⚙️

Ansible

Ansible CLI commands and playbook patterns for configuration management and automation

Ad-hoc Commands

Run one-off tasks against hosts without writing a playbook

bash·Ping all hosts

ansible all -m ping

bash·Ping a specific group

ansible webservers -m ping

bash·Run shell command on all hosts

ansible all -m shell -a 'uptime'

bash·Copy file to hosts

ansible all -m copy -a 'src=./app.conf dest=/etc/app/app.conf owner=root mode=0644'

bash·Install package (apt)

ansible all -m apt -a 'name=nginx state=present' --become

bash·Remove package

ansible all -m apt -a 'name=nginx state=absent' --become

bash·Restart a service

ansible all -m service -a 'name=nginx state=restarted' --become

bash·Gather facts from hosts

ansible all -m setup

bash·Gather specific fact

ansible all -m setup -a 'filter=ansible_distribution*'

bash·Run as a different user

ansible all -m shell -a 'whoami' --become --become-user=postgres

bash·Limit to one host

ansible all -m ping --limit web01.example.com

Inventory

Define and inspect static and dynamic inventories

bash·List all hosts in inventory

ansible all --list-hosts

bash·List hosts in a group

ansible webservers --list-hosts

bash·Use a custom inventory file

ansible all -i inventory/prod.ini --list-hosts

bash·Use dynamic inventory script

ansible all -i inventory/aws_ec2.yml --list-hosts

bash·Graph group hierarchy

ansible-inventory --graph

bash·Show host vars as JSON

ansible-inventory --host <hostname>

bash·Dump full inventory as JSON

ansible-inventory --list

ini·Static inventory file (INI)

[webservers]
web01.example.com ansible_user=ubuntu
web02.example.com ansible_user=ubuntu

[dbservers]
db01.example.com ansible_user=postgres ansible_port=2222

[production:children]
webservers
dbservers

[production:vars]
ansible_ssh_private_key_file=~/.ssh/prod_key

yaml·Dynamic AWS EC2 inventory (YAML)

plugin: amazon.aws.aws_ec2
regions:
  - us-east-1
filters:
  tag:Environment: production
  instance-state-name: running
keyed_groups:
  - key: tags.Role
    prefix: role
hostnames:
  - private-ip-address

Running Playbooks

Execute, test and control playbook runs

bash·Run a playbook

ansible-playbook site.yml

bash·Run with custom inventory

ansible-playbook -i inventory/prod.ini site.yml

bash·Dry run (check mode)

ansible-playbook site.yml --check

bash·Dry run with diff output

ansible-playbook site.yml --check --diff

bash·Limit to specific hosts or groups

ansible-playbook site.yml --limit webservers

bash·Run only specific tags

ansible-playbook site.yml --tags deploy

bash·Skip specific tags

ansible-playbook site.yml --skip-tags restart

bash·Start from a specific task

ansible-playbook site.yml --start-at-task='Configure nginx'

bash·Step through tasks interactively

ansible-playbook site.yml --step

bash·Pass extra variables

ansible-playbook site.yml -e 'env=prod version=1.2.3'

bash·Pass extra variables from file

ansible-playbook site.yml -e @vars/prod.yml

bash·Increase verbosity (up to -vvvv)

ansible-playbook site.yml -vv

bash·Fork across 20 hosts in parallel

ansible-playbook site.yml --forks=20

Playbook Patterns

Common playbook structures and task idioms

yaml·Basic playbook structure

---
- name: Configure web servers
  hosts: webservers
  become: true
  vars:
    app_port: 8080

  pre_tasks:
    - name: Update apt cache
      apt:
        update_cache: true
        cache_valid_time: 3600

  tasks:
    - name: Install nginx
      apt:
        name: nginx
        state: present

    - name: Deploy config
      template:
        src: templates/nginx.conf.j2
        dest: /etc/nginx/nginx.conf
        owner: root
        mode: "0644"
      notify: Restart nginx

  handlers:
    - name: Restart nginx
      service:
        name: nginx
        state: restarted

yaml·Loop over a list

- name: Install required packages
  apt:
    name: "{{ item }}"
    state: present
  loop:
    - git
    - curl
    - unzip
    - build-essential

yaml·Conditionals with when

- name: Install on Debian-based systems only
  apt:
    name: nginx
    state: present
  when: ansible_os_family == "Debian"

- name: Install on RedHat-based systems only
  yum:
    name: nginx
    state: present
  when: ansible_os_family == "RedHat"

yaml·Register and use task output

- name: Check if app is running
  shell: pgrep -x myapp
  register: app_status
  ignore_errors: true

- name: Start app if not running
  shell: /opt/myapp/start.sh
  when: app_status.rc != 0

yaml·Block with rescue and always

- block:
    - name: Run risky task
      shell: /opt/deploy.sh

    - name: Run follow-up task
      shell: /opt/verify.sh

  rescue:
    - name: Rollback on failure
      shell: /opt/rollback.sh

  always:
    - name: Send notification
      uri:
        url: https://hooks.example.com/notify
        method: POST

yaml·Serial rolling deploy (one host at a time)

- name: Rolling deploy
  hosts: webservers
  serial: 1          # or "25%" for 25% at a time
  max_fail_percentage: 0

  tasks:
    - name: Pull latest image
      shell: docker pull myapp:latest

    - name: Restart container
      shell: docker-compose up -d --no-deps myapp

Variables & Jinja2 Templates

Variable precedence, filters and Jinja2 template patterns

yaml·Variable precedence (low → high)

# Low priority (define defaults here)
# roles/myrole/defaults/main.yml
app_port: 8080
app_workers: 4

# Medium priority (role-specific vars)
# roles/myrole/vars/main.yml
app_log_level: info

# High priority (host/group specific)
# inventory/group_vars/webservers.yml
app_port: 443

# Highest priority (CLI override)
# ansible-playbook site.yml -e 'app_port=9090'

yaml·Common Jinja2 filters

# String manipulation
"{{ app_name | upper }}"             # MYAPP
"{{ app_name | replace('-', '_') }}" # my_app
"{{ app_name | default('myapp') }}"  # fallback if undefined

# List operations
"{{ packages | join(', ') }}"        # git, curl, unzip
"{{ users | length }}"               # count items
"{{ items | select('match','web*') | list }}"

# Paths and types
"{{ '/etc/app' | basename }}"        # app
"{{ value | int }}"                  # cast to integer
"{{ value | bool }}"                 # cast to boolean
"{{ data | to_json }}"               # serialize to JSON

yaml·Jinja2 template file (nginx.conf.j2)

upstream backend {
{% for host in groups['appservers'] %}
  server {{ hostvars[host]['ansible_host'] }}:{{ app_port }};
{% endfor %}
}

server {
  listen 80;
  server_name {{ inventory_hostname }};

  location / {
    proxy_pass http://backend;
    proxy_set_header Host $host;
  }
}

yaml·Encrypt a variable with Vault inline

# In vars file — value was encrypted with:
# ansible-vault encrypt_string 'mysecret' --name 'db_password'
db_password: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  61383032303361343139616331373538...

Ansible Vault

Encrypt and manage secrets in playbooks and var files

bash·Encrypt a file

ansible-vault encrypt vars/secrets.yml

bash·Decrypt a file

ansible-vault decrypt vars/secrets.yml

bash·View encrypted file without decrypting on disk

ansible-vault view vars/secrets.yml

bash·Edit encrypted file in-place

ansible-vault edit vars/secrets.yml

bash·Re-encrypt with a new password

ansible-vault rekey vars/secrets.yml

bash·Encrypt a single string value

ansible-vault encrypt_string 'mysecretvalue' --name 'db_password'

bash·Run playbook with vault password prompt

ansible-playbook site.yml --ask-vault-pass

bash·Run playbook with vault password file

ansible-playbook site.yml --vault-password-file ~/.vault_pass

bash·Use multiple vault IDs (multi-key)

ansible-playbook site.yml --vault-id dev@~/.vault_dev --vault-id prod@~/.vault_prod

Roles

Create, structure and reuse Ansible roles

bash·Create a new role scaffold

ansible-galaxy role init myrole

bash·Role directory structure

roles/myrole/
├── defaults/main.yml   # low-priority default vars
├── vars/main.yml       # high-priority role vars
├── tasks/main.yml      # task entry point
├── handlers/main.yml   # handlers
├── templates/          # Jinja2 .j2 files
├── files/              # static files to copy
├── meta/main.yml       # role dependencies
└── README.md

yaml·Use a role in a playbook

- name: Deploy app
  hosts: webservers
  roles:
    - common
    - role: nginx
      vars:
        nginx_port: 443
    - role: myapp
      tags: deploy

bash·Install role from Ansible Galaxy

ansible-galaxy role install geerlingguy.nginx

bash·Install roles from requirements file

ansible-galaxy install -r requirements.yml

bash·List installed roles

ansible-galaxy role list

bash·Remove a role

ansible-galaxy role remove geerlingguy.nginx

yaml·requirements.yml for roles and collections

---
roles:
  - name: geerlingguy.nginx
    version: "3.2.0"
  - src: https://github.com/myorg/myrole.git
    scm: git
    version: main

collections:
  - name: amazon.aws
    version: ">=7.0.0"
  - name: community.general

Collections & Galaxy

Install and manage Ansible collections

bash·Install a collection

ansible-galaxy collection install amazon.aws

bash·Install collection at specific version

ansible-galaxy collection install amazon.aws:==7.2.0

bash·Install collections from requirements.yml

ansible-galaxy collection install -r requirements.yml

bash·List installed collections

ansible-galaxy collection list

bash·Upgrade a collection

ansible-galaxy collection install amazon.aws --upgrade

bash·Build a collection tarball

ansible-galaxy collection build

bash·Publish collection to Galaxy

ansible-galaxy collection publish myorg-mycollection-1.0.0.tar.gz --token <api-token>

Debugging & Testing

Lint, debug and test playbooks and roles

bash·Lint playbook with ansible-lint

ansible-lint site.yml

bash·Lint entire project

ansible-lint

bash·Syntax check only (no connection)

ansible-playbook site.yml --syntax-check

bash·List all tasks a playbook would run

ansible-playbook site.yml --list-tasks

bash·List all hosts a playbook targets

ansible-playbook site.yml --list-hosts

bash·List all tags in a playbook

ansible-playbook site.yml --list-tags

yaml·Debug task — print variable value

- name: Print variable
  debug:
    var: my_variable

- name: Print message with interpolation
  debug:
    msg: "App version is {{ app_version }}, port is {{ app_port }}"

- name: Dump all host facts
  debug:
    var: hostvars[inventory_hostname]

yaml·Assert task — fail fast on bad state

- name: Ensure app version is set
  assert:
    that:
      - app_version is defined
      - app_version | length > 0
      - app_port | int > 1024
    fail_msg: "app_version must be defined and app_port > 1024"
    success_msg: "Assertions passed"

bash·Test role with Molecule (init)

molecule init scenario --driver-name docker

bash·Run Molecule tests

molecule test

bash·Molecule converge only (no verify/destroy)

molecule converge