ansible

Ansible

Intent Router

Request	Reference	Load When
Install tool, SSH setup, ansible.cfg	resources/install-and-setup.md	User needs to install Ansible or configure control node
Inventory files, group_vars, host_vars	resources/inventory-and-variables.md	User needs inventory structure or variable precedence
Playbook authoring, roles, modules	resources/playbook-patterns.md	User needs play structure, task patterns, or common modules
CLI commands, vault, galaxy	resources/command-cookbook.md	User needs ansible/ansible-playbook/ansible-vault/galaxy commands

Quick Start

# 1. Define your inventory
cat > inventory.ini <<'EOF'
[web]
web1.example.com
web2.example.com

[db] db1.example.com EOF

2. Test connectivity (ad-hoc ping)

ansible all -i inventory.ini -m ping

3. Run a playbook

ansible-playbook -i inventory.ini site.yml

4. Dry-run a playbook (check mode — no changes)

ansible-playbook -i inventory.ini site.yml --check --diff

## Core Concepts

| Concept | Description |
| --- | --- |
| **Control node** | Machine where Ansible runs (requires Python; no agent needed on targets) |
| **Managed node** | Target host reached via SSH (Linux) or WinRM (Windows) |
| **Inventory** | List of managed nodes (INI, YAML, or dynamic script) |
| **Playbook** | YAML file defining ordered plays and tasks |
| **Role** | Reusable directory structure (tasks, handlers, templates, vars) |
| **Module** | Idempotent unit of work (copy, service, package, user, command…) |
| **Collection** | Packaged set of roles, modules, and plugins from Ansible Galaxy |

## Safety Guardrails

- Always run with `--check --diff` first to preview changes without applying them.
- Use `--limit` to target a subset of hosts before running against all inventory.
- Avoid `command` and `shell` modules when an idempotent module exists.
- Running as root (`become: true`) requires explicit approval — confirm privilege escalation scope.
- Protect secrets with `ansible-vault encrypt` — never commit plaintext passwords.

```bash
# Install a role then dry-run the playbook to preview changes
ansible-galaxy role install geerlingguy.java
ansible-playbook -i inventory.ini site.yml --check --diff

Workflow

1. Define or update inventory.
2. Test connectivity: ansible all -m ping -i inventory.ini
3. Write or update playbook.
4. Dry-run: ansible-playbook site.yml -i inventory.ini --check --diff
5. Run against a subset: ansible-playbook site.yml -i inventory.ini --limit web1.example.com
6. Run against all: ansible-playbook site.yml -i inventory.ini

Related Skills

• terraform — provision infrastructure; Ansible configures after provisioning
• pulumi — IaC with code; Ansible handles post-provision configuration

References

• resources/install-and-setup.md
• resources/inventory-and-variables.md
• resources/playbook-patterns.md
• resources/command-cookbook.md
• Official docs: https://docs.ansible.com/ansible/latest/
• Galaxy: https://galaxy.ansible.com
• Jeff Geerling's book/repo: https://www.ansiblefordevops.com/
• Red Hat learning: https://www.redhat.com/en/topics/automation/learning-ansible