Ansible

Automating servers with Ansible playbooks and roles.

Quick Start

pip install ansible
ansible -i hosts all -m ping

When to Use

• Configuration management across servers
• Repeatable provisioning and deploys
• Orchestrating multi-host tasks
• Idempotent server setup

Best Practices

Playbooks & Roles

• Structure with roles (tasks, handlers, vars, templates)
• Keep playbooks thin; logic in roles
• Use handlers for service reloads
• Name every task for readable output

Idempotency

• Write tasks that converge to the desired state
• Avoid commands with side effects; prefer modules
• Use `creates`/`when` guards where needed
• Re-running playbooks should be safe

Inventory & Variables

• Use group_vars and host_vars for config
• Encrypt secrets with ansible-vault
• Use inventory plugins for dynamic hosts
• Prefer variables over hardcoding

Safety

• Run `--check` before applying
• Limit blast radius with `--limit` and serial
• Use become carefully and scoped
• Version control playbooks and roles

Dependencies

pip install ansible
ansible --version

Examples

# Playbook with a role
- hosts: webservers
  become: true
  roles:
    - nginx

# Simple playbook
- hosts: all
  tasks:
    - name: Ensure nginx installed
      apt:
        name: nginx
        state: present
    - name: Start nginx
      service:
        name: nginx
        state: started
        enabled: true

# Role structure
# roles/nginx/tasks/main.yml
- name: Install nginx
  apt: { name: nginx, state: present }
  notify: reload nginx

# roles/nginx/handlers/main.yml
- name: reload nginx
  service: { name: nginx, state: reloaded }

# Check mode + apply
ansible-playbook site.yml --check
ansible-playbook site.yml --limit web-01

Step-by-Step

1. Define the inventory and group_vars.

2. Structure logic into roles.

3. Write idempotent tasks using modules.

4. Add handlers for reloads.

5. Encrypt secrets with ansible-vault.

6. Run `--check` then apply with limits.

7. Version control playbooks and roles.

8. Schedule with AWX/Ansible Tower or CI.

Validation

1. Playbooks are idempotent (re-run changes nothing)

2. `--check` reports expected changes

3. Secrets are encrypted in vault

4. Handlers fire on changes only

5. Deploys succeed across the inventory

Troubleshooting

• Changed on every run: find non-idempotent task.
• Become errors: check sudo rules and become_method.
• Unreachable: verify SSH keys and inventory addresses.