Score:1

Server

Practice of high frequency scheduled Ansible playbook runs

corvus-migratorius

7/2/24, 2:47 PM

I'm fairly new to administrating servers with configuration managers such as Ansible. I plan on running playbooks automatically on a schedule (via something like Ansible Semaphore, or even just Cron) with high frequency (like every 30 minutes or so).

I'm hoping to achieve two goals with this approach:

Enforce configuration (so I can be confident that no deviation from the expected configuration exists for long);
Detect any such deviation and investigate it (since Ansible reports changes for each task).

Is this a normal and/or recommended approach (I wasn't able to find authoritative sources on the best practices in this regard)?

If not, why, — and what would be a better way to achieve my goals?

Thank you!

118

1 + 2

automation

scheduled-task

configuration-management

best-practices

ansible

Vladimir Botka

7/2/24, 7:29 PM

See [UBUNTU20-CIS](https://github.com/ansible-lockdown/UBUNTU20-CIS) for an example of configuring and auditing systems. Use [ansible-runner](https://ansible.readthedocs.io/projects/runner/en/stable/) to schedule the playbooks on your own. See the [example](https://ansible-runner-role.readthedocs.io/en/latest/example1-cron.html).

corvus-migratorius

7/7/24, 10:34 AM

@VladimirBotka, thanks a lot for the helpful recommendations. Especially for mentioning CIS configuration. Now I know what my next project will be =)

Score:0

Server

U880D

7/2/24, 5:46 PM

Ansible AWX and Ansible Tower, both have the capability to Schedule Job Templates.

Since Ansible Managed Nodes are agent-less, Ansible pushes the configuration which is described with a playbook from the Control Node onto the Remote Nodes. Therefore you need at least to consider

How long will the runtime for my playbook be?
How many nodes should become configured and the configuration enforced?
What could be resource constrains like network bandwith, hops, latency, utilization, etc.?

but that should be the same for any other product.

You could start with reviewing Task engine built on top of Ansible (AWX) and read further about Ansible Tower for Configuration Drift or Control with Ansible Tower. And also do not miss the comment from Vladimir Botka about

UBUNTU20-CIS for an example of configuring and auditing systems. Use ansible-runner to schedule the playbooks on your own. See the Example.

+ 5

FiftiN

7/3/24, 8:57 AM

AWX too complex for this task, Semaphore better choice.

Semicolon

7/5/24, 1:19 PM

Agree - the runtime of the playbook in question is usually the biggest limiting factor for determining how frequently the playbook can be re-run.

corvus-migratorius

7/7/24, 10:36 AM

Thanks a lot! So, just to clarify, in a server environment, it's A-okay to run playbooks as often as possible based on the observed execution time (plus some margin, of course)?

U880D

7/7/24, 10:48 AM

Yes, of course. See in example [Control with Ansible Tower](https://www.ansible.com/blog/control-with-ansible-tower-part-1) to prevent Configuration Drift or [Ansible Tower for Configuration Drift](https://stackoverflow.com/a/71251713/6771046).

corvus-migratorius

7/9/24, 3:46 PM

@U880D Don't have enough reputation to upvote anything, but I'm certainly grateful for your help! Cheers!

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Practice of high frequency scheduled Ansible playbook runs

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.