AUTOMATE
EVERYWHERE

What is Ansible?

Ansible is an open-source automation tool that handles configuration management, application deployment, and IT orchestration. It's designed to be simple, powerful, and agentless.

Key Principles

• Agentless: No agents to install on managed nodes
• Idempotent: Running the same playbook multiple times produces the same result
• Declarative: You describe the desired state, Ansible makes it so
• YAML-based: Playbooks are written in easy-to-read YAML

How Ansible Works

1. Control Node: The machine where Ansible is installed
2. Managed Nodes: The servers you want to manage
3. Inventory: A list of managed nodes
4. Modules: Units of work that Ansible executes
5. Playbooks: YAML files defining automation tasks

Installing Ansible

# On Ubuntu/Debian
sudo apt update
sudo apt install ansible

# On RHEL/CentOS
sudo yum install ansible

# Check version
ansible --version

Quiz

Inventory

The inventory is a list of hosts that Ansible manages. It can be a simple file or a dynamic script.

Static Inventory File

[webservers]
web1.example.com
web2.example.com

[databases]
db1.example.com
db2.example.com

[all:vars]
ansible_user=ubuntu

Ad-Hoc Commands

Quick one-liner commands for testing:

# Ping all hosts
ansible all -m ping

# Check disk space
ansible all -a "df -h"

# Copy file to all webservers
ansible webservers -m copy -a "src=/tmp/file dest=/tmp/"

# Install package
ansible all -m apt -a "name=vim state=present"

Quiz

Your First Playbook

Playbooks are YAML files that define your automation tasks:

---
- name: My first playbook
  hosts: webservers
  become: yes
  tasks:
    - name: Install nginx
      apt:
        name: nginx
        state: present

    - name: Start nginx service
      service:
        name: nginx
        state: started
        enabled: yes

Running a Playbook

ansible-playbook site.yml

Key Concepts

• --- YAML document start
• name: Descriptive name for play/task
• hosts: Target inventory hosts
• become: Escalate privileges (sudo)
• tasks: List of actions to perform

Quiz

Common Modules

Ansible ships with thousands of modules. Here are the most common:

file Module

- name: Create a directory
  file:
    path: /tmp/mydir
    state: directory
    mode: '0755'

- name: Create a symlink
  file:
    src: /tmp/file
    dest: /tmp/link
    state: link

copy Module

- name: Copy file with permissions
  copy:
    src: /local/file.conf
    dest: /etc/app/file.conf
    owner: app
    group: app
    mode: '0644'

command & shell

- name: Run command
  command: /usr/bin/myapp --version

- name: Run shell command
  shell: cat /etc/os-release

Quiz

Defining Variables

---
- name: Using variables
  hosts: all
  vars:
    app_port: 8080
    app_user: myapp
  tasks:
    - name: Create user
      user:
        name: "{{ app_user }}"

    - name: Configure app
      template:
        src: app.conf.j2
        dest: /etc/app/config.conf

Facts

Facts are system information collected by Ansible:

# Display all facts
ansible all -m setup

# Filter facts
ansible all -m setup -a "filter=ansible_*_mb"

# Access in playbook
- debug:
    msg: "{{ ansible_distribution }}"

Registered Variables

- name: Run command and register output
  command: /usr/bin/myapp status
  register: app_status

- name: Display output
  debug:
    msg: "{{ app_status.stdout }}"

Quiz

Conditionals (when)

Run tasks conditionally based on variables or facts:

- name: Install Apache on Debian
  apt:
    name: apache2
    state: present
  when: ansible_os_family == "Debian"

- name: Install Apache on RedHat
  yum:
    name: httpd
    state: present
  when: ansible_os_family == "RedHat"

Loops (with_items)

- name: Create multiple users
  user:
    name: "{{ item }}"
    state: present
  with_items:
    - alice
    - bob
    - charlie

- name: Install multiple packages
  apt:
    name: "{{ item }}"
    state: present
  with_items:
    - vim
    - git
    - curl

Quiz

What are Roles?

Roles organize playbooks into reusable components with a standard directory structure:

Role Directory Structure

roles/
  common/
    defaults/
      main.yml
    handlers/
      main.yml
    tasks/
      main.yml
    templates/
    files/

Using a Role

---
- name: Deploy webserver
  hosts: webservers
  roles:
    - common
    - nginx
    - php

Role defaults/main.yml

---
nginx_port: 80
nginx_user: www-data
nginx_workers: 4

Quiz

Jinja2 Templates

Ansible uses Jinja2 for templating. Templates end in .j2:

Template Example

server {
    listen {{ nginx_port }};
    server_name {{ domain_name }};
    user {{ nginx_user }};
    worker_processes {{ nginx_workers }};

    {% if ssl_enabled %}
    ssl_certificate {{ ssl_cert_path }};
    ssl_certificate_key {{ ssl_key_path }};
    {% endif %}

    location / {
        root {{ document_root }};
        index index.html index.htm;
    }
}

Using Templates in Playbook

- name: Configure nginx
  template:
    src: nginx.conf.j2
    dest: /etc/nginx/nginx.conf
  notify: Restart nginx

Template Filters

{{ my_variable | default('fallback') }}
{{ my_string | upper }}
{{ my_string | lower }}
{{ my_list | join(',') }}

Quiz

Ansible Vault

Ansible Vault encrypts sensitive data like passwords and keys:

Creating Encrypted Files

# Create new encrypted file
ansible-vault create secrets.yml

# Encrypt existing file
ansible-vault encrypt secrets.yml

# Decrypt file
ansible-vault decrypt secrets.yml

# Edit encrypted file
ansible-vault edit secrets.yml

# Change password
ansible-vault rekey secrets.yml

Using Vault in Playbooks

# Require vault password at runtime
ansible-playbook site.yml --ask-vault-pass

# Use vault password file
ansible-playbook site.yml --vault-password-file ~/.vault_pass

Best Practices

• Never commit encrypted files to git
• Use --ask-vault-pass for interactive runs
• Use password files only in secure environments
• Rotate vault passwords regularly

Quiz

Blocks

Blocks group tasks and allow error handling:

- name: Handle errors
  block:
    - name: Try this
      debug:
        msg: "This might fail"

    - name: This too
      command: /usr/bin/failing-command
  rescue:
    - name: Handle failure
      debug:
        msg: "Something went wrong"
  always:
    - name: Always run
      debug:
        msg: "This always runs"

Ignoring Errors

- name: This might fail
  command: /usr/bin/risky-command
  ignore_errors: yes

Debug Module

- debug:
    msg: "Hello"

- debug:
    var: my_variable

- debug:
    msg: "{{ ansible_failed_task.name }} failed"

Quiz

molecule

Molecule tests Ansible roles in containers:

# Install molecule
pip install molecule

# Initialize new role with molecule
molecule init role my-role

# Run tests
cd my-role
molecule test

# Run different scenarios
molecule converge
molecule verify

ansible-lint

Lints playbooks for best practices:

# Install ansible-lint
pip install ansible-lint

# Lint a playbook
ansible-lint site.yml

# With custom rules
ansible-lint site.yml -R rules/

CI/CD Integration

# GitHub Actions example
- name: Test Ansible
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v2
    - name: Lint
      run: ansible-lint site.yml
    - name: Test
      run: molecule test

Quiz

AWX / Ansible Automation Platform

AWX provides a web UI and REST API for Ansible:

• Web-based interface
• Role-based access control
• Job scheduling
• Inventory management
• Credential management

Collections

Collections organize Ansible content:

# Install collection
ansible-collection install community.postgresql

# Use in playbook
- name: Install PostgreSQL
  community.postgresql.postgresql_db:
    name: mydb
    state: present

Production Best Practices

• Use version control for all playbooks
• Test with molecule before production
• Use roles for reusability
• Separate dev/staging/production inventories
• Use CI/CD for automation
• Implement proper secret management

Quiz