Red Hat Ansible Automation Platform Reviews

I am the section manager for the open system section in a county. We provide support for Red Hat Enterprise Linux, the IBM AIX platform, and, of course, Ansible Tower.

Ansible Tower was brought in to automate a lot of endpoint security software. We have an entire process where we bring up virtual machines on the x86 environment. Every time we brought up a Linux or Windows virtual machine, all the endpoint software needed to be installed after the fact by the necessary groups. That was taking a long time. If we have ten machines pop up today, going to all ten machines and installing five different endpoint security tools takes a while. Ansible helped in adding Ansible playbooks into the workflow. Now, when someone clicks and says that I want a Linux machine and provides all the information, then in the end, it spins up the machine automatically and uses Ansible Playbooks to install all the necessary pieces of software. It then gives a login and the necessary passwords for the customer to log in and start working. We now know that every time we deploy, all our endpoint security products are installed and ready to go.

The benefit is in terms of time-saving. There is more time for our team to worry about and take care of other engineering work than worrying about installing endpoints. Also, our Oracle database team is working on Ansible Playbooks to automate patching, which takes a long time to plan and do, especially in the production workloads. We are working very closely with that group.

We also work with the backup group to see how we can automate the day-to-day mundane processes. All these aspects bring us a lot of value. We are saving time, and we can also restructure and understand our necessity to have extra people on the team. We can cut down costs on that. We can reorganize ourselves to focus on much better technology, such as AI and things like that, instead of wasting time doing manual processes.

It has helped us achieve our mission. It helps to reduce the workforce and manage the time of our existing workforce. They can be more involved in new technologies such as AI. Understanding them takes time. They save a lot of time with automation.

We use other Red Hat products. We use OpenShift. When containers started taking off, which was about six to seven years ago, the government sector did not want to go into the cloud and use AWS containers. However, in our county, the customers were demanding that. They were saying that their applications are modernizing and we need to provide them with a container environment. That is when we decided to go for it. Because we were already Red Hat customers and we have been running Red Hat Enterprise Linux since 4.x, we decided to go for OpenShift. It was the same platform, and they were offering manageable containers. That is how we brought in the container platform. It is rock-solid. We had it on-prem. We have moved it to AWS, and it is great. The new thing is OpenShift Container Platform Plus which comes with a slew of additional tools. These tools help us provide the necessary application infrastructure for containers for customers.

We have Red Hat Enterprise Linux and OCP running in AWS.

It takes away a lot of work. For example, if you have five security products to install, you install the first one, test it, and make sure it works. You then install the second one, the third one, and the fourth one, and then something happens. Something breaks. All that is taken away because we have foolproof systems built into our playbooks. There is also a continuous workflow from the start until the end.

With Ansible Tower, the automation methodology is simple. There is ease of learning. It definitely reduces the training required to learn how to automate things for technical folks. It is much easier than writing bash scripts. This reduced training affects our operations or business. For example, if security folks come and say that they need to write a bash script that will go into their workflow to install, uninstall, and upgrade agents, that is a lot easier to do with Ansible Playbooks.

It helps to bring teams together. Black lines between the operations, security, and other teams are going away. Those lines are becoming more gray and light gray. There are DevOps and SecOps, and even finance is becoming FinOps. It definitely helps teams come together, and then we try our best to guide the teams, whether it is the Oracle team or security team, so that eventually they will learn to do their own playbooks. We can always be the guardrails.

It increases productivity, saves time, and even saves the cost of people working after hours trying to get these things going. It is all in the workflow.

It has definitely helped to reduce the time we spend on low-value or repetitive tasks. There is a huge difference. About 20% of my staff's time is saved. They do not have to worry about things. Once you set it, you can forget it unless there is a change or there is something different. For example, the security group comes and says that they have stopped using the Cisco product. They are using some other vendor's endpoint security. In such a case, all we have to do is change those variables, and we are done. Previously, we had to go back, use the Windows uninstall program and reinstall. This is much easier.

We are primarily using it to update OpenShift as well as managing more than 800 Windows servers and about 50 Linux or Red Hat Enterprise Linux servers.

The main benefits are reducing server configuration drift and building new servers or updating software on servers in a very consistent way.

My team manages all of the server platforms. We are the middleware team. We support EAP, OpenShift, and the whole gambit. Being able to consistently configure those machines and the software on those machines so that the applications run in a consistent way, good or bad, is key. Even if it is bad, at least it is done consistently. We can pinpoint the problem, make changes from the playbook, and reapply it. We can get it corrected in a very consistent manner, and we do not actively skip a host. If somebody is manually making changes, we know where that goes.

I would rate Ansible Automation Platform very highly for helping to reduce the number of steps involved in automating things. After you develop your playbook, that playbook consistently runs, and the playbooks are not difficult at all. Once you understand how Ansible works, it is straightforward. Even on a Windows platform, it is not difficult at all. However, writing new roles is a different story. I have written a couple of those. I have about a dozen or so custom roles written in PowerShell to run on Windows. Even for that, the documentation was not bad.

Ansible Automation Platform can help reduce the training required to learn how to automate things. I can give somebody a playbook, and if the author of that playbook follows our standards of documentation, it eases that quite a bit. However, we have some playbooks that are pretty complicated. In those cases, they have to understand what it is doing under the covers. Onboarding to Ansible is pretty straightforward once you get the handle on what tasks are there and what to do in the pretask and the roles. Once you grasp that concept, especially the concept that every task and every playbook will run concurrently on every host which is a hard one for people to grasp, it makes a lot of sense. This reduced training has affected our operations or business.

We use the platform's collection of certified content. It is very good. We can find things easily for Red Hat Enterprise Linux. If we find something for Red Hat Enterprise Linux but cannot find it for Windows, we will model the Red Hat Enterprise Linux version to create one for Windows.

Ansible Automation Platform has helped to reduce the time we spend on low-value or repetitive tasks. I can give a good example of that. We are also a Dynatrace shop, so we have set up monitors for our certificates on our servers. Dynatrace is alerting us when certificates are 30 days out. We have not yet hooked it up to the automation platform, but the next step is to do that. It is going to run the playbooks that are already there to renew those certificates. After that, we are going to integrate it with ServiceNow to open a ticket when it does that and close the ticket once it succeeds. We are moving down that path, but we are not quite there yet. As an example, we have to renew every single certificate in about three months. I have one playbook that we can run across all of our servers. Regardless of the type of application that is on that server, that playbook will renew the certificate from our certificate server. We will download the certificate to the machine, implement it in Windows, export it from Windows, convert it to the format that the application needs, be it a key store or a PIM file, load it into the application store, and then restart the process of that target application. If you try to do that by hand, you can just forget it.

Our use cases are related to system compliance, package management, system patching, and general infrastructure and security as a code.

We can easily remediate a lot of the routine tasks or even break-fix issues that keep coming up. It could be a simple break for which we do not have a root cause analysis for a proper solution, but it keeps coming up. We can easily remediate such issues and have those not impact workflows for our developers while we work on a full solution in the backend. It also helps with the general tasks of maintaining systems or correcting them when things get out of line. We are able to deploy things at scale versus having someone there. Their time is much more valuable. They do not have to spend five or ten minutes here or there throughout the day when they can be focused on a more dedicated effort elsewhere.

It helps us achieve our mission because we want to enable our researchers and developers to have an ecosystem that allows them to do what they need but in a secure environment. We want to protect system information, data, and IPs. We want to be able to do that at scale, quickly roll out changes, and maintain systems as needed for compliance. We want to allow all that holistically for our groups to manage. It has helped us with workflows to help expedite that process.

We also use other Red Hat products. We use Satellite and IDM, and we are moving towards AAP and EDA. We chose these products to help manage our infrastructure. Because we are managing Linux systems, we want everything to work and play with each other as well as they can. We are adopting the same ecosystem. Choosing Red Hat products allows us to do that with the most reliability, and we also get support from the experts who built the programs themselves. If anything were to go wrong, we have that backup of people who are dedicated to helping us find the solution for it. With multiple Red Hat products, we have interoperability. We are able to spread across different teams. If we standardize our process on the same products and the same technologies, it means we can train other departments and other groups to manage their own piece of the pie. If they have many different products, the only people who would know how to work with a product are the ones who are dedicated to working with that product, whereas if we standardize on the same kind of ecosystem, it is easier to cross-train on that.

It does a good job because the whole syntax is human-readable, and it is YAML. While it has its quirks, it is pretty straightforward. Generating playbooks, tasks, modules, and other things is pretty easy. Even the plugins are Python-based, so it is an easy language and it is near readable for Python, whereas, trying to make scripts for something or code in different languages is very tedious. You need people who are experts in making that deployable and handling any unexpected outcomes or different conditions that may cause issues, so having something that is easy and straightforward to learn and that handles all of the guesswork on the backend makes it much easier to develop automation.

It helps reduce the training required to learn how to automate things. It is a very easy language to learn, and it is not like learning an entire programming language.

It helps connect teams, such as developers, operations, or security so that they can automate together. Developers and operations definitely work hand in hand. Introducing infrastructure as a code or security as a code when they have not adopted that mindset can be difficult. They definitely agree with the concept but getting them to work and manage their own playbooks is a little bit more difficult because not everyone is intrinsically interested in coding even if it is a simple language. However, being able to have the partnership to say that we can help them out and they have a readable syntax is helpful. They can clearly see what is going on. It helps them a lot in understanding what is going on in the backend. We are becoming more and more productive as we get more products involved and more people on board with developing and adopting their own respective departments as code, such as infrastructure, security, IT, and anything else that we may have in the pipeline.

Its collection of certified content helps out a lot. We are able to pull certified content and then use it within whatever we are trying to deploy. Everything essentially works with whatever we are trying to deploy. If it does not work, we know that it is something on our end. It helps out with identifying known goods and then working from there.

It helps to reduce the time we spend on low-value or repetitive tasks. It has taken off about 45% of my workload from tedious tasks.

We use it for firewall upgrades and backups. That is pretty much it for now because it has been only a year.

Ansible Automation Platform has saved a lot of time, man-hours, and money. Specifically for the upgrades, there have been a lot of time savings.

It keeps us in compliance. It helps with compliance drifting and keeping us up to date with code.

It helps to reduce the number of steps involved in automating things. Everything is performed consistently every time. There are no missed steps. If you do it manually, you might miss a step. With Red Hat Ansible Automation Platform, it is just the same every time, which is good.

Ansible Automation Platform does not reduce the training required to learn how to automate things. There is a lot more overhead and a lot more training to teach how to use Ansible.

Ansible Automation Platform helps connect teams, such as developers, operations, or security so that they can automate together. Our engineering team can now collaborate or work with our operations team. We build the Ansible solution, and they run the solution. There is more teamwork.

We use the collection of certified content. It is 80% there for helping to quickly add automation to our systems. It is decent.

Ansible Automation Platform has helped to reduce the time we spend on low-value or repetitive tasks by 80%.

We use it for patching and configuration management.

We are a healthcare institution. We have less than 500 hosts. Ansible is used between the infrastructure and applications, and primarily has Red Hat as the OS.

It has improved our organization through provisioning and security hardening. When we do get a new VM, we have been able to bring on a provisioned machine in less than a day. This morning alone, I provisioned two machines within an hour. I am talking about hardening, installing antivirus software on it, and creating user accounts because the Playbooks were predesigned. From the time we got the servers to the actual hand-off, it takes less than an hour. We are talking about having the servers actually authenticate Red Hat Satellites and run the yum updates. All of that can be done within an hour.

We use it for everything. We use it for provisioning servers, configuring servers, auditing servers, and generating tickets to define a task for the things that we find.

The key to automation is standardization. You need to be able to make certain assumptions safely. As you automate more things, they say, "Well, why don't you do this?" You then say, "I cannot automate this because I cannot confidently predict this. There are too many variables." So, it makes people think that they have to do it this way or they have to be more consistent about how they do something. Consistency and standardization are something that has been lacking at least in my organization, whereas now, with the demand for automation, people are like, "You have to fix this if somebody else is going to help you with their automation." It is starting the dialogue. We are trying to figure out why people are doing things and we are coming across a lot of stories such as people are doing something for a reason that is no longer valid, but they just thought this is the way it always had to be done. They did that for a very specific reason. That reason is gone. They do not have to do it that way.

Ansible Automation Platform has a huge part in helping to reduce the number of steps involved in automating things. There are a lot of different groups within the organization that have achieved automation in their own way, and it worked for them. However, Ansible is a pretty consistent and easy way that everybody can use. It is much more approachable than some of the other methods that other teams have opted to use. At the end of the day, those teams may be using very advanced and pretty complex tooling. However, for the sake of making it continuous and for being able to integrate with teams that are using automation that is not as complex but still just as meaningful and necessary, they agree to do it this way. It is getting everybody in the same language and the same plane for us.

Ansible Automation Platform helps reduce the training required to learn how to automate things. I have seen places that have sent teams of people to get trained, but we have much more of each one, teach one approach. That worked for us.

We are getting to that point now where we will be able to reduce the time we spend on low-value or repetitive tasks. We often had very skilled people doing very mundane tasks, but we have gotten to a point where we have written automation, and we have written playbooks and given them to people who may be in a technical role but are not necessarily as technical as some of their other counterparts. A good way to put it would be that if you have two people who are assigned to clean a room, somebody got to vacuum and somebody got to dust. With Ansible, people who like to dust can dust. People who want to do the windows can do the windows. Previously, everybody had to do their own windows and their own dusting. It gives people the opportunity to specialize in what they are good at.

My use cases with Ansible include configuring network devices. That is what I used it for when I was first learning Ansible. I then automated PKI (public key infrastructure) compliance. That particular domain has different servers and I developed an automation solution, using Ansible, to automate the configuration of the PKI servers. And for the last eight or nine months, I have been working on automating cloud solutions, such as deploying services or upgrading or migrating to a specific version of a product.

I am working on a client network, and that client also has clients who are hiring our client for hosted services, such as websites or internal applications for their employees or for their end-users. All the database-related activities and operations are being handled by our client. What I am doing, in that context, has to do with patches. There are patch releases, or bundles, or package upgrades, but the developers of those packages can't go and directly upgrade the particular sites of every customer. So we have developed an automation solution for them, using Ansible, that can directly trigger these processes. They can point out that "this is the package," and our automation in the backend, using Ansible, takes care of it.

It's a tool to automate different domains and Ansible can reduce human efforts for two domains in particular. One is DevOps and the other is network automation.

It's a total automation tool. Where you might need 100 employees to do a certain type of work manually, by developing Ansible modules, that type of work can be done by one employee. It just requires a simple SSH to the target nodes and then you can do whatever you want.

We had a scenario, the public key infrastructure project, in which there were multiple components. Some of my colleagues had automated some domains, such as a firewall domain. We then needed to integrate components, the firewall servers and the PKI servers, so that they could communicate with each other, and for security purposes. Ansible helped with that.

When you compare a process done by Ansible with human effort, there is a large time-reduction ratio. In a scenario involving networking, if it is done manually, the human effort will involve logging in to the system, entering user credentials, installing software, and configuring it to make the system ready. If there are 100 such systems, we would need to do the same process to all 100 systems, one by one. Whereas with Ansible, you just need to configure the IP addresses of those systems and, with one click, your job is done.

And when we integrate Ansible with a CI/CD tool, like Jenkins or Bitbucket, that reduces service deployment time by more than one hour. Also, we have site deployment where we require multiple servers. For example, when we have a database server, it needs many other components as well. When we deploy all those services manually, using a UI or a console in the cloud, it takes more than 10 hours to deploy one site. With Ansible, we automate that task once and it can do it in an hour, and the site will be provisioned successfully.

We primarily use it for network automation and security or CVE resolution.

We save thousands of hours a year doing security updates and configuration updates. We save our administrator's time by pushing updates. It is a one-click solution, and all they have to do now is pull down whatever they need for their configs. It saves about 4,000 man hours a year.

If you imagine Tier 1, 2, and 3 administrators, I am sitting more at the Tier 3 level. We are able to push out more complicated configurations. We can do just an SSH push to thousands of devices. It saves the time of our administrators from having to go into the console of every device. They do not have to SSH into every device and manually type in those configs. We can resolve security issues within a matter of minutes rather than days.

You have the initial big push to get Ansible set up and running in the environment, but once it is there, any tweaks or changes involve just edits to the code base, and you are good to go. It is not at all intensive.

Red Hat Ansible Automation Platform has not reduced the training required to learn how to automate things. We are starting from scratch, so there is always going to be a learning curve associated with it. The more you peel that onion, the more involved it gets, and the more you have to learn about it.

Red Hat Ansible Automation Platform helps connect teams, such as developers, operations, or security so that they can automate together. It is hard to get anything done if all of those players are not talking. Knowledge bases are not siloed anymore. Previously, we did not have a cross-talk or sharing of information. Now that we have the platform, we have to share knowledge back and forth where we are pushing an update and they are telling us what is broken. There is constant feedback. There is a good feedback loop.

Red Hat Ansible Automation Platform has helped to reduce the time we spend on low-value or repetitive tasks. It is hard to quantify the time savings because of the mass scale at which we use it, but it would be within thousands of man hours a year.

My guess is that Red Hat Ansible Automation Platform has saved us costs, but I am not in a position to see those numbers.