Chapter 3: Implementing an Ansible Playbook

Ansible playbooks cheat sheet

Everything from chapter 3 that you should be able to do without notes, plus the commands and file templates worth memorising.

The chapter in nine sentences

A play is an ordered list of tasks that runs against hosts selected from the inventory.
A playbook is a text file containing one or more plays, run in order.
Playbooks are written in YAML, which uses space indentation (never tabs) to show structure.
Plays are idempotent: they change nothing when the current state already matches the desired state.
Tasks use modules, standard code that implements one kind of change.
Modules are packaged in Ansible Content Collections and named by their FQCN, like ansible.builtin.copy.
ansible-navigator doc lists the modules in your execution environment and shows their documentation and examples.
ansible-navigator run runs playbooks and, with --syntax-check, validates them.
ansible.cfg and ansible-navigator.yml in the project directory configure the inventory, connection user, privilege escalation and execution environment.

Templates to memorise

ansible.cfg

[defaults]
inventory = ./inventory
remote_user = devops
ask_pass = false

[privilege_escalation]
become = true
become_method = sudo
become_user = root
become_ask_pass = false

ansible-navigator.yml

---
ansible-navigator:
  execution-environment:
    image: utility.lab.example.com/ee-supported-rhel8:latest   # home lab: use  enabled: false  instead of image/pull
    pull:
      policy: missing
  playbook-artifact:
    enable: false

inventory

[web]
server[a:b].lab.example.com

[db]
serverc.lab.example.com

[prod:children]
web
db

site.yml

---
- name: Web server is configured
  hosts: web
  become: true
  tasks:
    - name: httpd is installed
      ansible.builtin.dnf:
        name: httpd
        state: present

    - name: httpd is started and enabled
      ansible.builtin.service:
        name: httpd
        state: started
        enabled: true

- name: Web server responds
  hosts: localhost
  become: false
  tasks:
    - name: Home page returns 200
      ansible.builtin.uri:
        url: http://servera.lab.example.com
        status_code: 200

Command cheat sheet

Goal	Command
Show one group as a tree	`ansible-navigator inventory -m stdout --graph GROUP`
Dump the whole inventory as JSON	`ansible-navigator inventory -m stdout --list`
Is this host in the inventory?	`ansible-navigator inventory -m stdout --host HOST`
Use a different inventory	add `-i PATH` to any command
See the effective configuration	`ansible-navigator config`
List modules in the EE	`ansible-navigator doc -l -m stdout`
Read a module's docs	`ansible-navigator doc MODULE -m stdout`
Browse collections	`ansible-navigator collections`
Check syntax	`ansible-navigator run -m stdout site.yml --syntax-check`
Dry run	`ansible-navigator run -m stdout site.yml --check`
Run	`ansible-navigator run -m stdout site.yml`
Run with more detail	add `-v` … `-vvvv`
Prompt for SSH password	add `--ask-pass` (artifacts disabled, `-m stdout`)

File	Lookup order (first found wins)
`ansible.cfg`	`$ANSIBLE_CONFIG` → `./ansible.cfg` → `~/.ansible.cfg` → `/etc/ansible/ansible.cfg`
`ansible-navigator.yml`	`$ANSIBLE_NAVIGATOR_CONFIG` → `./ansible-navigator.yml` → `~/.ansible-navigator.yml`
Connection user	`ansible_user` → play `remote_user` → `ansible.cfg` `remote_user` → root in the EE

Which two groups always exist in an inventory?: `all` (every host) and `ungrouped` (hosts in no other group).
How do you make a group of groups?: A section named `[parent:children]` listing the child **group** names.
What does `server[01:03]` expand to?: server01, server02, server03. Inclusive, and leading zeros are kept.
Where does Ansible look for ansible.cfg first?: The file named by `ANSIBLE_CONFIG`, then `./ansible.cfg` in the current directory.
Are settings merged across several ansible.cfg files?: No. Only the **first file found** is used.
What is the difference between remote_user and become_user?: `remote_user` is who Ansible **logs in** as; `become_user` is who it **switches to** afterwards (usually root).
Two YAML indentation rules?: Same level → same indentation. Children → indented more than their parent. Spaces only.
What is an FQCN?: Fully qualified collection name: `namespace.collection.module`, e.g. `ansible.posix.firewalld`.
--syntax-check versus --check?: `--syntax-check` only parses the YAML. `--check` connects to hosts and reports what would change.
How do you make a command task idempotent?: Add `creates:` or `removes:`, or better, use a purpose-built module.
Which module works without Python on the host?: `ansible.builtin.raw`
What does hosts: localhost mean under ansible-navigator?: The tasks run inside the **execution environment container**.