← all cheat sheets

OPERATOR REFERENCE · ANSIBLE

Ansible Field Reference
Inventory, Playbooks & Modules

setup → inventory → playbook → modules → vault — one page, every day

CONTROL NODE · playbooks / inventory

ssh / winrm, agentless

MANAGED NODES · no daemon required

01 Setup & Config

◎

Install & Verify

pip install ansible ansible --version

⚙

ansible.cfg

[defaults]
inventory = ./inventory.ini
host_key_checking = False

Search order: ANSIBLE_CONFIG env var → ./ansible.cfg → ~/.ansible.cfg → /etc/ansible/ansible.cfg

✓

Test Connectivity

ansible all -m ping ansible all -m ping -i inventory.ini

02 Inventory & Ad-Hoc Commands

▤

Static Inventory (INI)

[web]
web01.example.com
web02.example.com

[db]
db01.example.com ansible_user=admin

▥

Static Inventory (YAML)

web:
  hosts:
    web01.example.com:
    web02.example.com:

▶

Ad-Hoc: Shell / Command

ansible web -m shell -a "uptime" ansible web -m command -a "df -h"

shell supports pipes/redirects; command does not — prefer command when possible.

▣

Ad-Hoc: Facts & Groups

ansible all -m setup ansible-inventory --list -i inventory.ini

03 Playbooks — Core Structure

▦

Minimal Playbook

- name: Configure web servers
  hosts: web
  become: true
  tasks:
    - name: Install nginx
      apt:
        name: nginx
        state: present

▶

Run It

ansible-playbook site.yml ansible-playbook site.yml --check --diff ansible-playbook site.yml --limit web01

--check --diff is a dry run that shows what would change — always run it first against production.

04 Common Modules

📄

copy / template

- copy:
    src: app.conf
    dest: /etc/app.conf

- template:
    src: app.conf.j2
    dest: /etc/app.conf

template renders Jinja2 first; copy moves the file byte-for-byte.

📦

package / apt / yum

- apt:
    name: nginx
    state: present
    update_cache: true

⚙

service

- service:
    name: nginx
    state: started
    enabled: true

✎

lineinfile / file

- lineinfile:
    path: /etc/hosts
    line: "10.0.0.5 app01"

- file:
    path: /var/log/app
    state: directory
    mode: '0755'

👤

user

- user:
    name: deploy
    groups: sudo
    shell: /bin/bash

↺

handlers

handlers:
  - name: restart nginx
    service:
      name: nginx
      state: restarted

Triggered by notify on a task, and run once at the very end — not per matching task.

05 Variables, Templating & Control Flow

Variables

vars:
  app_port: 8080

group_vars/web.yml
host_vars/web01.yml

Precedence: host_vars > group_vars > playbook vars > role defaults (roughly, most-specific wins).

{}

Jinja2 Templating

Listen {{ app_port }}
{% if env == "prod" %}
workers 4;
{% endif %}

register / when

- command: systemctl is-active nginx
  register: result
  ignore_errors: true

- debug:
    msg: "down"
  when: result.rc != 0

↻

loop

- apt:
    name: "{{ item }}"
  loop:
    - nginx
    - curl
    - git

◈

Facts

{{ ansible_facts['os_family'] }}
{{ ansible_default_ipv4.address }}

Gathered automatically at play start unless gather_facts: false.

Role Layout

roles/web/
  tasks/main.yml
  handlers/main.yml
  templates/
  files/
  vars/main.yml
  defaults/main.yml

ansible-galaxy init roles/web

↓

Use Roles / Install from Galaxy

- hosts: web
  roles:
    - web
    - { role: common, tags: ['base'] }

ansible-galaxy install geerlingguy.nginx

07 Vault — Secrets Management

🔒

Create / Edit

ansible-vault create secrets.yml ansible-vault edit secrets.yml

⇄

Encrypt / Decrypt

ansible-vault encrypt vars.yml ansible-vault decrypt vars.yml

⚠ decrypt writes the plaintext back to disk — don't commit it

▶

Run with Vault

ansible-playbook site.yml --ask-vault-pass ansible-playbook site.yml --vault-password-file .vault_pass

08 Common Errors & Quick Reference

Symptom	Fix
UNREACHABLE — SSH connection refused	check inventory host, ansible_port, firewall
Permission denied on task	add become: true / --ask-become-pass
Python interpreter not found on target	set ansible_python_interpreter
Task always shows "changed"	module isn't idempotent — check for a shell/command w/o changed_when
Vault decryption failed	wrong --vault-password-file / key mismatch
Variable undefined	check precedence: host_vars vs group_vars vs defaults

Command	Purpose
ansible-playbook site.yml -vvv	debug verbose SSH & module output
ansible-playbook site.yml --syntax-check	safe validates YAML/module syntax only
ansible-playbook site.yml --check --diff	safe dry run, shows proposed changes
ansible-playbook site.yml --step	caution confirm each task interactively
ansible-doc apt	view a module's full parameter reference
ansible-lint site.yml	static analysis for style/best-practice issues