Ansible

The garden’s Ansible thread, anchored on the work context (COT’s ps-ansible playbooks, the the ansible-cot rewrite project (Hermes skill) rewrite project) and the 2026-09 capture wave. This note is the concept hub; project specifics stay in their own repos.

Execution Environments (the 2026-09 talk, transcript captured)

A Polish-language conference talk on Ansible Execution Environments — “wrzucenie Ansible, kolekcji i dodatkowych narzędzi w kontener, który jest później wykorzystywany podczas automatyzacji” (Ansible + collections + extra tooling packed into a container used during automation). The speaker’s through-line:

• Why: the Python-support treadmill — Ansible 2.2 dropped Python 2 on controllers; 2.13 dropped Python 2.6 on managed hosts (RHEL 6/CentOS 6/OL 6 era); 2.16 dropped 3.9/3.5; 2.17 ends Python 3.10-on-controlled and 3.6-on-managed. The controller/managed matrix is the recurring pain an EE freezes in place. Plus the speaker’s own history: three parallel Ansible versions in the pre-2.0 days — stable, new-features, experimental.
• The philosophy alignment: “jak już mam zautomatyzowaną większą część infrastruktury prawie całą to to jest disaster recovery — dowolny komponent mogę zaorać, postawić od nowa i wrzucić dane” — full-automation as cattle-style DR, the same rethink-as-replace instinct as containers.
• The tooling quartet: ansible-navigator (TUI: run, browse docs, config, inspect images, exec into EEs — “jedno narzędzie prawie do wszystkiego”, developed as part of Automation Platform but free to use standalone), ansible-builder (builds the EE containers), ansible-runner (push-and-run Ansible on external systems), Podman as the container base.
• The talk’s own twist: building EEs on a Debian base instead of the usual RHEL-family — the demo replaces the RHEL-isms (“naleciałości RHEL-owe”) with Debian equivalents via script, then podman build with a tag.

Why EEs matter for the COT context: pinned controller + collections + Python in one image kills the “works on my Ansible” class of drift between team members and CI — the same problem Golden repo CI/CD solves for code, solved for the automation tool itself.

Landscape anchors

• Dariusz Puchalak — the garden’s primary Polish Ansible source; materials site (talk PDFs 2017→2025 + 60+ playbook examples) + talks inventory captured there.
• Diff tools — diffyml’s todo: structural YAML diff on Ansible playbooks (anchors, multi-doc, Jinja unknowns still to test).
• the ansible-cot rewrite project (Hermes skill) project — the roles rewrite; style rules live in the ansible-style-guide skill.
• The module/setup Python-version matrix is the argument for managing when fleets upgrade: old managed hosts (EL6-class) constrain controller choices in the flat-install world; EEs decouple them.

Open

• (open: try an EE for ps-ansible — Debian-base variant per the talk’s demo; navigator as the daily driver TUI)
• (open: diffyml hands-on on real playbooks, wired from Diff tools)

Related: Diff tools · Golden repo · Self-hosted CI-CD (forgejo-runner runs Ansible in EEs — the automation-tool-in-a-container pattern closes the loop: CI pinned, controller pinned)

Role notes

• ansible-role-cot-acl — the COT ACL role; known issue: recursive default ACLs fail on trees containing files (ansible.posix#592, closed but untested); verify before prod.
• Ansible data validation — yamllint + JSON Schema + ansible.utils.validate: fail bad host_vars at commit time, not mid-playbook at 2 a.m.