Large Ansible code bases are painful to maintain. Roles don’t encapsulate well enough and the setting that makes their variables private is unusable if you need to “exports”/“outputs” and I guarantee you do, flow control isn’t powerful enough and you either supplement by dropping down to script/shell or by wring whole programs in Jinja, variables are so spooky action at a distance that you need an external tool to graph where they come from, vault variables aren’t greppable so good luck there, you can’t write a type checker because it’s all strings and any large codebase will dynamically generate variable names due to lack of expressiveness, you will desperately want a way to tell Ansible to eagerly evaluate some variables instead of keeping them as strings and find out how ugly the workaround is without your own patches, you eventually desperately wish you had the ability to evaluate filters and lookups on the target and might eventually, like me, write a plug-in for that. Your options for complex data transformations is writing 50 line filter pipelines with item.0 item.1 or dropping to python and just writing your own filter, you will also eventually desperately wish you could define new modules via “subroutines” by chaining a few trivial module invocations together and then find out that you must drop to an action plugins which expose all the underbelly of Ansible. You will pull your hair out getting Jinja to strip the whitespace from strings to get Ansible to recognize the results as an array since it’s all strings, you will find out that Ansible has its own string type that doesn’t play nice with str and that is somehow exposed to you in bog standard Ansible.

If Ansible was a Python library I would scream for joy at how much unnecessary complexity and necessary bullshit trivia I could drop from my brain.

> and instead Ansible still opens an SSH connection per task is nuts

Mitogen is not worth the bugs compared to using SSH ControlPersist.