Hacker News Reader

Comment by encryptluks2 | Hacker News Reader

Pretty cool but Ansible just seems too slow to me. I'm just comparing this against like native scripting, Terraform, etc. I guess Ansible is still the best option for configuration management, but I keep hoping someone will come out with a new tool, preferably built with Go or Rust.

View on HN

While I don't have any hard numbers, I would bet a lot of money that any "slowness" of ansible has nothing to do with the use of Python. Everything happens over SSH, that's a lot of network roundtrips.

Indeed. See saltstack for something that does the same thing, witten in python that runs much faster.

SSH can be quicker, I believe ansibles use of SSH processes is more the issue. An old but still relevant benchmark exists in my pyinfra project which uses SSH (amongst other protocols) but a Python implementation, and its significantly quicker and more scalable than ansible: http://docs.pyinfra.com/en/1.x/performance.html

> I guess Ansible is still the best option for configuration management

Ansible is perhaps the worst option, next to CFEngine and some other legacy ones. It's just the one everyone goes for because nobody wants to maintain a puppet/chef/salt/etc server, and encoding a bastardized DSL in YAML seems easier than writing Ruby.

I run Mitogen which makes it super fast. There was some discussion of merging them. But the Ansible side got all grumpy and refused. It was a bad decision, because it hurts Ansible being so slow.

I wrote a proof-of-concept tool, inspired by puppet more than anything, but since it runs locally it is perhaps comparable to ansible too:

https://github.com/skx/marionette/

It turns out that three operations suffice for almost 90% of my needs:

* Populate a file, from a template with variable expansion.

* Run a shell-command.

* Install a package.

I added support for pulling a docker container too, just for fun. Although I never made the effort to pimp/promote it, the tool is stable and useful as-is.

I doubt building ansible in go or rust we save more than a few ms in the average playbook run.

Um, you've seen https://github.com/purpleidea/mgmt/ right ;) Join us!

Red Hatters keep leaving the company and building config management tools =D.

For mgmt, I don't see anything particularly novel that it brings to the space. It doesnt use YAML, but if I'm going to write pseudocode I may as well reach for Pulumi or python. Why would you recommend mgmt over Ansible or Terraform? Since this can use Consul, why wouldn't I just use Consul for event driven changes?

Puthon doesn't seem to be the performance issue here, but remote operations on target hosts.

salt has been great for me. SSH is just so slow compared to always on zeromq

Maybe, but I feel safe exposing openssh to the open internet, which is more than I can say for salt.

In properly set up environment things like that should never been exposed outside.

Not every environment can provide an internal network.

Actually you always have an option to properly secure.

If you have own data center and more than one machine you do have a LAN.

I'm guessing you're talking about public cloud like AWS.

Similarly you can have private subnets (which is the best practice).

If you have a single instance that's only public, you can place definitions on local S3 and have instance pull it. You can secure everything so it's not accessible from outside, and you don't need service to be available from the outside.

If you have multiple instances and all are on public subnets and talk to each other over the Internet, you should rethink your design, but at very least have firewall configured. Security groups that list themselves could help.

Let me know if you have some other scenario.

In a word: Hetzner. Dedicated servers scattered across data centers, sufficiently numerous to make IPAM too painful to manually tie them together with wireguard. It's possible that some sort of overlay network or VPN could be made to work, but I could also just expose port 22 with only public key auth enabled, use ansible, and be done.

I never used Hetzner but based on my research, Hetzner says that they only have 3 data centers:

- Nuremberg, Germany

- Falkenstein/Vogtland, Germany

- Helsinki, Finland

so you could place 3 instances, one in each and would have to use public IP to communicate between them.

But, Hetzner also offers Cloud Network, which is essentially a LAN that you should prefer for communicating.

Anyway, whatever works for you, using Ansible is easier, because doesn't require any prior setup, but you pay that back with worse experience keeping things running and slower speed.

mgmt config is written in go and has a lot of interesting concepts.

Thanks for looking out for us =D Link for any who's interested: https://github.com/purpleidea/mgmt/ I and others have been working quite hard on it, so please come join us =D

Hey there, I've been following "mgmt" for years, hoping it was going to be the next big thing. I did see a while ago that you made a significant investment in developing mgmt full-time but then didn't see much news out of the community afterwards.

I'm curious whether there's a status update you could provide? I'd love to get involved as I think it truly represents a next generation style config management system, but I also had fears it was dead in the water or not being actively developed!

Reply on news.ycombinator.com