What is an Ansible inventory, and what do the built-in `all` and `ungrouped` groups contain?

## Why an inventory exists Ansible installs no agent. It connects outward, usually over SSH, runs a module and disconnects, which means it cannot discover infrastructure on its own. The inventory is the single source of "which machines may this run touch", and that is why interviewers treat it as a blast-radius question rather than a file-format question. An inventory source can be a static file, a directory of files that Ansible parses and merges, a dynamic inventory plugin configured by a YAML file, or an executable script that prints JSON. You point at it with `-i` (repeatable), or set `inventory` in `ansible.cfg`. The historical default is `/etc/ansible/hosts`, which real projects almost never use because inventory belongs in the repository next to the playbooks. ## The INI format ```ini [webservers] web01 ansible_host=10.0.1.11 web[02:05].example.com [dbservers] db01 ansible_host=10.0.2.21 [prod:children] webservers dbservers [prod:vars] ntp_server=time.internal ``` Three section shapes matter: a bare `[group]` lists hosts, `[group:vars]` attaches variables to the whole group, and `[group:children]` makes a group of groups. `web[02:05].example.com` is a host range, expanding to four hosts. Inline `key=value` after a host name sets host variables. ## The YAML format ```yaml all: children: webservers: hosts: web01: ansible_host: 10.0.1.11 dbservers: hosts: db01: {} prod: children: webservers: {} dbservers: {} vars: ntp_server: time.internal ``` YAML expresses the same model with real nesting and typed values, and it is what most teams standardise on. Note the shape: a group has `hosts:` and/or `children:` and optionally `vars:`. ## Groups, nesting and membership A host may be in many groups, and group membership is transitive upward: a host in `webservers` is also in `prod` when `prod` lists `webservers` as a child. That is what makes `hosts: prod` work without repeating hosts. Groups are just labels — they carry no ordering or ownership beyond variable resolution. ## The implicit groups `all` is created for you and contains every host the inventory produced, including hosts that came from a dynamic plugin. `ungrouped` contains hosts that ended up in no group other than `all` — usually hosts listed at the top of an INI file before any `[section]` header. Seeing hosts in `ungrouped` when you expected them in `webservers` is a fast signal that a section header is missing or misspelled. One special case surprises people: Ansible provides an *implicit localhost* with `ansible_connection=local`, so `hosts: localhost` works even when localhost is nowhere in the inventory. That implicit entry is not matched by `all` or `*`; you must name it. ## Verifying before you run ```bash ansible-inventory -i inventories/prod --graph ansible-inventory -i inventories/prod --list --yaml ansible-playbook -i inventories/prod site.yml --list-hosts ``` `--graph` prints the group tree with hosts under it, `--list` dumps hosts with their resolved variables, and `--list-hosts` on a playbook shows exactly which hosts a play would target. Running these first is the cheap habit that prevents "I thought that group was empty". ## What goes wrong in practice Hosts silently landing in `ungrouped`; a group name typo so `hosts: webserver` matches nothing; assuming `all` includes the control node; and treating the inventory as documentation rather than as the executable definition of blast radius. In a real repository the inventory is reviewed as carefully as the playbooks, because adding one line to the wrong group is enough to reconfigure a production database.