judo VS Ansible

I maintain two projects that I use daily for both work and personal stuff, that have attracted a modest, but appreciable amount of contributions. In both cases, the codebases are relatively small (500-1k sloc), and laser-focused on doing exactly one thing well.

I'm very grateful for every contribution, no matter how small - people have found bugs, fixed real problems, done cleanups. The hardest part is telling someone that a feature/idea does not have a place in this project. I think the general emphasis on minimalism tends to help here - I've never had to deal with any drama.

In terms of workload, again - the minimalist design and extremely clear goals have helped so much. I got trapped by that once before - I volunteered to build an internal automation tool (that saved someone else from doing like 1h/d of work), but literally couldn't spare 1h/mo to maintain it; the cause of the maintenance burden was an influx of changes in the APIs of the external services it integrated. So now I'm much more careful about volunteering to maintain integrations with external tools; in case of these two projects, the targets are SSH and ZFS - both have extremely stable interfaces.

In both cases it was absolutely worth it to publish and (very lightly) promote the projects; since these are "devops" tools that theoretically have unlimited potential for causing great harm, having any response at all helped reassure me that the code I'm running against production infrastructure has fewer unknown bugs. https://i.pinimg.com/474x/2f/e0/87/2fe08785e8eb112cada6da789...

The projects: <https://github.com/rollcat/judo>; <https://github.com/rollcat/zfs-autosnap>.

"This simple tool solves X at my org" is probably the most underrated type of project. There's not enough room to overcomplicate something that isn't a core part of the business, it must be practical to maintain, simple&stupid enough so that onboarding is not a hurdle, etc.

I encourage everyone to share your "splunk in 1kloc of Python" projects! Some of my own:

- https://github.com/rollcat/judo is Ansible without Python or YAML

- https://github.com/rollcat/zfs-autosnap manages rolling ZFS snapshots

I've written a minimalist replacement for Ansible. It started as a weekend hack, and I'm still using it daily after 7 years. Perhaps it's not technically impressive, but so wasn't the original UNIX, which served as a direct inspiration: how much work can you do with the simplest design and the least amount of code?

https://github.com/rollcat/judo

Ansible and YAML were my primary (de)motivators to create Judo (https://github.com/rollcat/judo). This combo is extremely frustrating: for every line in a (hypothetical) shell script that would do one thing, I needed 3-5 (sometimes many more) lines of YAML. Most people on the team who were just getting started with Ansible, would often do half of their work just shelling out. I would usually push to do things "the Ansible way", but even I had to acknowledge the mental overhead of translating back & forth. I think what finally pushed me over the edge was when we started venturing into compose & k8s, and had to mix & juggle YAML+Jinja in two entirely different contexts, each with its own quirks, bugs, gotchas and brain damage.

I figured I just need a layer of glue to run shell scripts across a bunch of remote hosts (hence Judo), and otherwise resort to other tooling (like Terraform, AWS CLI, k8s CLI, etc) for problems that don't map to SSH.

You're right, once an adversary gains physical access (or even remote access as your main login account), all bets are off. This is the area where the traditional UNIX security model has failed to adapt at all: you need a password to install a random game from apt (a vetted and trusted source), but you don't need a password to install a cryptolocker, or exfiltrate personal data.

However I like having a password (or some other form of confirmation), just so that I can stop to think for a second, whether what I'm about to do is a good idea.

What's annoying is that I effectively need two different policies on workstations and on servers, since I still want to be able to escalate privileges from maintenance scripts[1].

[1]: https://github.com/rollcat/judo/issues/9

Hi! I'm the author of judo - it seems like our projects share a lot in common, all the way down to implementation language and license ;) feel free to borrow some inspiration or solutions (e.g. master mode for SSH connections might be useful).

I wrote judo[1] because I was frustrated with Ansible. I wanted a very basic tool that could do 80% of the work in 1% of the code. It has one or two bugs, but I've been using it for personal and work stuff since 2016 and I'm not looking back.

[1]: https://github.com/rollcat/judo

Ansible is an open-source IT automation tool that simplifies application deployment, cloud provisioning, and configuration management across diverse environments. It uses a declarative language to describe the desired state of the system, and then takes the necessary actions to achieve that state. Ansible has become incredibly popular due to its simplicity, agentless architecture, and extensive community support. Document: ansible.com, ansible basics

Ansible v2.16

Ansible is a tool used to help manage software automation processes, configuration management across machines, deployment as well as remote execution of commands and scripts. In sports, Ansible operates as the coach of your team by providing strategies (playbooks), and actions, and ensuring the smooth execution of tasks across your infrastructure, just like a coach guides and directs players (Servers)during a game.

They support for-if from python, too: https://jinja.palletsprojects.com/en/3.1.x/templates/#loop-f... but I haven't tried the "recursive" keyword to know if ansible supports that. I say "ansible supports that" because they don't just drop jinja2 into ansible and call it a draw, they have a bunch of custom execution integrations: https://github.com/ansible/ansible/blob/v2.16.3/lib/ansible/...

To manage a VM, you can use something as simple as just manual actions over SSH, or can use tools like Ansible, Hashicorp's Packer and Terraform or other automations. For an app where there is minimal load and security/reliability concern, VMs are still a great option that provide a lot of value for the buck

In this article's context, it is simply a tool that provides a declarative way to automate your machine/OS to configure the development machine as you want (install package, modify the configuration, etc). Examples of these tools are Ansible, Puppet, etc.

Now we're getting more tangential, but for years, Ansible releases were named for Van Halen songs (see old Changelog here: https://github.com/ansible/ansible/blob/v1.8.4/CHANGELOG.md)

In the lab to follow, we'll quickly provision a 3-node kubeadm cluster (1 master, 2 workers) on the cloud provider of your choice using an automation stack comprised of OpenTofu and Ansible, then deploy Rook Ceph using the official Helm charts and confirm that we are now able to successfully create CSI volume snapshots from PVCs by reusing the MinIO example from our last article.