Ascender overview: CIQ's automation platform
This overview introduces Ascender, CIQ's automation platform based on upstream Ansible AWX, which means anyone already running an AWX-derived product can migrate and receive CIQ support. The narration describes Ascender as a traffic control tower for Ansible playbooks and walks through the platform section by section, making it a good starting point for administrators, Windows admins and network engineers evaluating enterprise automation.
The first part covers enterprise fundamentals. The graphical interface sits on top of a complete API, so tools such as network monitoring systems or an ITSM like ServiceNow can trigger automation directly. Role-based access control governs who can view, create and execute, with teams mapped from Active Directory groups, and extensive logging records administrative changes and every job launch for security and compliance teams.
The second part follows the five sections where administrators spend most of their time. Inventories list hosts and can be built dynamically from cloud providers, monitoring systems or a CMDB. Projects pull playbooks from any reachable git repository, optionally resyncing on every launch. Credentials store secrets encrypted for use only at execution time, or delegate to engines such as HashiCorp Vault, CyberArk and Delinea. Job templates combine those pieces with fill-in-the-blank options, schedules and surveys, and workflows chain templates from different owners while inheriting their later changes.
Key takeaways
- Ascender is based on upstream Ansible AWX, so users of any AWX-derived product can migrate and receive CIQ service and support.
- The GUI fronts a full API, letting ITSM tools like ServiceNow or monitoring systems launch automation without users touching the platform.
- Role-based access control and Active Directory group mapping decide who can view, create and execute automation.
- Inventories can be built dynamically from cloud providers such as AWS, network monitoring systems or a ServiceNow CMDB.
- Credentials are stored encrypted and used only at execution time, or fetched from engines like HashiCorp Vault, CyberArk and Delinea.
- Workflows chain job templates from different owners, and execute-only permissions let you run automation you cannot view or modify.
Questions this video answers
What is Ascender from CIQ?
Ascender is CIQ's enterprise automation platform, built on the upstream Ansible AWX project. It provides a web GUI and REST API for running Ansible playbooks, with role-based access control, Active Directory integration, extensive logging, dynamic inventories, git-backed projects, encrypted credentials, job templates, schedules, surveys and workflows, backed by CIQ support.
How does Ascender handle access control and auditing?
A role-based access control system lets each group tightly control who can view, create and execute anything on the platform. Users and teams can be maintained manually or mapped from Active Directory groups so roles are inherited automatically. Logging captures administrative changes plus who launched which playbook, when, and the results, which helps security and compliance teams.
What is a workflow in Ascender?
A workflow chains individual job templates together so playbooks that perform discrete tasks can be reused. It also lets different automation owners share templates: with only execute permission you can add another admin's template to your workflow without viewing or modifying it, and if they later change it your workflow inherits the update.
This video is part of the Ascender Pro playlist. Browse every CIQ video by product and topic.
Transcript
this is Ascender ciq's automation platform proudly based on Upstream ansible awx this means anyone using a product based on awx can easily migrate to Ascender to get ciq's industry best service and support Ascender allows an Enterprise to reliably orchestrate their automation think of it as a traffic control tower for your ansible playbooks here you can see the graphical user interface which is great for regular Administration it's especially useful for any users that might be less familiar with Linux like Windows admins or network Engineers having said that the GUI is really just an interface for the fully realized API which means if you have existing
Tools in your environment that you rely on like a network monitoring systems or perhaps an itsm like servicenow they too can now take advantage of automation simply by calling Ascender's API in fact many end users will only interface with an itsm that calls the API completely unaware that they are taking advantage of the platform which can keep things incredibly simple for them aside from API another must have Enterprise feature is Access Control to automation if your playbooks are just sitting on a centralized server that everyone's sshing into then there's little control over who can run what sender utilizes a role-based access control system to
ensure that each group can tightly control who has access to view create and execute anything inside the platform users and teams are version of groups can be maintained from the access menu manually which is fine for small groups but Ascender also supports authentication from many other sources likely the most often seen is integration with active directory where Adu groups are mapped to Ascender teams so that users will automatically inherit the correct roles the platform also supports extensive logging so that anything from Administration admins making changes inside the system to full automation logging who launched What playbook when and what the results were this is
great for satiating security teams and anyone with compliance needs the majority of Administrators will spend their time in the next five sections inventories are just large lists of all the hosts you could operate against these could be servers that are physical VMS or even Cloud instances they could also be your network elements or security appliances really anything you want to automate against as with users I can manually maintain these hosts but the real power of the platform is that I can build these lists dynamically from virtually any source that could be any of the cloud providers so for example I could connect to AWS and
View full transcriptHide full transcript
pull all the hosts or I could connect to my network monitoring system and pull all of my discovered hosts I can also utilize configuration management database like the one in servicenow to maintain that source of Truth speaking of servicenow I can easily read and write to their cmdb so it's easy to keep it in compliance next comes projects this is how I pull playbooks into Ascender when I develop my playbooks I sync them to the corporate git repository be that GitHub bitbucket get T really any compliant git repo that the platform can reach this helps me adhere to my corporate standard of development and
change control once the repository is created I add it to the project section by simply choosing the source type as get and putting in the URL to it another interesting option here is update revision on launch what this does is anytime a piece of automation is run that uses this project it will pause and resync the project to ensure the newest version of playbooks are utilized again a way in which you don't have to touch the platform unless you want to next is the credentials section which allows you to securely create methods to connect to your remote resources in short how do I log into
this host secrets are stored in sha-256-bit encryption and are utilized at execution time which means no sensitive data is stored in playbooks again I can manually create and maintain these credentials or I can use a Secrets engine Secrets engine is a service that sits to the side and allows for credentials to be requested when needed engines like hashicorp Vault cyberark and delinea formerly thychotic can be integrated finally the template section is where I marry all of those previous pieces together into job templates here I specify my inventory list of hosts I could possibly run against my project that holds my playbooks select my playbook add
my credentials and then I can save and launch my job template I also have all of these wonderful options in front of me for ease of use if I was previously using ansible from the command line I had to memorize all of my options whereas here I have nice fill in the blank boxes if I'm unsure what an option does I can simply click the question mark for more information once I've saved my job template I can simply launch it or I can schedule it to run on Whatever frequency I like once a job is launched it pops into the job section here I have
the list of all the jobs that have run in the last 120 days retention in the database is adjustable this allows me to go back in time and see the results of any job I can look at the output of its run much like CLI ansible but I can also click on an entry to get greater detail on it I can also see the details on who ran in when it was run all of the job details even including the variables that were passed to it there are also features like surveys this allows you to prompt the user for any additional information at runtime it
could be something like text integer password or multiple choice options this information is then pushed into the Playbook as extra variables another extremely powerful feature of Ascender is workflows a workflow takes individual playbooks and allows an administrator to chain them together in interesting ways that allows for reuse of playbooks to perform discrete tasks but more importantly it allows differing owners of automation to easily execute job templates that were shared with them say for example I own this first job template top to bottom but the second one was created by another admin in a completely different group all they have given me is execute permissions to
their automation I can't view or modify their content rather all I do is add it to my workflow and execute it if they later make a modification of that job template I don't have to adjust anything within my workflow it will simply inherit the changes this really just scratches the surface of features and capabilities of Ascender we'd be delighted to talk more in depth about how Ascender backed by ciq's industry best support and service can be a game changer for you
Built for scale. Chosen by the world’s best.
2.75M+
Rocky Linux instances
Being used world wide
90%
Of fortune 100 companies
Use CIQ supported technologies
250k
Avg. monthly downloads
Rocky Linux
9
Enterprise products
Spanning the kernel to the orchestrator
Have questions about your infrastructure?
Talk to a CIQ engineer about Rocky Linux, HPC, and AI infrastructure.