Ideal permissions setup?

Archives Ansible Project
1

Today, we have a setup where all of our playbooks, roles, etc are owned and run by root on our ‘management instance’. Some important key files are protected/encrypted in the root home directory that playbooks need to access at times - this is why we root owns this. To allow others to run certain playbooks, we have given them specific sudo access for those exact commands, put them in scripts and version controlled them.

Our ideal world is to have two groups of users:

  1. Can deploy, start/stop components via playbooks across the board without specific whitelisting (but not access the root keys)
  2. Users in groups that allow them to run certain playbooks but not others

Just wondering how other people are managing this?

2

for such kind of tasks Ansible created Tower http://www.ansible.com/tower

Пʼятниця, 8 серпня 2014 р. 08:44:24 UTC+3 користувач Gary Malouf написав:

3

I hear that, but atm we can not afford to go that direction. I was more asking what users who have not been able to afford the commercial product are doing in the mean-time.

4

I’m not going to sell things on this list, but pricing has recently been updated if you have not checked recently - so it might actually make sense for you.

It’s a lot more complex to get this right than you think, so it may be worthwhile if you have such needs.