Ansible
Intent Router
| Request | Reference | Load When |
|---|---|---|
| Install tool, SSH setup, ansible.cfg | resources/install-and-setup.md | User needs to install Ansible or configure control node |
| Inventory files, group_vars, host_vars | resources/inventory-and-variables.md | User needs inventory structure or variable precedence |
| Playbook authoring, roles, modules | resources/playbook-patterns.md | User needs play structure, task patterns, or common modules |
| CLI commands, vault, galaxy | resources/command-cookbook.md | User needs ansible/ansible-playbook/ansible-vault/galaxy commands |
Quick Start
# 1. Define your inventory
cat > inventory.ini <<'EOF'
[web]
web1.example.com
web2.example.com
[db]
db1.example.com
EOF
# 2. Test connectivity (ad-hoc ping)
ansible all -i inventory.ini -m ping
# 3. Run a playbook
ansible-playbook -i inventory.ini site.yml
# 4. Dry-run a playbook (check mode — no changes)
ansible-playbook -i inventory.ini site.yml --check --diff
Core Concepts
| Concept | Description |
|---|---|
| Control node | Machine where Ansible runs (requires Python; no agent needed on targets) |
| Managed node | Target host reached via SSH (Linux) or WinRM (Windows) |
| Inventory | List of managed nodes (INI, YAML, or dynamic script) |
| Playbook | YAML file defining ordered plays and tasks |
| Role | Reusable directory structure (tasks, handlers, templates, vars) |
| Module | Idempotent unit of work (copy, service, package, user, command…) |
| Collection | Packaged set of roles, modules, and plugins from Ansible Galaxy |
Safety Guardrails
- Always run with
--check --difffirst to preview changes without applying them. - Use
--limitto target a subset of hosts before running against all inventory. - Avoid
commandandshellmodules when an idempotent module exists. - Running as root (
become: true) requires explicit approval — confirm privilege escalation scope. - Protect secrets with
ansible-vault encrypt— never commit plaintext passwords.
# Install a role then dry-run the playbook to preview changes
ansible-galaxy role install geerlingguy.java
ansible-playbook -i inventory.ini site.yml --check --diff
Workflow
- Define or update inventory.
- Test connectivity:
ansible all -m ping -i inventory.ini - Write or update playbook.
- Dry-run:
ansible-playbook site.yml -i inventory.ini --check --diff - Run against a subset:
ansible-playbook site.yml -i inventory.ini --limit web1.example.com - Run against all:
ansible-playbook site.yml -i inventory.ini
Related Skills
- terraform — provision infrastructure; Ansible configures after provisioning
- pulumi — IaC with code; Ansible handles post-provision configuration
References
resources/install-and-setup.mdresources/inventory-and-variables.mdresources/playbook-patterns.mdresources/command-cookbook.md- Official docs: https://docs.ansible.com/ansible/latest/
- Galaxy: https://galaxy.ansible.com
- Jeff Geerling's book/repo: https://www.ansiblefordevops.com/
- Red Hat learning: https://www.redhat.com/en/topics/automation/learning-ansible