Ansible

Ansible#

Ansible is an agentless IT automation engine. A control node reads a YAML playbook, opens SSH (or WinRM) to each target host, and runs Python-shaped task modules in sequence. Inventory groups the targets, variables parametrise the playbook, and handlers react to changed state. Most fleet-management and post-exploit configuration work eventually ends up here.

Variables#

Where values come from and how they layer.

host_vars/                  per-host variable files
group_vars/                 per-group variable files
ansible_facts               data gathered from the target itself
register                    capture a task's result into a variable
vars / vars_files           inline in a play
include_vars                load variables at task time

Higher-precedence sources override lower ones. The official reference enumerates the full ladder; the practical version is: extra-vars > task vars > block vars > role vars > inventory vars > host facts.

Loops and gates#

Repeat a task across a list, or skip it when a condition does not hold.

loop:                       modern list iteration (replaces with_items)
loop_control:               name a loop variable, index, label
with_nested / with_file     legacy lookups still in wide use
when:                       gate a task on an expression
block / rescue / always     structured error handling

Modules#

The verbs the playbook calls. A short list of the ones that account for most production playbooks.

copy            copy a file or literal content to a target
template        render Jinja2 then copy
get_url         download from a URL
file            create, remove, or change mode / owner
lineinfile      idempotent single-line edit
apt / yum / dnf manage packages
service / systemd manage services
firewalld / ufw firewall rules
user / group    accounts
debug           print a variable
wait_for        block until a condition holds
shell / command run an arbitrary command

Playbooks#

A playbook is a list of plays. Each play targets a host pattern and runs tasks. ansible-playbook is the runner.

$ ansible-playbook site.yml                  # run against the inventory
$ ansible-playbook site.yml --limit web      # subset by host pattern
$ ansible-playbook site.yml --tags deploy    # subset by task tag
$ ansible-playbook site.yml --check          # dry-run (no changes)
$ ansible-playbook site.yml --check --diff   # dry-run with file diffs
$ ansible-playbook site.yml --forks 20       # 20 hosts in parallel
$ ansible-playbook site.yml --start-at-task "T"  # resume mid-play
$ ansible-playbook site.yml --step           # confirm each task

Roles#

A role bundles tasks, handlers, variables, files, and templates under a conventional directory layout that can be reused across playbooks.

roles/<name>/
  defaults/main.yml     fallback variable values
  vars/main.yml         role variables that override defaults
  tasks/main.yml        the task list
  handlers/main.yml     handlers fired by ``notify``
  files/                static files copied unchanged
  templates/            Jinja2 source for ``template:``
  meta/main.yml         dependencies, author, supported platforms

Vault#

ansible-vault encrypts secret-bearing files at rest with a symmetric password. Encrypted files stay tracked in git; the password stays out.

$ ansible-vault create   secrets.yml
$ ansible-vault view     secrets.yml
$ ansible-vault edit     secrets.yml
$ ansible-vault encrypt  vars/prod.yml
$ ansible-vault decrypt  vars/prod.yml
$ ansible-vault rekey    secrets.yml
$ ansible-playbook       site.yml --ask-vault-pass
$ ansible-playbook       site.yml --vault-password-file .secret

References#

Contents