On Tuesday, December 9, 2014 at 2:49:39 AM UTC+1, David Fritzsche wrote: > > In my company we deploy almost all of our inhouse software inside jails > and > therefore I have developed a connection plugin "sshjail" that allows us to > use > a jail on a remote host as an Ansible host (addressed by jailname@host). > > To setup flexible test environments we want to use Ansible to create and > configure the jails up to the point where we can use our connection plugin > to > connect to the jail. One crucial part in the creation process is to setup > Python inside the jail. I created a patched version of the pkgng module > that > exposes pkg's --jail option as a "jail" parameter. See the pull request > https://github.com/ansible/ansible-modules-extras/pull/131 . This allows > me to > have a simple task that runs against the host and installs Python inside > the > jail. After that I can ran plays against the jail. > > Michael is unhappy with the idea of having a jail parameter in the pkgng > module and closed the pull request. >
Is this considered a closed issue, or open for debate? I've fairly recently started looking at ansible, and found this discussion (and the pull-request) because I'm looking to do things in exactly the way David Fritzsche describes. I'd like to elaborate a bit on why, hoping it can help convince people to consider the pull request again. FreeBSDs jails doesn't really force a specific way of using them upon you, you could have a single program use jail(), similar to the more common pattern of just using chroot(). For "fuller" jails, it's quite common to do a basic FreeBSD-install, and run basic services in the jail. You could easily run ssh in these jails, and use ansible like it was a "normal" system. Where Davids pull-request really comes in handy though (in my opinion at least), is for smaller service-jails, customer-specific ones, and so on. If you do a bare-bones install of the things you require for that specific service, customer or similar, it could more than double the size of the jail if you install python as well, and double the memory-footprint if you start ssh. If you have a couple of hundred of these jails running on one machine, it can be terribly inconvenient to have to run a couple of hundres ssh daemons as well, for the sole purpose of ansible reaching them, when you could use ssh to the host, and jexec your way to the jail, only when you're actually doing something with it. I get that I could use the jail-connector and run ansible locally on the host, but going down that route, you're starting to throw away some the very point (for me at least) of being able to separate an ansible-orchestration host from various service-hosts, etc. Terje -- You received this message because you are subscribed to the Google Groups "Ansible Project" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/da5543b5-6f65-4760-bf57-cf7f6f049109%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
