Execution model for Ansible playbooks in a network management system
Jokioja, Sanni (2026)
2026
Automaatiotekniikan DI-ohjelma - Master's Programme in Automation Engineering
Tekniikan ja luonnontieteiden tiedekunta - Faculty of Engineering and Natural Sciences
This publication is copyrighted. You may download, display and print it for Your own personal use. Commercial use is prohibited.
Hyväksymispäivämäärä
2026-06-22
Julkaisun pysyvä osoite on
https://urn.fi/URN:NBN:fi:tuni-202606187736
https://urn.fi/URN:NBN:fi:tuni-202606187736
Tiivistelmä
This thesis investigates how to redesign the execution model for Ansible playbooks in a Radio Access Network (RAN) Network Management System (NMS) so that dynamically provided playbooks can be run safely and in a controlled manner. The current solution relies on a wrapper script that executes playbooks from a mounted directory. This model works for official installations and upgrades but is inflexible for development, testing, and urgent service deliveries, because every change requires modifying the shared playbook set and rebuilding the image. The research problem is how to increase flexibility in playbook execution and delivery without weakening security or significantly increasing complexity.
The work combines a literature review on NMS deployment practices, containerized execution models, and Ansible based automation with a design-oriented case study in the target NMS environment. Based on the identified requirements, three alternative implementations are designed and implemented: an extension of the existing wrapper script, a new Ansible-driven solution with a Makefile based interface and an image-centric variant where playbooks are embedded into the container. The implementations are evaluated against criteria for functionality, security and quality, including usability and maintainability, using a structured, criteria-based assessment and an expert review session.
The results show that the new Ansible-based implementation provides the most flexible execution model and the highest overall quality in terms of understandability, documentation and ease of extension. The refined wrapper-based solution is the most secure alternative in the given environment, due to its tight coupling with a hardened platform and a more limited attack surface. The image-centric variant is the most restrictive in functionality but reduces some security risks by disallowing external playbooks altogether. Overall, the study demonstrates that it is feasible to design a more modular and dynamic playbook execution model for the NMS context, but that fully productizing such a model would require additional hardening and verification effort, which may be difficult to justify given the limited remaining lifetime of the current platform. The evaluation criteria and findings can be reused when designing future automation solutions for similar environments.
The work combines a literature review on NMS deployment practices, containerized execution models, and Ansible based automation with a design-oriented case study in the target NMS environment. Based on the identified requirements, three alternative implementations are designed and implemented: an extension of the existing wrapper script, a new Ansible-driven solution with a Makefile based interface and an image-centric variant where playbooks are embedded into the container. The implementations are evaluated against criteria for functionality, security and quality, including usability and maintainability, using a structured, criteria-based assessment and an expert review session.
The results show that the new Ansible-based implementation provides the most flexible execution model and the highest overall quality in terms of understandability, documentation and ease of extension. The refined wrapper-based solution is the most secure alternative in the given environment, due to its tight coupling with a hardened platform and a more limited attack surface. The image-centric variant is the most restrictive in functionality but reduces some security risks by disallowing external playbooks altogether. Overall, the study demonstrates that it is feasible to design a more modular and dynamic playbook execution model for the NMS context, but that fully productizing such a model would require additional hardening and verification effort, which may be difficult to justify given the limited remaining lifetime of the current platform. The evaluation criteria and findings can be reused when designing future automation solutions for similar environments.