Sovereign: Ansible playbooks to build and maintain your own private cloud • Hacker News Board

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#141

Post by apple4ever » Sun, Feb 02, 2020, 3:51 PM UTC

wtf1234 wrote: post #92

davestephens wrote: post #84

Earlier quoted context omitted.

Maybe you've never worked with someone that sucked at shell scripting, or packaging. Ansible is awesome for enabling people to do reasonably complicated things in a consistent manner, at scale, without having to write all of the boilerplate code to be able to do so. This is forgetting the fact that Ansible is reasonably opinionated, which is great for lowering the barrier to entry and helping devs/admins to be produc…

> lowering the barrier to entry That's the opposite of a good thing. > When I just need to Get Shit Done, Ansible is awesome. "just" is the keyword. "just" instead of caring about long term maintainability and security

LOL on your first point.

For your second, Ansible is specifically designed for long term maintainability and security.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#142

Post by mindslight » Sun, Feb 02, 2020, 10:06 PM UTC

apple4ever wrote: post #138

mindslight wrote: post #45

On the general topic of Ansible and personal infrastructure: Every time I attempt to use Ansible (or its kin) to manage my own network, it feels overly obtuse and ultimately unhelpful. Its gains seem to be rooted in configuring a large number of identical servers, and isn't geared for a handful of hosts with some commonalities and some differences. Writing playbooks feels like a still-imperative wrapper around shell…

It definitely is target at a large number of identical servers, but is still very helpful for just a handful of hoses. Putting everything in YAML is helpful because no matter what service you are setting up, the format is the same to read and understand. And I hope you are using modules and not shell command directly (except for the small cases it is necessary) Ansible can be as simple or as complex as you made it. I…

>I bet your script isn’t as nice as an Ansible setup, nor as maintainable. Ansible’s templating engine is super flexible.

Ansible uses jinja2, and so do I. I obviously can't form an objective opinion on the "niceness", having developed it. But I'll say that my setup puts which files are on which hosts front and center, whereas it seems like Ansible would want that splayed out into a directory tree of "roles" (of which I'd have about 25). With my setup, I've got that in 200 lines of python including host/group definitions (excluding comments), with the actual config files living in one analogous tree (eg conf/etc/network/interfaces).

Half the reason I threw my comment out there was to see what bounced back, as I am currently working on this system. One of the responses was about error checking, which resonated. So I've since given Ansible another shot, for managing the top-level (calling my templater for each host, apt upgrade, etc). I think I do like it for this, now that it's much closer to its sweet spot of doing similar things to every host.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#143

Post by Annatar » Tue, Feb 04, 2020, 5:53 AM UTC

davestephens wrote: post #84

Annatar wrote: post #81

Quit this damn nonsense with Ansible or whatever garbage fashion fad is in vogue these days and finally learn how to make OS packages so you can do configuration management with normal shell scripting inside of them, because that's what it's for. The amount of incompetence and insanity from incompetence has gone too far. Damn it, this is exactly why IT sucks so bad!!!

Maybe you've never worked with someone that sucked at shell scripting, or packaging. Ansible is awesome for enabling people to do reasonably complicated things in a consistent manner, at scale, without having to write all of the boilerplate code to be able to do so. This is forgetting the fact that Ansible is reasonably opinionated, which is great for lowering the barrier to entry and helping devs/admins to be produc…

I've worked with plenty of people who had no business working in IT, but some of them were smart enough to recognize that they could benefit from education, so I taught them how to correctly and properly program in shell. Others were just insecure assholes who didn't care about working with computers and were in IT just for the money but didn't want anyone to know they're incompetent (even though it was obvious). Those always wanted to needlessly spend money on buying shitty software or using "tools" like "Ansible".

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#144

Post by eeZah7Ux » Sun, Feb 09, 2020, 1:55 PM UTC

apple4ever wrote: post #137

eeZah7Ux wrote: post #133

Earlier quoted context omitted.

A system designed to SSH into production host with high privileges and make changes automatically instead of enforcing staging...

That’s not really a security disaster unless you consider all of SSH a security disaster. If you are concerned about Ansible SSH’ing in (which means you are concerned about any person SSH’ing in), you just do the standard SSH hardening.

...and yet SSHing on a production system to make configuration changes is prohibited in many large companies including some FAANGs.

Because you (or some intern hired a week ago) are 1 typo away from making a disaster.

For the record, security includes availability and this is an availability risk.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#145

Post by Annatar » Mon, Feb 10, 2020, 7:45 AM UTC

ex_amazon_sde wrote: post #91

Annatar wrote: post #81

Quit this damn nonsense with Ansible or whatever garbage fashion fad is in vogue these days and finally learn how to make OS packages so you can do configuration management with normal shell scripting inside of them, because that's what it's for. The amount of incompetence and insanity from incompetence has gone too far. Damn it, this is exactly why IT sucks so bad!!!

HN has decided that running arbitrary commands on your production systems is OK. And that doing packaging, staging with CI/CD and immutable infrastructure is unnecessary. FAANG companies clearly disagree.

HN decides a lot of dumbass stupid things, which is precisely why the dumbest ones end up on n-gate.com and elsewhere (exempli gratia:"Twitter") being the butt of jokes. It's not shameful not to know something, but it's downright abhorrent and disrespectful acting like one knows and refusing to learn from those of us who have gone through the pain and suffering with stupid things over the decades. A person should constantly learn and strive to be a better person tomorrow than one was today, but no... "HN" cares more about being trendy than actually designing and implementing hardware and software for longetivity.