← All work
Architecting Ansible Automation Platform as rebuildable IaC
Outcome: A resilient, rebuildable platform that lets the team do more with less. If AAP is ever lost, or when it is time to lift-and-shift to a newer OS or off VMware onto Hyper-V, it can be rebuilt from code with confidence, without leaning on Red Hat support to reconstruct it. Provisioning went fully agentless and first-time success climbed from 60% to 99%, and by automating at scale the organization can modernize and absorb the VMware exit without choosing between keeping skilled staff and paying escalating licensing. Real, maintained, custom automation delivering measurable, sustained value.
The problem
AAP had become the backbone for automation, but the platform itself was configured by hand in the UI, leaving upgrades risky, drift invisible, and recovery dependent on tribal knowledge and vendor support. At the same time, steep post-acquisition VMware licensing was forcing the organization off vSphere, so provisioning had to move onto AAP and be trustworthy from day one, in a healthcare and academic setting where budgets are tight and every dollar is accountable.
What I did
- Architected the entire AAP stack as infrastructure-as-code, defining install, upgrade, and configuration in version control so the platform is described by source rather than by clicks in a console.
- Drew a hard line between configuration and execution: the platform is only ever changed through code and pipelines, while the UI is left to operators for launching and testing workloads. Nothing about the running platform is hand-edited.
- Rebuilt provisioning on top of it as a fully agentless process, owning the Windows and RHEL lifecycle end to end, from IPAM reservation to a compliant, managed host, and cutting first-time provisioning failures from roughly 40% to near zero.
- Right-sized AAP to roughly 200 licenses, where an earlier proposal to license all 1,500 virtual machines had been rejected, and preserved the same reach by extending AAP through Azure DevOps and on-prem agents and integrating the existing SCCM and Satellite investments, so scale came from architecture rather than seat count while staying license-compliant.