On 2015-01-11 09:22, Alan McKinnon wrote:
On 11/01/2015 09:46, Tomas Mozes wrote:
On 2015-01-10 23:11, Alan McKinnon wrote:
On 10/01/2015 21:40, Tomas Mozes wrote:
Ansible is a not a backup solution. You don't need to download your
/etc
from the machines because you deploy your /etc to machines via
ansible.
I was also thinking about putting /etc in git and then deploying it
but:
- on updates, will you update all configurations in all /etc repos?
- do you really want to keep all the information in git, is it
necessary?
The set of fileS in /etc/ managed by ansible is always a strict
subset
of everything in /etc
For that reason alone, it's a good idea to back up /etc anyway,
regardless of having a CM system in place. The smallest benefit is
knowing when things changed, by the cm SYSTEM or otherwise
For what reason?
For the simple reason that ansible is not the only system that can make
changes in /etc
And how does a workflow look like then? You commit changes to your git
repo of ansible. Then you deploy via ansible and check the /etc of
each
machine and commit a message that you changed something via ansible?
When you commit to the ansible repo, you are committing and tracking
changes to the *ansible* config. You are not tracking changes to /etc
on
the actual destination host, that is a separate problem altogether and
not directly related to the fact that ansible logs in and does various
s
You can make your workflow whatever makes sense to you.
The reason I'm recommending to keep all of /etc in it's own repo is
that
it's the simplest way to do it. /etc/ is a large mixture of
ansible-controlled files, sysadmin-controlled files, and other
arbitrary
files installed by the package manager. It's also not very big, around
10M or so typically. So you *could* manually add to a repo every file
you change manually, but that is error-prone and easy to forget.
Simpler
to just commit everything in /etc which gives you an independant record
of all changes over time. Have you ever dealt with a compliance
auditor?
An independant change record that is separate from the CM itself is a
feature that those fellows really like a lot.
Out of curiosity, "ansible-controlled files, sysadmin-controlled files"
means that something is managed via ansible and something is done
manually?
And then, /etc is not the only directory with changing files, what about
other directories?
Regarding the workflow with /etc in git vs ansible in git I was asking
about your concrete workflow so we can learn from it and maybe apply
some good practices on our servers as well.
