5 ms·

Ansible 1.9.0 Released

90 points by soupdiver 11y ago

WestCoastJustin 11y ago
Have spent the past few months heavily working with Ansible and would totally recommend it for anyone wanting simple configuration management and orchestration. The barrier to entry is extremely low, because it uses ssh and there are no remote agents, so you can get going pretty quickly. I have an introductory screencast on in @ https://sysadmincasts.com/episodes/43-19-minutes-with-ansible-part-1-4 https://sysadmincasts.com/episodes/43-19-minutes-with-ansibl...
- erichmond 11y ago
  The other thing that should be noted is that ansible feels like (shell scripting)++. Other competitors I've used needed a much heavier cognitive load to get started.
  - chimeracoder 11y ago
    > The other thing that should be noted is that ansible feels like (shell scripting)++. Other competitors I've used needed a much heavier cognitive load to get started. Having used Chef, Puppet, and Ansible, this is exactly why I prefer Ansible for all my projects now. If you can write a shell script, you can write an Ansible playbook. It won't be a great playbook, and you get benefits from using their modules instead of shell commands (like idempotency). But you don't have to worry about learning a new DSL just to do write a basic playbook or tweak an existing one. As a functional programmer, I understand the benefits and appeal of declarative syntax. Unfortunately, systems programming is the one place where it's really hard to be 100% declarative, because systems are inherently all about state[0]. [0] At least in 2015 - perhaps things will change as we move toward better containerization models
    - makmanalp 11y ago
      And it's also not that it's just a /new/ DSL - every so often I find the DSLs annoyingly limited compared to having a full fledged programming language.
    - cies 11y ago
      > Having used Chef, Puppet, and Ansible The only comparable system that I believe is a match for Ansible is SaltStack. > As a functional programmer, I understand the benefits and appeal of declarative syntax. Unfortunately, systems programming is the one place where it's really hard to be 100% declarative, because systems are inherently all about state[0]. Have you looked into Nix/NixOS/NixOps? I think they have a really good approach to "functional configuration mgmt". > perhaps things will change as we move toward better containerization models I agree. When using scrappable VMs/containers (deploy to a new one, then scrap the old one) that are build from a description, it is in some ways quite close to approach in the Nix-camp.
- luca_barbieri 11y ago
  I'm using Ansible as well, but I'm not really sure that it's better than just using shell scripts. The problem of something like Ansible is that you have to do a web search to figure out how to do anything, rather than just writing the shell command you already know to do it. The only major advantage is that it can tell you whether a configuration step changed the machine or not in a standardized format, which is something that shell cannot do without manually writing the code to do so. Ansible in particular is also much slower than shell, since it seems to do a network roundtrip for each command. This is pretty surprising, since the #1 performance concern in writing such a tool is of course precisely not doing that.
geerlingguy 11y ago
1.9.0 includes convenient new gluster_volume and haproxy modules (among others) and will also update its DigitalOcean integration to use the v2 API shortly (in 1.9.1 - it's currently using the more annoying v1 API). If you want to use the latest and greatest, it's easy enough to set up Ansible from source. Otherwise, use brew, apt, yum, or pip (they're all up to date). P.S. 1.9.0 was released on Mar. 25th, I think there's an older thread on it somewhere around here.
UserRights 11y ago
Does there exist a good playbook for setting up a production-ready mailserver? Thanks!
- ceejayoz 11y ago
  "Production-ready mailserver" is horribly broad (for starters, outgoing mail or incoming mail?), but Ansible Galaxy has lots of mail-related roles. For example, Zabbix: https://galaxy.ansible.com/list#/roles/1879 https://galaxy.ansible.com/list#/roles/1879
  - UserRights 11y ago
    zabbix is a monitoring solution, I am sure this sets up some kind of outgoing mail, but I was looking for a solution similar to iredmail.
    - ceejayoz 11y ago
      Sorry, I'm mixing it up with Zimbra. Too many weird names. I don't see an iredmail role, but having used Ansible previously, if you can install it chances are you can write an Ansible playbook for it.
- UserRights 11y ago
  BTW I found http://debops.org/ http://debops.org/ But still I think it would be a great idea to have a community playbook for critical things like mailservers where it is so easy to make a mistake and the fight against spammers is so hard to fight when you are only a small group of people or alone.
- groks 11y ago
  https://github.com/al3x/sovereign https://github.com/al3x/sovereign
  - UserRights 11y ago
    THIS! thanks!
drinchev 11y ago
I'm really happy they now support "svc", part of D. J. Bernstein DaemonTools [1]. This one really is a killer feature, I'm excited to use. I'm far closer than ever to not use ssh on my server manually. 1 : http://cr.yp.to/daemontools.html http://cr.yp.to/daemontools.html
izolate 11y ago
I've learned with Ansible never to be quick to update. There's always something that will break. I've been on 1.7.2 for a while, and will probably think about updating later this year.
- Sgoettschkes 11y ago
  Strange, I have the exact opposite experience. I am running devel and update every half month or so and it usually just works.
- meddlepal 11y ago
  S3 module and something else was b0rked in this release that I ran into last week (can't remember atm). Very annoying.
  - jimi_c 11y ago
    Yes, very sorry about that. The 1.9.1 rc1 will be out today, which will address this.
ynak 11y ago
Do they have any plans to support python3? I want to use it on Arch and Ubuntu. FAQ says they will address this issue by python3 becomes mainstream, but what does the mainstream exactly mean? When RHEL set python3 as default? Python2 maintenance continues until 2020, so seems have to wait for more several years.
- jimi_c 11y ago
  Hi ynak, we're planning on supporting py3 in the core engine with the v2 codebase. As for modules, we're still working on the best possible solution there, since we do need to continue supporting python 2.4 for the foreseeable future.
  - Spiritus 11y ago
    Why would you need to support Python 2.4? Haven't that been dead for for like 10 years?
    - jimi_c 11y ago
      There are still a lot of RHEL/CentOS 5 users out there, which run python 2.4. While py3 is moving forward, the number of users stuck on 2.4 is still considerably larger, and we will continue to support that until such a time as it's no longer the case. In the meantime, we are exploring options so that we can help those on newer distributions work by default in the same way.
  - ynak 11y ago
    Thank you for the reply. I'm looking forward to it.
- CraigJPerry 11y ago
  Those distributions have great dependency management, they will install the python 2 dependency when installing ansible
  - berdario 11y ago
sheraz 11y ago
Love Ansible for its simplicity. For some reason it "just clicked" whereas I really struggled with Puppet / Chef / or old-school shell scripts. (That says more about me than Puppet and Chef) For me, YAML files and fantastic documentation made more sense than the DSLs of the other two. Currently we use it to setup our 12-factor app in production, staging, and development environments. (Django, Elasticsearch on Ubuntu)
gtirloni 11y ago
Nice maintenance release with a few improvements. I'd say the core of Ansible's brainpower is focused on v2 which will have significant changes (easily available today if you want to try, check the v2 dir).
bbrazil 11y ago
One of the changes hinted at here is that you can now specify that a task will always run using the 'always' tag - handy for things like ec2_facts which was a long requested feature (https://github.com/ansible/ansible/issues/3157 https://github.com/ansible/ansible/issues/3157)
A_COMPUTER 11y ago
Started using Ansible last year, I use it to create up to date base images for AWS autoscale groups and to quick set up personal development environments for other developers, and have playbooks for creating all my security groups so I can version control them. Highly recommended. I tried other tools but by far and away Ansible was the easiest to learn and use with no loss of functionality.
est 11y ago
OK I am gonna ask the obvious question here: How does Ansible compare to Saltstack?
- michaelkrupp 11y ago
  Ansible is much easier to get into. The more complex your requirements are (complexity of your infrastructure, services, etc) the less useful it becomes IMHO. SaltStack feels much more feature-complete and much more powerful to me. Also Ansible has no dependency-graph which sometimes makes it hard to modularize your "plays". On the other hand, SaltStack needs to be setup on the minions first, whereas with Ansible you only need SSH. I myself now use Ansible to bootstrap SaltStack and let SaltStack do the heavy lifting.
- acveilleux 11y ago
  My own experience, which is fairly limited, is that Ansible is much simpler, "agent-less" (it uploads code as needed and remote executes it over SSH) and a mix between declarative and imperative in nature (a lot of the modules require you to use semaphore files or equivalent for idempotence.) Orchestration is pretty much built-in, including rolling deployment/restarts. Performance can be lacking on large cluster due to the many network round trips and lack of agent. Agents can be faked by rsync'ing config and running ansible in local mode. You can use ansible to do it and ansible is a great Fabric replacement. Salt is much heavier to setup. Has explicit agents ("minions") and a server ("Salt master") whereas ansible can be run from anywhere as long as SSH connection exists. Salt maintains metadata ("grains") about the remote hosts, ansible gathers whatever data it needs on demand. Salt is heavy on the custom terminology and concepts. You have to work with the metaphors. Salt states are much more declarative. Both make use of YAML for a lot of things. My impression was that Ansible is a far better tool for smaller environments with, say, less then 20-50 hosts being managed and the learning curve is surprisingly shallow. When I got it to work, I had more difficulty getting Vagrant to like Ansible than Ansible to setup a complicated stack (Islandora for the curious.) The semi declarative nature of the Ansible modules was easy to work with but getting idempotence was actually a bit of a pain. I've not fully setup Salt because of the level of effort required. It's comparable to a full Chef setup.
arca_vorago 11y ago
Ansible is really great, but for reasons some people might not think about. Ansible has support for powershell, which is essentially now the backend of windows. (your new servers are gui-less right?) Powershell is also not a bad language at all, and while for those of us that are bash/zsh/fish natives, it will take some getting used to, I find it a really powerfull and more intuitive way to interact with windows, even if it is very overly majorly verbose-verbose. Being able to work in my very mixed environment (Solaris/OSX/Linux/Doze, etc) via a central ansible server group is awesome.
- brunoqc 11y ago
  Is it a problem for you that it requires PowerShell 3.0? I wish I could use ansible with all those XP workstation a work.
  - arca_vorago 11y ago
    No it hasn't been a problem so far, just an update that gets pushed via the normal pre-ansible methods and requires a restart. Regarding XP... unless it's embedded get that shit outa there!
    - brunoqc 11y ago
      > Regarding XP... unless it's embedded get that shit outa there! We're also stuck with Windows Server 2003 for now :( I grew up thinking that the technology move so fast...
turingbook 11y ago
A comparison of notable free and open source configuration management software: http://en.wikipedia.org/wiki/Comparison_of_open-source_configuration_management_software http://en.wikipedia.org/wiki/Comparison_of_open-source_confi...

90 points by soupdiver 11y ago

Have spent the past few months heavily working with Ansible and would totally recommend it for anyone wanting simple configuration management and orchestration. The barrier to entry is extremely low, because it uses ssh and there are no remote agents, so you can get going pretty quickly. I have an introductory screencast on in @ https://sysadmincasts.com/episodes/43-19-minutes-with-ansible-part-1-4 https://sysadmincasts.com/episodes/43-19-minutes-with-ansibl...

erichmond 11y ago
The other thing that should be noted is that ansible feels like (shell scripting)++. Other competitors I've used needed a much heavier cognitive load to get started.
- chimeracoder 11y ago
  > The other thing that should be noted is that ansible feels like (shell scripting)++. Other competitors I've used needed a much heavier cognitive load to get started. Having used Chef, Puppet, and Ansible, this is exactly why I prefer Ansible for all my projects now. If you can write a shell script, you can write an Ansible playbook. It won't be a great playbook, and you get benefits from using their modules instead of shell commands (like idempotency). But you don't have to worry about learning a new DSL just to do write a basic playbook or tweak an existing one. As a functional programmer, I understand the benefits and appeal of declarative syntax. Unfortunately, systems programming is the one place where it's really hard to be 100% declarative, because systems are inherently all about state[0]. [0] At least in 2015 - perhaps things will change as we move toward better containerization models
  - makmanalp 11y ago
    And it's also not that it's just a /new/ DSL - every so often I find the DSLs annoyingly limited compared to having a full fledged programming language.
  - cies 11y ago
    > Having used Chef, Puppet, and Ansible The only comparable system that I believe is a match for Ansible is SaltStack. > As a functional programmer, I understand the benefits and appeal of declarative syntax. Unfortunately, systems programming is the one place where it's really hard to be 100% declarative, because systems are inherently all about state[0]. Have you looked into Nix/NixOS/NixOps? I think they have a really good approach to "functional configuration mgmt". > perhaps things will change as we move toward better containerization models I agree. When using scrappable VMs/containers (deploy to a new one, then scrap the old one) that are build from a description, it is in some ways quite close to approach in the Nix-camp.
luca_barbieri 11y ago
I'm using Ansible as well, but I'm not really sure that it's better than just using shell scripts. The problem of something like Ansible is that you have to do a web search to figure out how to do anything, rather than just writing the shell command you already know to do it. The only major advantage is that it can tell you whether a configuration step changed the machine or not in a standardized format, which is something that shell cannot do without manually writing the code to do so. Ansible in particular is also much slower than shell, since it seems to do a network roundtrip for each command. This is pretty surprising, since the #1 performance concern in writing such a tool is of course precisely not doing that.

geerlingguy 11y ago

1.9.0 includes convenient new gluster_volume and haproxy modules (among others) and will also update its DigitalOcean integration to use the v2 API shortly (in 1.9.1 - it's currently using the more annoying v1 API). If you want to use the latest and greatest, it's easy enough to set up Ansible from source. Otherwise, use brew, apt, yum, or pip (they're all up to date). P.S. 1.9.0 was released on Mar. 25th, I think there's an older thread on it somewhere around here.

UserRights 11y ago

Does there exist a good playbook for setting up a production-ready mailserver? Thanks!

ceejayoz 11y ago
"Production-ready mailserver" is horribly broad (for starters, outgoing mail or incoming mail?), but Ansible Galaxy has lots of mail-related roles. For example, Zabbix: https://galaxy.ansible.com/list#/roles/1879 https://galaxy.ansible.com/list#/roles/1879
- UserRights 11y ago
  zabbix is a monitoring solution, I am sure this sets up some kind of outgoing mail, but I was looking for a solution similar to iredmail.
  - ceejayoz 11y ago
    Sorry, I'm mixing it up with Zimbra. Too many weird names. I don't see an iredmail role, but having used Ansible previously, if you can install it chances are you can write an Ansible playbook for it.
UserRights 11y ago
BTW I found http://debops.org/ http://debops.org/ But still I think it would be a great idea to have a community playbook for critical things like mailservers where it is so easy to make a mistake and the fight against spammers is so hard to fight when you are only a small group of people or alone.
groks 11y ago
https://github.com/al3x/sovereign https://github.com/al3x/sovereign
- UserRights 11y ago
  THIS! thanks!

drinchev 11y ago

I'm really happy they now support "svc", part of D. J. Bernstein DaemonTools [1]. This one really is a killer feature, I'm excited to use. I'm far closer than ever to not use ssh on my server manually. 1 : http://cr.yp.to/daemontools.html http://cr.yp.to/daemontools.html

izolate 11y ago

I've learned with Ansible never to be quick to update. There's always something that will break. I've been on 1.7.2 for a while, and will probably think about updating later this year.

Sgoettschkes 11y ago
Strange, I have the exact opposite experience. I am running devel and update every half month or so and it usually just works.
meddlepal 11y ago
S3 module and something else was b0rked in this release that I ran into last week (can't remember atm). Very annoying.
- jimi_c 11y ago
  Yes, very sorry about that. The 1.9.1 rc1 will be out today, which will address this.

ynak 11y ago

Do they have any plans to support python3? I want to use it on Arch and Ubuntu. FAQ says they will address this issue by python3 becomes mainstream, but what does the mainstream exactly mean? When RHEL set python3 as default? Python2 maintenance continues until 2020, so seems have to wait for more several years.

jimi_c 11y ago
Hi ynak, we're planning on supporting py3 in the core engine with the v2 codebase. As for modules, we're still working on the best possible solution there, since we do need to continue supporting python 2.4 for the foreseeable future.
- Spiritus 11y ago
  Why would you need to support Python 2.4? Haven't that been dead for for like 10 years?
  - jimi_c 11y ago
    There are still a lot of RHEL/CentOS 5 users out there, which run python 2.4. While py3 is moving forward, the number of users stuck on 2.4 is still considerably larger, and we will continue to support that until such a time as it's no longer the case. In the meantime, we are exploring options so that we can help those on newer distributions work by default in the same way.
- ynak 11y ago
  Thank you for the reply. I'm looking forward to it.
CraigJPerry 11y ago
Those distributions have great dependency management, they will install the python 2 dependency when installing ansible
- berdario 11y ago

sheraz 11y ago

Love Ansible for its simplicity. For some reason it "just clicked" whereas I really struggled with Puppet / Chef / or old-school shell scripts. (That says more about me than Puppet and Chef) For me, YAML files and fantastic documentation made more sense than the DSLs of the other two. Currently we use it to setup our 12-factor app in production, staging, and development environments. (Django, Elasticsearch on Ubuntu)

gtirloni 11y ago

Nice maintenance release with a few improvements. I'd say the core of Ansible's brainpower is focused on v2 which will have significant changes (easily available today if you want to try, check the v2 dir).

bbrazil 11y ago

One of the changes hinted at here is that you can now specify that a task will always run using the 'always' tag - handy for things like ec2_facts which was a long requested feature (https://github.com/ansible/ansible/issues/3157 https://github.com/ansible/ansible/issues/3157)

A_COMPUTER 11y ago

Started using Ansible last year, I use it to create up to date base images for AWS autoscale groups and to quick set up personal development environments for other developers, and have playbooks for creating all my security groups so I can version control them. Highly recommended. I tried other tools but by far and away Ansible was the easiest to learn and use with no loss of functionality.

est 11y ago

OK I am gonna ask the obvious question here: How does Ansible compare to Saltstack?

michaelkrupp 11y ago
Ansible is much easier to get into. The more complex your requirements are (complexity of your infrastructure, services, etc) the less useful it becomes IMHO. SaltStack feels much more feature-complete and much more powerful to me. Also Ansible has no dependency-graph which sometimes makes it hard to modularize your "plays". On the other hand, SaltStack needs to be setup on the minions first, whereas with Ansible you only need SSH. I myself now use Ansible to bootstrap SaltStack and let SaltStack do the heavy lifting.
acveilleux 11y ago
My own experience, which is fairly limited, is that Ansible is much simpler, "agent-less" (it uploads code as needed and remote executes it over SSH) and a mix between declarative and imperative in nature (a lot of the modules require you to use semaphore files or equivalent for idempotence.) Orchestration is pretty much built-in, including rolling deployment/restarts. Performance can be lacking on large cluster due to the many network round trips and lack of agent. Agents can be faked by rsync'ing config and running ansible in local mode. You can use ansible to do it and ansible is a great Fabric replacement. Salt is much heavier to setup. Has explicit agents ("minions") and a server ("Salt master") whereas ansible can be run from anywhere as long as SSH connection exists. Salt maintains metadata ("grains") about the remote hosts, ansible gathers whatever data it needs on demand. Salt is heavy on the custom terminology and concepts. You have to work with the metaphors. Salt states are much more declarative. Both make use of YAML for a lot of things. My impression was that Ansible is a far better tool for smaller environments with, say, less then 20-50 hosts being managed and the learning curve is surprisingly shallow. When I got it to work, I had more difficulty getting Vagrant to like Ansible than Ansible to setup a complicated stack (Islandora for the curious.) The semi declarative nature of the Ansible modules was easy to work with but getting idempotence was actually a bit of a pain. I've not fully setup Salt because of the level of effort required. It's comparable to a full Chef setup.

arca_vorago 11y ago

Ansible is really great, but for reasons some people might not think about. Ansible has support for powershell, which is essentially now the backend of windows. (your new servers are gui-less right?) Powershell is also not a bad language at all, and while for those of us that are bash/zsh/fish natives, it will take some getting used to, I find it a really powerfull and more intuitive way to interact with windows, even if it is very overly majorly verbose-verbose. Being able to work in my very mixed environment (Solaris/OSX/Linux/Doze, etc) via a central ansible server group is awesome.

brunoqc 11y ago
Is it a problem for you that it requires PowerShell 3.0? I wish I could use ansible with all those XP workstation a work.
- arca_vorago 11y ago
  No it hasn't been a problem so far, just an update that gets pushed via the normal pre-ansible methods and requires a restart. Regarding XP... unless it's embedded get that shit outa there!
  - brunoqc 11y ago
    > Regarding XP... unless it's embedded get that shit outa there! We're also stuck with Windows Server 2003 for now :( I grew up thinking that the technology move so fast...

turingbook 11y ago

A comparison of notable free and open source configuration management software: http://en.wikipedia.org/wiki/Comparison_of_open-source_configuration_management_software http://en.wikipedia.org/wiki/Comparison_of_open-source_confi...