← DevOps Hub
DevOps · Guide

Ansible

Playbooks, inventory, idempotent configuration management.

— min read DevOps

Theory

Ansible is agentless SSH automation — idempotent playbooks describe desired state, not imperative steps.

Ansible connects to managed nodes over SSH (or WinRM) and pushes modules that declare desired state. No agent daemon runs on targets — only Python and an SSH user with sudo.

Playbooks are YAML ordered lists of plays; each play targets an inventory group and applies roles or tasks. Roles bundle tasks, handlers, templates, and defaults for reuse.

Inventory defines hosts and groups (static INI/YAML or dynamic from cloud APIs). Variables layer: extra-vars > play vars > role defaults > facts.

Idempotency means re-running a playbook should make zero changes when the system already matches (changed=0). Modules like apt, copy, and systemd check state before acting.

Ansible Vault encrypts secrets inside repo files. ansible-vault encrypt/decrypt integrates with CI using vault password files or env vars — never plaintext prod secrets in git.

Handlers run once at end of play when notified (e.g. restart nginx after config template changes). Tags limit execution: ansible-playbook site.yml --tags web.

Tower/AWX (now Ansible Automation Platform) adds RBAC, job templates, scheduling, and audit trails for enterprise teams.

Compared to Terraform (provisioning) and Chef/Puppet (agent-based), Ansible wins for ad-hoc fleet patching and app config when SSH access exists.

Architecture Diagram

  Control node (ansible-playbook)
         | SSH / WinRM
         v
  +------------------+
  |  Inventory       |
  |  web, db, cache  |
  +------------------+
         |
    +----+----+----+
    v    v    v    v
  web1 web2 db1 cache1
         |
    Modules: apt, copy,
    template, systemd

Examples

yaml — inventory 
[web]
web1 ansible_host=10.0.1.10
web2 ansible_host=10.0.1.11

[web:vars]
ansible_user=deploy
yaml — playbook 
- hosts: web
  become: true
  tasks:
    - name: Install nginx
      apt:
        name: nginx
        state: present
    - name: Deploy site config
      template:
        src: nginx.conf.j2
        dest: /etc/nginx/nginx.conf
      notify: Reload nginx
  handlers:
    - name: Reload nginx
      systemd:
        name: nginx
        state: reloaded
bash 
ansible web -m ping
ansible-playbook site.yml --check --diff
ansible-vault encrypt group_vars/prod/secrets.yml

Interview Questions

Why is Ansible called agentless?

It uses SSH/WinRM to push modules; no persistent agent on nodes reduces operational overhead and firewall complexity.

Explain idempotency with an example.

apt: name=nginx state=present on an already-installed host reports ok/changed=0; only missing packages trigger change.

Handlers vs tasks?

Tasks run every time (unless skipped); handlers run once at play end when notified — ideal for service restarts.

How do you manage secrets?

Ansible Vault encrypts YAML blobs; decrypt at runtime with vault password from CI secret store.

Dynamic inventory use case?

Query AWS/GCP APIs so new autoscaled instances join groups without manual INI edits.

Ansible vs Terraform?

Terraform provisions infrastructure (API CRUD); Ansible configures OS/apps on existing hosts — often used together.

What is a role?

Reusable unit: tasks/, handlers/, templates/, defaults/ — shared across playbooks like a package.

Debugging failed tasks?

Run with -vvv, check register variables, use ansible-playbook --start-at-task, verify become and connectivity.

FAANG: scale limits?

Forking SSH to thousands of hosts needs strategy: rolling batches, mitogen/mirror acceleration, tower for parallelism control.

Rolling deploy pattern?

Serial or max_fail_percentage in play; update subset, health check, continue — avoids full-fleet bad config.

Best Practices

  • Use roles and group_vars/host_vars hierarchy
  • Always --check on prod-like staging first
  • Pin collection versions in requirements.yml
  • Limit become: true to tasks that need it
  • Tag tasks for partial runs
  • Store vault files separately with tight ACL

Common Mistakes

Watch for these patterns — they cause most production incidents around Ansible.
  • Running playbooks without become when root needed
  • command/shell instead of idempotent modules
  • Secrets in plain group_vars committed to git
  • No serial strategy — all hosts break at once
  • Ignoring ansible-lint warnings

Cheat Sheet

ansible-playbookRun YAML playbook
-m pingAd-hoc connectivity test
--checkDry-run mode
ansible-vaultEncrypt sensitive vars
notify/handlerDeferred restart pattern

Practical Exercises

LAMP stack role

Create roles for nginx, php-fpm, mysql; parameterize with vars.

Vault workflow

Encrypt DB password; run playbook from CI with vault password env.

Rolling update

Deploy app version with serial: 2 and health check between batches.

← Terraform

Related topics