Hacker News Reader

Comment by devy | Hacker News Reader

I have not been a big fan of Ansible due to some critical bugs (at least in 1.x) and the way how its community core committers are treating community requests like this.

For one: Ansible 1.x cannot even print out the syntax error file and line number in the offending Playbook. [1] And their core committers ignored the issue and refuse to backport the basic debugging requirement after issue being opened 2 years.

That itself, is a deal breaker for me.

[1]: https://github.com/ansible/ansible/issues/5797

Edit: Downvoting me doesn't make this issue go away. What was requested is a simple basic debugging requirement - any mature syntax tree parsers should be able to do it.

View on HN

disclaimer: i'm an ansible dev.

As the ticket shows, this was added in the 2.x release of Ansible, that is why the ticket was closed.

Adding this info required a major revamp of the parser, which we did in 2.x, for this and many other reasons. This is not a simple change in 1.x and we decided not to backport it.

Could you? Tons and tons of companies are forced into using outdated versions (for tons of reasons) where point release updates are still possible.

I'm sure it's a lot of work, but a lot of your core and original users would appreciate it. Not implementing something as useful as that just has a "we got 'em, no need to do anything else for them" vibe.

> Tons and tons of companies are forced into using outdated versions (for tons of reasons) where point release updates are still possible.

Exactly my point! Ansible devs should own up to it for admitting their BAD design choice (I heard someone from here saying intentionally not use a parser but use YAML.) of not being able to get syntax error file name + line number!

My story was that debugging ansible playbook with loads of nonsense cryptic error messages due to syntax errors that I have to spent hours to figure out what went wrong was a complete frustration. It was so bad that we eventually re-designed our infrastructure to cut out Ansible and never look back again. So much for Ansible 2.x that it doesn't even matter. Ansible lost its appeal in 1.x, and that's it. No more 2.x upgrades.

Lesson learned here is that if a young software tools got adopted but early version caused so many frustrations that the authors don't care about back-porting bugfixes, all future version becomes irrelevant.

It's gotten so bad with these sorts of tools with their incredibly annoying design flaws that I've been debating creating my own using rpm and ssh on top of bash with some python.

I get why it's important to have a lot of the features, but when the devops crowd thinks [0] is acceptable (or at the very least, doesn't scream about it), then it might be time for something new.. with [1] in mind.

  [0] $ man salt 2>/dev/null | wc -l
  140905

[1] https://xkcd.com/927/

Which design flaws are you referring to? As a recent Salt convert (and Puppet expert), I was perplexed as to why such a nice tool would have a man page 40x longer than bash.

Turns out it includes extensive documentation for all states supported by Salt, generated from the online documentation. Compare this to the Puppet manual:

    $ man puppet
    PUPPET(8)                Puppet manual                         PUPPET(8)

    NAME
       puppet

       See ´puppet help´ for help on available puppet subcommands

Obviously no-one will be using everything that Salt supports, so it would be nice if it was broken into sub-sections. But I much prefer having all documentation available in a manual to looping through every module and run "rdoc" as in the Puppet case.

Any sufficiently popular configuration management tool will have equally long documentation.

There are a couple of simpler options available:

http://www.nico.schottelius.org/software/cdist/

https://github.com/brandonhilkert/fucking_shell_scripts

"Design flaw" might not be right description. Maybe, "Naive implementations with nearly useless documentation" is better.

When I first started using puppet, I would go home absolutely exhausted every night. Their design choices, along with a lack of documentation, would turn the equivalent of a 20 minute bash script into something that would take days. Best example I can think of is the arbitrary ordering of module execution. I understand why they do it this way, but if they documented it in plain sight, then maybe my desk wouldn't have a forehead shaped dent in it. Similar goes for the other tools.

The only thing I can think of that prevents companies from releasing proper documentation is because of their expensive support contracts. There's a lot of incentive to make a standard incredibly difficult.

I just want accessible tools :(

edit: fss looks pretty neat! Kinda rpm-y, but it fits a nice middle ground.

I get your sentiment. I only started using Salt some months ago, but it was really a breath of fresh air compared to Puppet. However it took me a while to realize its true strengths since the documentation is very...dry.

IIRC Ansible, like Chef, does serial execution. That is, states are applied in the order they are written. I think that's part of the reason it has gotten so popular, as you'll have very few surprises in the vein of "what do you mean there is no ntp_service -- it's right there next to the config declaration!".

What Salt got right is the pillar, for which the Puppet equivalent (Hiera) was an afterthought. The Salt engine allows you to generate states from the pillar, rather than making poor clones of Puppet modules (as most of the formulas I've seen online).

However that flexibility is not documented anywhere, nor part of best practices. Nevertheless I'm about to release a set of formulas that are truly pillar-driven with no hard-coded stuff. Keep an eye out for the accompanying blog post :)

Of course, if you don't care about data/code separation and just want to get stuff done, there are better tools. And if you have full control of your environment, I would strongly suggest using Guix and/or Nix rather than these legacy configuration management tools.

I actually really like salt, just not its documentation. Like you said - it was a breath of fresh air. :)

Last time I used it a few months ago, it was while helping out another admin. He had a lot of confusion on how to do certain things, and the documentation wasn't very helpful for either of us. The solution came from github, which has become my go-to for these sorts of tools. Though, that could easily be supplemented with some better examples on their site, or in their, erm, man page.

I doubt we'll have some great tools with great documentation anytime soon (or monitoring tools!), but a sysadmin can dream... :)

Although it's cool you guys fixed it - thank you for that - those of us sitting out in RedHat land may not see 2.1 sitting on EPEL for a very long time. So it's a legit request.

its in 2.0, which is available on RHEL

Ah ok if it's in 2.0 then you're right! I thought it was exclusive to 2.1.

>any mature syntax tree parsers should be able to do it.

Well thats' just it, I don't think they use such a parser.

I always thought that's why they use YAML as their input language, to avoid having to write a parser,

I like many things about Ansible, but the 'language' is an unreadable mess that makes termcap[1] feel like genius level UX design.

[1] https://www.freebsd.org/cgi/man.cgi?query=termcap&sektion=5 (Also known in my day as 'turdcap'.)

RE: "I like many things about Ansible, but the 'language' is an unreadable mess that makes termcap[1] feel like genius level UX design."

I've been a puppet user, and long time chef user, and recently been using ansible for a couple of projects, but I can't learn to like the 'language' at all. I feel like ansibles YAML syntax is just hiding the complexity of configuration management from you. Which at first as a novice ansible and CM user, or for small projects is great! You can be super productive, and anyone can understand it in your team.

However, as your systems get more complex, I feel like doing anything remotely complex with it produces confusing, hacky, unreadable ansible 'code'. Then you try to scale this working in a team, and try to do any useful testing, or re-use/extend/share any roles, your kind of doomed.

The reason I continue to use chef is because its a ruby DSL that you can easily extend, where anyone who can code; can write, test and understand. While I find Ansible is just templated YAML, and means you dont have to understand how to program.

I guess my point is, configuration management is kind of hard. I feel like people use Ansible because 'its easy', and I hear people say 'Ansible is easy' a lot. But in the end, Ansible, the tool chain, workflows and syntax will become just as complex as chef/puppet/saltstack when you operate it at scale.

I think we have to distinguish two things going on in Ansible files.

1) It's declarative. So if you are looking for a procedural language, you will be disappointed. It's also declarative for good reason IMHO.

2) It's still hacky. If the 'language' remained entirely declarative then the YAML syntax _might_ have been ok, but the language looks like a poor design stretched beyond it's limits.

Some people don't like the Ansible language for reason 1 or some for reason 2.

Personally, I prefer that it's declarative, the file is supposed to describe the features the target system must have, and then the module, which is procedural, has to figure out how to make that happen on whatever target system is in question.

That separation keeps things clean, idempotent (most times) and neat.

I think procedural approaches _seem_ better because they are familiar to programmers, but they can become complex, non-idempotent and hard to debug.

I've used Ansible quite a bit, and I could sometimes sum it up as, "the worst one, except for its alternatives".

I tend to think of Ansible as supporting a flexible combination of declarative and procedural approaches. Within a particular sequence of tasks, it's procedural. Those lists of tasks are typically combined into a role or the like that is typically more declarative in its application. Of course application of roles is actually procedural in that it happens in the same obvious order it's defined, but the higher level organizational constructs like roles have more of a declarative feel to me (I'd assume that's by design).

Ansible has none of the things that make declarative languages good, though. Good Declarative languages allow composition - Having a base object, adding properties to it, overriding others. Ansible handles none of that in it's playbook syntax or it's vars syntax. In the role and module syntax, sure, but they're turing complete anyway.

I agree that it's crufty.

If I were them I'd sunset the old syntax in the next version, create a conversion tool that works for 90% of cases and then drop support for the old file format.

But that's what I would do, and it would probably kill the project.

As soon as people can't cut and paste Ansible 1.x roles from github into their project, Ansible would probably start to wither.[1]

That's the typical workflow. You need to do something on your linux box. You google that, find a decent Ansible solution, cut and paste a few text files maybe modify it a bit and repeat.

[1] And this s another reason declarative syntax is so awesome, because it's easy to snap roles together like lego bricks.

Every time I let the config management stuff slide slowly towards procedural, bad things have happened.

You want your config management templates to be as declarative as possible. "This is the desired final state", and that's it. Of course, in practice it's very hard to stay 100% declarative, but it's very good practice to try and keep it close to ideal.

Agreed, this is a great way to think about it. I think Ansible is at its best when the modules handle the imperative stuff behind the scenes, and the playbook just declares. That's not always possible, but the modules are getting better and better.

FWIW I also found YAML to be very confusing syntactically at first; things got easier once I realized that it's basically 1-to-1 with JSON, and could convert to JSON to get intuition for the file structure (simple yaml2json script here: http://pastebin.com/TpjZLnLa). Thumbing through the book Ansible Up and Running also helped.

In the long run, putting a declarative idempotent layer atop the same old mutable infra is tough but a necessary compromise right now. It'll be great if the immutable-first tools of today (nixos et al) mature and we can leave this behind.

I speculate that Ansible choose YAML under the premise that it would lower the barrier to entry as opposed to a real language like Python or whatever. That would be nice if everything were just a matter of configurations, in which case YAML would be just as good as JSON, if not better.

The problem is that because people want logic, Ansible ended up introducing an idiosyncratic YAML-templating language that's not actually YAML or anything else. Now people write large system deployment scripts in this weird YAML that I don't ever want to look at.

JSON is crap for configuration. Its picky with quotes, doesn't like trailing commas, and isn't as readable as other options.

JSON is the example, not the prescription; JSON is just a widely used format for arbitrarily nested data. You can use Javascript objects (or Python dictionaries) if you want. Again, this example applies for the scenario if Ansible playbooks were only configurations. If it were only configurations, then fine, let's go with readable YAML.

If Ansible were playbooks with only configurations, then even XML would be okay, because in the sum of all pros and cons, this would be a tiny factor. The pickiness of quotes and trailing commas is really whatever here.

But instead Ansible playbooks use a "readable" YAML-ish language. The price is not right.

When it's that easy then implement it yourself and make a PR to Ansible ;)

Apparently it's NOT easy to implement according to Ansible dev above.

It's also not that easy to get PRs accepted.

Reply on news.ycombinator.com