I've been using AAP for quite a while. In Tower, the concept of creating a "secure bubble wrap" by utilizing virtualenvs was a great idea. However, from my world of Secrets Management, it made it near impossible to get attributes of the workload executing within to identify it without a "secret zero".
Today, in AAP... the containerized execution environments are a game changer! Now, we can determine the attributes of the environment to provide it secrets and when the execution completes -- POOF! -- the container and all secrets within are gone!
This simple change in architecture to improve modernization was an amazing advancement! Review collected by and hosted on G2.com.
I said I was in secrets management, so you should see this one coming:
"The Single Credential Problem"
Today, Job Templates only support 1 Machine Credential. If I want to scale a job template across many hosts to patch them efficiently, there is no native way to accomplish this today. I have to utilize a workaround that employs the use of lookup plugins in the playbook and dynamically fetching secrets just-in-time based on inventory_hostname. It was actually my Lightning Talk for AnsibleFest here at Summit this week. The feature request was added to AWX in 2017.
Also, AAP has no underlying OIDC configuration. This makes it hard to utilize an identity-aware process that allows secrets management to utilize attributes of workloads (the "payload" of the JWT from OIDC) to identify them instead of a "secret zero" needing to be utilized. Cloud services and even OpenShift has this support today... a modern AAP should also support the same similar to most CI platforms out there. Review collected by and hosted on G2.com.
Validated through a business email account
The reviewer received either a gift card or a donation made to a charity of their choice in exchange for writing this review.
G2 Gives Campaign. The reviewer received either a gift card or a donation made to a charity of their choice in exchange for writing this review.