x27;re going home-roll it, but I haven&amp;#x27;t seen too many people do so.</text></item><item><author>pm90</author><text>This is a great point. Although...other CI systems already have that kind of privilege, right? e.g. Chef has a master node if I&amp;#x27;m not mistaken.&lt;p&gt;In my experience, ansible playbooks are great when run from a more general purpose task runner like jenkins, which then has permissions to access&amp;#x2F;modify one&amp;#x27;s production environment. I don&amp;#x27;t think I would personally use tower unless it provides something much much better than running ansible tasks in Jenkins... it would be just too much of a hassle to get the security&amp;#x2F;compliance aspects right.</text></item><item><author>lima</author><text>If you&amp;#x27;re considering using this (or any similar) tool, please keep in mind that you&amp;#x27;re adding a lot of attack surface.&lt;p&gt;Your Ansible master is one of the most critical (if not &lt;i&gt;the&lt;/i&gt; most critical) machine in your network. It has unrestricted access to everything, including a very detailed list of what and where everything is. If it&amp;#x27;s compromised, it&amp;#x27;s over.&lt;p&gt;Something like Ansible Tower adds a LOT of attack surface. Instead of a locked-down server exposing a public key-only SSH port, you suddenly have a whole web application stack in there. Your browser and every Chrome extension with full page access now has root access to your network (and don&amp;#x27;t get me started on potential CSRF or XSS vulnerabilities...).&lt;p&gt;If you don&amp;#x27;t need any of the enterprise-ey features, just might be better off with plain Ansible and Ara[1], with the latter running on a separate machine. A &amp;quot;sudoers&amp;quot; rule is much more secure than any ACL in a web application backend.&lt;p&gt;If you do want to use Tower, you need to think about these risks and how you mitigate them. Of course, this also applies to any similar tool like Jenkins, Rundeck, CircleCI or whatever if you give them production credentials.&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;ara.readthedocs.io&amp;#x2F;en&amp;#x2F;latest&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;ara.readthedocs.io&amp;#x2F;en&amp;#x2F;latest&amp;#x2F;&lt;/a&gt;</text></item></parent_chain><comment><author>eropple</author><text>You can run Ansible locally with `-c local`.&lt;p&gt;But, as far as serverless&amp;#x2F;self-bootstrapping deploys go, it&amp;#x27;s less common. Ansible has less of a &amp;quot;culture of dependencies&amp;quot;; the simpler, more approachable-looking nature of the Ansible playbook format seems to lend itself to people one-offing whatever they need rather than looking for best-practices solutions that already exist. Because of this, there&amp;#x27;s no real Berkshelf equivalent for Ansible. The tooling doesn&amp;#x27;t exist, outside of Tower (sorta), because nobody wants it, and nobody wants it because the tooling doesn&amp;#x27;t exist. So the people who &lt;i&gt;are&lt;/i&gt; doing with Ansible something similar to the Chef Zero stuff I mentioned above are mostly home-rolling it. (I just use a S3 bucket as a Minimart berkshelf endpoint and move on with my day.)&lt;p&gt;Last-mile configuration is also tricky. In my Chef Zero stuff, I use CloudFormation metadata to provide Chef attributes. You can do something similar with Ansible...but it&amp;#x27;s duct-tapey. There are times when simple is better; IMO, Ansible&amp;#x27;s core tooling errs too far on that side and the ecosystem has not caught up to make more rigorous approaches really viable.</text></comment>
<story><title>Ansible open-sources Ansible Tower with AWX</title><url>https://www.jeffgeerling.com/blog/2017/ansible-open-sources-ansible-tower-awx</url></story><parent_chain><item><author>oblio</author><text>Does anyone actually use Ansible server-less? Can it even be done?&lt;p&gt;(Edit: my bad, ignore this comment, I misphrased my question; the real question should have been: can you run Ansible locally on the target server, just like chef-solo&amp;#x2F;chef-zero?)</text></item><item><author>eropple</author><text>Chef Server has a central server. Chef Zero doesn&amp;#x27;t, especially when using tools like cfn-init&amp;#x2F;cfn-hup and S3-backed minimart to self-bootstrap. This is the approach I take, and it&amp;#x27;s the approach I see becoming more and more common. Letting nodes figure out how to deal with their own problems (better able to auto-scale, more fault tolerant) is, to me, much better than having Jenkins or whatever have to SSH into them in the first place.&lt;p&gt;You can do it with Ansible, if you&amp;#x27;re going home-roll it, but I haven&amp;#x27;t seen too many people do so.</text></item><item><author>pm90</author><text>This is a great point. Although...other CI systems already have that kind of privilege, right? e.g. Chef has a master node if I&amp;#x27;m not mistaken.&lt;p&gt;In my experience, ansible playbooks are great when run from a more general purpose task runner like jenkins, which then has permissions to access&amp;#x2F;modify one&amp;#x27;s production environment. I don&amp;#x27;t think I would personally use tower unless it provides something much much better than running ansible tasks in Jenkins... it would be just too much of a hassle to get the security&amp;#x2F;compliance aspects right.</text></item><item><author>lima</author><text>If you&amp;#x27;re considering using this (or any similar) tool, please keep in mind that you&amp;#x27;re adding a lot of attack surface.&lt;p&gt;Your Ansible master is one of the most critical (if not &lt;i&gt;the&lt;/i&gt; most critical) machine in your network. It has unrestricted access to everything, including a very detailed list of what and where everything is. If it&amp;#x27;s compromised, it&amp;#x27;s over.&lt;p&gt;Something like Ansible Tower adds a LOT of attack surface. Instead of a locked-down server exposing a public key-only SSH port, you suddenly have a whole web application stack in there. Your browser and every Chrome extension with full page access now has root access to your network (and don&amp;#x27;t get me started on potential CSRF or XSS vulnerabilities...).&lt;p&gt;If you don&amp;#x27;t need any of the enterprise-ey features, just might be better off with plain Ansible and Ara[1], with the latter running on a separate machine. A &amp;quot;sudoers&amp;quot; rule is much more secure than any ACL in a web application backend.&lt;p&gt;If you do want to use Tower, you need to think about these risks and how you mitigate them. Of course, this also applies to any similar tool like Jenkins, Rundeck, CircleCI or whatever if you give them production credentials.&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;ara.readthedocs.io&amp;#x2F;en&amp;#x2F;latest&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;ara.readthedocs.io&amp;#x2F;en&amp;#x2F;latest&amp;#x2F;&lt;/a&gt;</text></item></parent_chain><comment><author>mcx</author><text>On AWS, we bake our AMIs with packer and include the Ansible roles and playbooks.&lt;p&gt;We use CloudFormation to deploy, so in the instance metadata we have it run Ansible locally to bootstrap and return the exit status to cfn-signal.&lt;p&gt;We retrieve secrets via Parameter Store. For environment specific configs that are not secrets (ie passing in vars from CloudFormation), we have cloud-init write a json file that we include with our ansible-playbook command.&lt;p&gt;The command ends up looking something like:&lt;p&gt;ansible-playbook -v -i &amp;#x27;localhost,&amp;#x27; -c local &amp;#x2F;some&amp;#x2F;path&amp;#x2F;playbook.yml --extra-vars &amp;#x27;@&amp;#x2F;some&amp;#x2F;path&amp;#x2F;vars.json&amp;#x27; &amp;amp;&amp;amp; &amp;#x2F;opt&amp;#x2F;aws&amp;#x2F;bin&amp;#x2F;cfn-signal -e $? --stack ${AWS::StackName} --resource ${AsgName} --region ${AWS::Region}</text></comment>