case study: ansible and nasa

CASE STUDIES: NASA AND FRIENDS

Greg DeKoenigsberg (@gregdek)

GOOD MORNING!(Who are you?)

THIS IS A TALK FOR BUSINESS FOLKS(But we can go anywhere you like!)

ANSIBLE USERS HAVE A LOT OF USE CASESLet's talk about a few of them today.

WHAT IS ANSIBLE, ANYWAY?

CONFIGURATION MANAGEMENTKinda like Puppet / Chef

ORCHESTRATIONKinda like mCollective

APPLICATION DEPLOYMENTKinda like... Fabric / Capistrano

ALL OF THESE THINGS TOGETHERKinda like... nothing

\"FANCY SSH FOR-LOOP\"

NEXT GENERATION AUTOMATION FRAMEWORK

SIMPLE(Get started on your lunch hour)

AGENTLESS(Got ssh? Ansible is for you)

POWERFUL(Batteries included)

BINCKBANK

About BinckBank

Based in Amsterdam, NL

Largest Dutch online discount broker

590 employees

760,000+ accounts

600 UNIX servers

Mark Maas, UNIX/Linux System Administrator

THE CHALLENGE

We have 600 UNIX servers in house. We have a lot of specialtyenvironments that we need to create while at the same time

managing our production environment.

Our problem was complexity in the datacenter. We wantedautomation but we also wanted simplicity and to not have to send

people to training in order to use the product.

BEFORE ANSIBLE

In the past we did our own scripting for menial tasks over a lot oflate nights of pizza.

WITH ANSIBLE

Ansible is quite fun to use right away-—as soon as you write fivelines of code it works.

With SSH and Ansible I can send commands to 500 serverswithout having even used the servers before.

We are completely focused on automating as much as possible inour datacenter and going beyond Unix to create more stuff for

more people to do be able to do more.

MOVING FORWARD

Recently I purchased a license for Ansible Tower. I would like togive non-technical users access to it and open up the technicalside to people who have no idea what I am talking about. With

Tower, my Linux guys can access our templates without having todo any coding. Tower opens up Ansible to the rest of company.

HOOTSUITE

About HootSuite

Based in Vancouver, BC, Canada

Social media management

~400 employees

Over 8 million users

75% of Fortune 500 uses HootSuite

Beier Cai, Director of Technology

THE CHALLENGE

Our infrastructure is not scripted, repeatable or immutable.

Rebuilding a server relies on limited documentation and mostlymemory.

Lack of repeatability makes automating our infrastructure andapplication deployment difficult.

There was one time we had to spend over a month of anengineer’s time to rebuild a server that had lived for 2 years with

random config changes by ops engineers along the way, withlimited documentation.

BEFORE ANSIBLE

We had limited experience with Puppet, but didn’t quite like itbecause 1) it needs agents, and we don’t like agents; and 2) wefavor immutability over snowflake factory for infrastructure

management.

WITH ANSIBLE

Ops and devs both feel safer, literally. Before they were alwaysworried about ‘what if the server dies’. They aren’t worried about

this anymore after all servers are properly ‘Ansiblized’.

With the help of Vagrant we can test server builds locally asmany times as we want until it works, instead of testing it on EC2

cloud which is remote and always slow.

Increase our bus factor from 1 to infinite! Before, only 1 or 2people know how a server was built from the beginning. With

Ansible, storing playbooks in source control gives everyone theability to rebuild the server at any time.

MOVING FORWARD

We want to build out "Devops" into HootSuite, and our vision is"Software Engineers are engaged in the entire cycle of designing,implementing, deploying and maintaining their software across

all environments".

NASA

About NASA

They put men on the freaking moon

About NASA WESTprime

WESTPrime == Web Enterprise Service Technologies prime

Blanket purchase agreement funded by NASA

Contracted to InfoZen Inc., a cloud broker and integratorbased in Rockville, MD

InfoZen responsible for entire cloud migration for all NASAweb assets

Jonathan Davila, Senior DevOps Lead, InfoZen

THE CHALLENGE

WESTPrime’s initial focus was to move roughly 65 applicationsoff the old data center as quickly as possible in a seemingly

impossible timeline.

All of a sudden we had an environment spanning multiple VPCsand AWS accounts with no way of centrally managing it.

We were faced with a very ugly scenario where even simplethings like ensuring every SysAdmin had access to every server,

or simple patching were extremely burdensome.

BEFORE ANSIBLE

Previously, NASA WESTPrime was using a lot of shell scripts.There was a lot of "manually ssh-in-and-do-x" type of work being

done.

We then created a demo day in which we invited the automationplayers to demonstrate the enterprise flavors of their product.

After quite a long day of deep level demos and Q&A, and a weekof analysis with the technical team we decided unanimously that

Ansible was the best fit for us.

Why?

No agents

Very small learning curve (a day or less!)

Non-technical staff can read a play and know what's happening

Native use of SSH

The most active open source community among itscompetitors

WITH ANSIBLE

NASA web app servers are being patched routinely andautomatically through Tower with a very simple 10-line Ansible

playbook.

Every single week www.nasa.gov is updated via Ansible,generally only taking about 5 minutes to do, including the mobile

version of nasa.gov.

Because of Ansible we are able to organize our inventory of AWSresources in a very granular way that was not at all possible

before.

One time we faced some strict deadlines for monitoring and wedidn’t have time to deploy Nagios agents (due to lengthy approval

workflows in place) to monitor RAM and CPU. So what did wedo? We did a very simple hack to be able to monitor CPU and

RAM with Ansible in near real-time (no agent required!).

Ansible was leveraged to remediate both OpenSSL issues thisyear in ridiculous time (leadership was blown away).

It is also used to ensure our environment is compliant withnecessary Federal security standards as outlined by FedRAMP

and other regulatory requirements.

There is a level of comfort and confidence that Ansible has beenable to provide that simply was not there before.

MOVING FORWARD

We are working on moving many applications into cycles ofContinuous Integration and Deployment, which will be

leveraging Ansible as the conductor of these architectures.

The moment 1.7 is released, Ansible will be used to manage ourstack of Windows servers and do the same magic we've been

doing with Linux.

The end goal will be for our sysadmins to only need toSSH/WINRM into servers manually for troubleshooting. Allserver changes will eventually happen exclusively through

Ansible (and the occasional CloudFormation tempate).

A TWEET BEFORE WE GO

Adam Werewolf (@adamwwolf)

I use @ansible to do just about everything. If you say "I don't havetime to set it up" you're who it's for--you don't have time *not* to.

11:20 AM - 21 Oct 2014

https://twitter.com/adamwwolf/status/524626206470053889

THE WORLD IS CHANGING

THANKS / Q+Agreg@ansible.com

@gregdek