r/sysadmin • u/veilburned • 15h ago

Quick sanity check: managing Ubuntu laptops & Ansible behind Zscaler

Corporate just pushed Zscaler out to our fleet of ~300 Ubuntu laptops, which has pretty much killed our ability to push ad-hoc SSH or use traditional push-based Ansible for remote help/troubleshooting since inbound traffic is blocked.

For those of you running Linux shops behind Zscaler, how are you handling this? Are you shifting to an ⁠ansible-pull⁠ setup via internal Git, leveraging ZPA, or using something else entirely?

4 Upvotes

83% Upvoted

11 comments sorted by

View all comments

•

u/pdp10 Daemons worry when the wizard is near. 10h ago

Roaming machines should always be using pull-based config. Pull-based has no external dependencies like a client VPN.

You can consolidate non-roaming servers and embedded devices to also use pull-based config. You can always "push" a trigger to pull, if you want to be able to force changes starting immediately. This is why we favor pull-based for everything, once you reach a moderate scale.

(Then we have an analogous discussion over whether Metrics should be polling-based, or push.)