Ansible

Ansible's command module executes a program directly with no shell, so pipes, redirects, globs and environment-variable expansion do not work. The shell module runs the command line through a shell on the target, so they do. Prefer command unless you need shell features.

An Ansible role is a fixed directory tree - tasks/, handlers/, defaults/, vars/, files/, templates/, meta/. Ansible auto-loads main.yml from each of those directories, and resolves copy and template sources against files/ and templates/.

The default filter supplies a value only when the variable is undefined. Passing true as a second argument also replaces empty or otherwise falsy values. Passing the special omit value removes the parameter from the task entirely, so the module applies its own default.

Ansible Vault symmetrically encrypts variable files or single values with a password so they can be committed to git. Ansible decrypts them in memory at run time. It protects secrets at rest only — anyone holding the password reads everything.

Ansible loads group_vars/ and host_vars/ from two places: the directory holding the inventory and the directory holding the playbook, with the playbook-adjacent copy winning. Across groups, a child group's file beats its parent's, and host_vars beat every group file.

Changed means the module actually altered the host during this run. The command and shell modules run an opaque command and cannot tell whether anything changed, so they report changed every time unless you add creates, removes, or changed_when.

Ansible cannot inspect what an arbitrary command did, so command and shell report changed whenever they run. Fix it with changed_when, evaluating the return code or output, with changed_when false for read-only commands, or with creates so the task is skipped entirely.

A handler runs only when a task that notifies it reports changed, and it runs once, at the end of the play, not at the point of notification. A meta flush_handlers task forces queued handlers to run earlier.

defaults/main.yml holds the role's overridable knobs: it is the lowest-precedence variable source, so almost anything a consumer sets wins. vars/main.yml sits far higher, so reserve it for role-internal constants the consumer should not have to change.

Ansible layers about 22 variable sources from role defaults at the bottom to command-line extra vars at the top, which always win. Facts sit below play vars; set_fact and registered vars sit near the top. Trace a value with the debug module and ansible-inventory.

The CI system injects the password from its own secret store, the job writes it to a private temporary file, and Ansible reads it with --vault-password-file or the ANSIBLE_VAULT_PASSWORD_FILE variable. Interactive prompting cannot work without a terminal.

The when keyword makes a task run only if its expression is true; otherwise the task is skipped for that host. The value is already evaluated as a Jinja expression, so wrapping it in curly braces is redundant and Ansible warns about it.

Set ansible_host to the real address or DNS name, ansible_port to 2222 and ansible_user to deploy. The inventory name stays a label used in patterns and for the host_vars filename; ansible_host is what Ansible actually connects to.

Modules are units of work shipped to the managed host and executed there by its Python interpreter, returning JSON. Plugins extend the control node itself — lookup, connection, callback, inventory, strategy, become — and run locally, never on the target.

A collection is Ansible's packaging and distribution unit: a namespace.name bundle of modules, plugins, roles and playbooks. Content inside it is addressed by fully qualified collection name, such as community.general.timezone, and installed with ansible-galaxy collection install.

import_role is static: Ansible expands the role when it parses the playbook, so its tasks inherit tags and show up in --list-tasks, but it cannot be looped. include_role is dynamic: resolved at runtime, so it can be looped and skipped as one unit.

register captures a task's result object for the host that ran it; set_fact computes a named value per host at run time; vars_files loads static YAML at the start of a play. A set_fact value is per host and survives into later plays of the same run, but not into the next run unless cacheable is set.

Encrypt a whole file when nearly everything in it is secret; use encrypt_string when a mostly-plaintext file needs one or two secret values. Whole-file encryption makes diffs unreadable; inline vault strings keep the surrounding YAML reviewable.

Replace the static file with a dynamic inventory plugin config — for EC2, a YAML file whose name ends in aws_ec2.yml declaring the amazon.aws.aws_ec2 plugin. Plugins are preferred over executable scripts because they are configured declaratively, support caching, and build groups from tags.

A custom Ansible module must declare its inputs through an argument_spec on AnsibleModule, compare current state with desired state, act only when they differ, honour check mode, and exit by printing JSON via exit_json with an accurate changed flag or fail_json with a message.

ignore_errors continues past a failed task but still marks it failed and offers no recovery path. block/rescue/always groups tasks, runs the rescue section when any task in the block fails, and always runs cleanup either way, so the host is marked recovered rather than failed.

Set serial on the play to run it in batches of hosts instead of all at once, optionally with max_fail_percentage to abort if a batch goes badly. Because the whole play repeats per batch, handlers flush at the end of each batch, so restarts roll host group by host group.

Declare every dependency in a version-controlled requirements.yml with an exact version, install it in CI with ansible-galaxy role install -r and ansible-galaxy collection install -r into a project-local path, and never rely on whatever happens to be on the control node.

Facts are produced by the setup module, which Ansible runs implicitly at the start of a play. Disabling gathering skips it, so no ansible_facts exist. Options are to re-enable gathering, run setup explicitly for the hosts that need it, narrow it with gather_subset, or enable fact caching.

Read it through the hostvars magic variable, indexed by the other host's inventory name, and find the hosts with groups. Inventory-defined values are always there, but another host's facts only exist if that host was played in this run or its facts are cached.

Rekey changes the password that encrypts the file, not the secrets inside it. Anyone with the old password and an old commit can still read the current credentials, because the plaintext never changed. Real rotation changes the credential at the system that issued it.

With a loop, the registered variable holds a results list with one entry per iteration, each carrying its own item and module return values, rather than a single result. The loop_control label sets what Ansible prints for each iteration instead of the whole item.

From the control node. Every Ansible lookup plugin runs locally, in the controller's Python process, using the controller's filesystem, environment and credentials — never on the managed host, regardless of which host the task targets.

A vault ID pairs a label with a password source, such as --vault-id prod@prompt, so one run can carry several vault passwords at once. The label is written into the encrypted file's header and tells Ansible which password to try first.