Ad-hoc commands
ansible all -i inventory.ini -m ping
ansible web -i inventory.ini -m command -a "uptime"
ansible web -i inventory.ini -m apt -a "name=nginx state=present" --become
ansible-inventory -i inventory.ini --graph
ansible-inventory -i inventory.ini --host web1.example.com| Flag | Meaning |
|---|---|
-m |
Module to run |
-a |
Module arguments |
--become |
Run with elevated rights |
--limit |
Restrict to some hosts |
--check |
Show what would change |
Running playbooks
ansible-playbook -i inventory.ini site.yml
ansible-playbook site.yml --syntax-check
ansible-playbook site.yml --check --diff --limit web1.example.com
ansible-playbook site.yml --tags config --skip-tags slow
ansible-playbook site.yml --start-at-task "Render nginx configuration"
ansible-playbook site.yml --list-tasksPlaybook skeleton
- name: Configure web servers
hosts: web
become: true
vars:
app_port: 8080
tasks:
- name: Install nginx
ansible.builtin.apt:
name: nginx
state: present
- name: Render configuration
ansible.builtin.template:
src: shop.conf.j2
dest: /etc/nginx/conf.d/shop.conf
validate: "nginx -t -c /etc/nginx/nginx.conf"
notify: Reload nginx
handlers:
- name: Reload nginx
ansible.builtin.service:
name: nginx
state: reloadedRead the recap: a clean second run shows changed=0.
Control flow
- name: Only on Debian
ansible.builtin.apt:
name: nginx
when: ansible_facts['os_family'] == "Debian"
- name: Make users
ansible.builtin.user:
name: "{{ item }}"
loop: [alice, bob]| Tool | Use |
|---|---|
when |
Run a task only if true |
loop |
Repeat for each item |
block / rescue / always |
Try, catch, finally |
changed_when: false |
Mark a read-only task as unchanged |
no_log: true |
Hide secrets from output |
Roles and collections
ansible-galaxy init roles/nginx
ansible-galaxy install -r requirements.yml
ansible-galaxy collection listPin versions in requirements.yml. Put overridable settings in defaults/main.yml and prefix variable names with the role name.
Vault
ansible-vault create group_vars/prod/vault.yml
ansible-vault edit group_vars/prod/vault.yml
ansible-vault encrypt_string 'value' --name 'vault_db_password'
ansible-playbook site.yml --vault-id prod@promptKeep the vault password out of the repository.
Safe rollout
- hosts: web
serial: "20%"
max_fail_percentage: 10Test with ansible-lint and Molecule. Use a canary batch and a health check before continuing.
Troubleshooting
| Symptom | First step |
|---|---|
| UNREACHABLE, publickey | ssh -vvv with the same user and key |
| Missing sudo password | Check become and sudoers |
| Missing variable | ansible-inventory --host, add default or assert |
| Slow run | gather_facts: false, more forks, profile_tasks |