┌─────────────────────────────────────────────────────────────┐
│                 Ansible Automation Platform                 │
│                                                             │
│  ┌─────────────────┐     ┌──────────────────────────────┐   │
│  │ Automation Hub  │     │    Automation Controller     │   │
│  │                 │     │                              │   │
│  │ - Certified     │     │  ┌────────────────────────┐  │   │
│  │   Collections   │     │  │     Job Templates      │  │   │
│  │ - Private repo  │◄────┤  │     Workflows          │  │   │
│  │ - Sync from     │     │  │     Schedules          │  │   │
│  │   Galaxy        │     │  │     Credentials        │  │   │
│  └─────────────────┘     │  │     Inventories        │  │   │
│                          │  │     Projects (SCM)     │  │   │
│  ┌─────────────────┐     │  └────────────────────────┘  │   │
│  │  Event Driven   │     └──────────────────────────────┘   │
│  │  Ansible (EDA)  │                   │                    │
│  │                 │     ┌─────────────▼────────────────┐   │
│  │ - Rulebooks     │     │    Execution Environments    │   │
│  │ - Event sources │     │  (containerized Ansible)     │   │
│  │ - Kafka/webhook │     └──────────────────────────────┘   │
│  └─────────────────┘                                        │
│                                                             │
│  ┌──────────────────────────────────────────────────────┐   │
│  │            Automation Analytics (optional)           │   │
│  │   Job history, savings calculator, host metrics      │   │
│  └──────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────┘

Organization
├── Teams
│   ├── Team: Developers
│   │   └── Role: Execute (Job Templates only)
│   └── Team: Ops
│       └── Role: Admin (all resources)
├── Users
├── Inventories
├── Projects
├── Job Templates
└── Credentials

# Built-in credential types:
Machine          # SSH key/password for managed nodes
Source Control   # Git username/token/SSH key
Vault            # Ansible Vault password
AWS              # Access key + secret
GCP              # Service account JSON
Azure            # Client ID + secret
OpenShift/K8s    # Kubeconfig / bearer token
HashiCorp Vault  # AppRole / token
CyberArk         # API credentials

Name:          Deploy App
Inventory:     Production Inventory
Project:       App Deployment (Git)
Playbook:      deploy.yml
Credentials:
  - Machine: prod-ssh-key
  - Vault: prod-vault-pass
  - AWS: prod-aws-creds
Extra Vars:
  env: production
  version: "{{ tower_job_id }}"
Verbosity:     1 (Verbose)
Job Tags:      deploy,config
Limit:         webservers           # Run only on webservers group
Concurrent:    false                # Prevent parallel runs
Timeout:       3600
Survey:        enabled              # Runtime input form

┌─────────────┐     ┌──────────────┐     ┌─────────────────┐
│  Run Tests  │────►│ Deploy App   │────►│ Smoke Tests     │
└─────────────┘     └──────────────┘     └────────┬────────┘
                           │                      │
                      on_failure             on_success
                           │                      │
                    ┌──────▼──────┐      ┌────────▼────────┐
                    │  Rollback   │      │ Notify Slack    │
                    └─────────────┘      └─────────────────┘

# Workflow node conditions:
on_success    # Run next node if this one succeeds
on_failure    # Run next node if this one fails
always        # Run next node regardless of result

# Survey fields on a Job Template
- variable: app_version
  question_name: "App Version to Deploy"
  type: text
  required: true
  default: "latest"
- variable: environment
  question_name: "Target Environment"
  type: multiplechoice
  choices:
    - dev
    - staging
    - production
  required: true
- variable: replica_count
  question_name: "Number of Replicas"
  type: integer
  min: 1
  max: 10
  default: 2

# Launch a job template via API
curl -X POST \
  https://aap.example.com/api/v2/job_templates/42/launch/ \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "extra_vars": {
      "env": "production",
      "version": "2.1.0"
    },
    "limit": "webservers"
  }'
# Check job status
curl -X GET \
  https://aap.example.com/api/v2/jobs/1234/ \
  -H "Authorization: Bearer $TOKEN"
# Get job output
curl -X GET \
  https://aap.example.com/api/v2/jobs/1234/stdout/?format=txt \
  -H "Authorization: Bearer $TOKEN"

┌────────────────────────────────────────────────────────┐
│                 Infrastructure Lifecycle               │
│                                                        │
│  ┌───────────────┐          ┌──────────────────────┐   │
│  │   Terraform   │          │       Ansible        │   │
│  │               │          │                      │   │
│  │ - Provision   │─────────►│ - Configure OS       │   │
│  │   VMs/cloud   │          │ - Install software   │   │
│  │ - Networks    │          │ - Deploy apps        │   │
│  │ - Storage     │          │ - Manage users       │   │
│  │ - Kubernetes  │          │ - Day-2 operations   │   │
│  │               │          │                      │   │
│  │ "Build it"    │          │ "Configure it"       │   │
│  └───────────────┘          └──────────────────────┘   │
│         │                            │                 │
│         └────────────────────────────┘                 │
│                  Works together                        │
└────────────────────────────────────────────────────────┘

# main.tf — Terraform creates EC2 instances
resource "aws_instance" "web" {
  count         = 3
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.medium"
  tags = {
    Name        = "web-${count.index + 1}"
    Role        = "webserver"
    Environment = "production"
  }
  # Run Ansible after instance is created
  provisioner "local-exec" {
    command = <<-EOT
      sleep 30  # Wait for SSH
      ansible-playbook \
        -i '${self.public_ip},' \
        -u ec2-user \
        --private-key ~/.ssh/prod-key.pem \
        playbooks/configure-webserver.yml \
        --extra-vars "env=production"
    EOT
  }
}
# Output IPs for Ansible dynamic inventory
output "web_ips" {
  value = aws_instance.web[*].public_ip
}

# outputs.tf
output "web_servers" {
  value = {
    for idx, instance in aws_instance.web :
    "web-${idx + 1}" => {
      ip       = instance.public_ip
      private  = instance.private_ip
      az       = instance.availability_zone
    }
  }
}

#!/usr/bin/env python3
# dynamic_inventory.py — reads Terraform state for Ansible inventory
import json
import subprocess
import sys
def get_terraform_output():
    result = subprocess.run(
        ["terraform", "output", "-json"],
        capture_output=True, text=True
    )
    return json.loads(result.stdout)
def build_inventory():
    tf_output = get_terraform_output()
    web_servers = tf_output["web_servers"]["value"]
    inventory = {
        "webservers": {
            "hosts": list(web_servers.keys()),
        },
        "_meta": {
            "hostvars": {
                name: {
                    "ansible_host": data["ip"],
                    "private_ip": data["private"],
                    "az": data["az"],
                    "ansible_user": "ec2-user"
                }
                for name, data in web_servers.items()
            }
        }
    }
    return inventory
print(json.dumps(build_inventory()))

# Use dynamic inventory
ansible-playbook -i dynamic_inventory.py configure.yml

# playbook — use Ansible to run Terraform
- name: Provision infrastructure with Terraform
  hosts: localhost
  gather_facts: false
  tasks:
    - name: Terraform init
      community.general.terraform:
        project_path: ./terraform
        state: present
        force_init: true
        backend_config:
          bucket: my-tf-state
          key: prod/terraform.tfstate
          region: us-east-1
        variables:
          environment: production
          instance_count: "3"
          instance_type: t3.medium
      register: tf_result
    - name: Show outputs
      debug:
        var: tf_result.outputs
    - name: Add new hosts to inventory
      add_host:
        name: "{{ item.key }}"
        ansible_host: "{{ item.value.ip }}"
        groups: webservers
      loop: "{{ tf_result.outputs.web_servers.value | dict2items }}"
- name: Configure newly provisioned servers
  hosts: webservers
  become: true
  roles:
    - common
    - webserver

# data.tf — read existing Terraform state in another playbook
data "terraform_remote_state" "network" {
  backend = "s3"
  config = {
    bucket = "my-tf-state"
    key    = "network/terraform.tfstate"
    region = "us-east-1"
  }
}
# Use VPC ID from network state
resource "aws_instance" "web" {
  subnet_id = data.terraform_remote_state.network.outputs.subnet_id
}

# Ansible reading Terraform state directly
- name: Read Terraform state
  hosts: localhost
  tasks:
    - name: Get TF state from S3
      amazon.aws.s3_object:
        bucket: my-tf-state
        object: prod/terraform.tfstate
        dest: /tmp/terraform.tfstate
        mode: get
    - name: Parse state
      set_fact:
        tf_state: "{{ lookup('file', '/tmp/terraform.tfstate') | from_json }}"
    - name: Extract outputs
      set_fact:
        web_ips: >-
          {{ tf_state.outputs.web_ips.value }}

┌──────────────────────────────────────────────────────────────┐
│                     CI/CD Pipeline                           │
│                                                              │
│  Code Push                                                   │
│     │                                                        │
│     ▼                                                        │
│  ┌──────┐   ┌────────┐   ┌──────────┐   ┌────────────────┐   │
│  │ SCM  │──►│  CI    │──►│ Ansible  │──►│   Production   │   │
│  │(Git) │   │(build/ │   │(deploy/  │   │  (live env)    │   │
│  │      │   │ test)  │   │ config)  │   │                │   │
│  └──────┘   └────────┘   └──────────┘   └────────────────┘   │
│                                                              │
└──────────────────────────────────────────────────────────────┘

// Jenkinsfile
pipeline {
    agent any
    environment {
        ANSIBLE_HOST_KEY_CHECKING = 'False'
        VAULT_PASSWORD_FILE = credentials('ansible-vault-pass')
    }
    parameters {
        choice(
            name: 'ENVIRONMENT',
            choices: ['dev', 'staging', 'production'],
            description: 'Target environment'
        )
        string(
            name: 'APP_VERSION',
            defaultValue: 'latest',
            description: 'Version to deploy'
        )
    }
    stages {
        stage('Checkout') {
            steps {
                git branch: 'main',
                    url: 'https://github.com/myorg/ansible-playbooks.git',
                    credentialsId: 'github-token'
            }
        }
        stage('Lint & Syntax Check') {
            steps {
                sh '''
                    pip install ansible-lint
                    ansible-lint playbooks/deploy.yml
                    ansible-playbook playbooks/deploy.yml --syntax-check
                '''
            }
        }
        stage('Molecule Tests') {
            when {
                branch 'main'
            }
            steps {
                sh '''
                    pip install molecule molecule-docker
                    cd roles/myapp
                    molecule test
                '''
            }
        }
        stage('Deploy to Dev') {
            when {
                expression { params.ENVIRONMENT == 'dev' }
            }
            steps {
                sh """
                    ansible-playbook playbooks/deploy.yml \
                        -i inventories/dev/hosts.yml \
                        --vault-password-file ${VAULT_PASSWORD_FILE} \
                        -e app_version=${params.APP_VERSION} \
                        -e env=dev
                """
            }
        }
        stage('Deploy to Staging') {
            when {
                expression { params.ENVIRONMENT == 'staging' }
            }
            steps {
                sh """
                    ansible-playbook playbooks/deploy.yml \
                        -i inventories/staging/hosts.yml \
                        --vault-password-file ${VAULT_PASSWORD_FILE} \
                        -e app_version=${params.APP_VERSION} \
                        -e env=staging
                """
            }
            post {
                success {
                    // Trigger smoke tests
                    sh 'ansible-playbook playbooks/smoke-tests.yml -i inventories/staging/hosts.yml'
                }
            }
        }
        stage('Approval') {
            when {
                expression { params.ENVIRONMENT == 'production' }
            }
            steps {
                timeout(time: 1, unit: 'HOURS') {
                    input message: 'Deploy to Production?',
                          ok: 'Deploy',
                          submitter: 'ops-team'
                }
            }
        }
        stage('Deploy to Production') {
            when {
                expression { params.ENVIRONMENT == 'production' }
            }
            steps {
                sh """
                    ansible-playbook playbooks/deploy.yml \
                        -i inventories/production/hosts.yml \
                        --vault-password-file ${VAULT_PASSWORD_FILE} \
                        -e app_version=${params.APP_VERSION} \
                        -e env=production \
                        --diff
                """
            }
        }
    }
    post {
        success {
            slackSend channel: '#deployments',
                      message: "✅ Deploy ${params.APP_VERSION} to ${params.ENVIRONMENT} succeeded"
        }
        failure {
            slackSend channel: '#deployments',
                      message: "❌ Deploy ${params.APP_VERSION} to ${params.ENVIRONMENT} FAILED"
            // Auto rollback on production failure
            script {
                if (params.ENVIRONMENT == 'production') {
                    sh 'ansible-playbook playbooks/rollback.yml -i inventories/production/hosts.yml'
                }
            }
        }
    }
}

# .gitlab-ci.yml
stages:
  - lint
  - test
  - deploy-dev
  - deploy-staging
  - deploy-prod
variables:
  ANSIBLE_HOST_KEY_CHECKING: "false"
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.pip-cache"
# Reusable anchor for Ansible setup
.ansible_setup: &ansible_setup
  image: python:3.11-slim
  before_script:
    - pip install ansible ansible-lint molecule[docker] --quiet
    - ansible-galaxy collection install -r requirements.yml
    - echo "$VAULT_PASSWORD" > /tmp/vault_pass
# Lint stage
ansible-lint:
  <<: *ansible_setup
  stage: lint
  script:
    - ansible-lint
    - ansible-playbook site.yml --syntax-check -i inventories/dev/
# Molecule tests
molecule-test:
  <<: *ansible_setup
  stage: test
  services:
    - docker:dind
  variables:
    DOCKER_HOST: tcp://docker:2376
  script:
    - |
      for role in roles/*/; do
        echo "Testing role: $role"
        cd "$role"
        molecule test
        cd -
      done
  only:
    - merge_requests
    - main
# Deploy to dev
deploy-dev:
  <<: *ansible_setup
  stage: deploy-dev
  script:
    - |
      ansible-playbook deploy.yml \
        -i inventories/dev/hosts.yml \
        --vault-password-file /tmp/vault_pass \
        -e app_version=$CI_COMMIT_SHA \
        -e env=dev
  environment:
    name: development
    url: https://dev.example.com
  only:
    - main
# Deploy to staging
deploy-staging:
  <<: *ansible_setup
  stage: deploy-staging
  script:
    - |
      ansible-playbook deploy.yml \
        -i inventories/staging/hosts.yml \
        --vault-password-file /tmp/vault_pass \
        -e app_version=$CI_COMMIT_TAG \
        -e env=staging
  environment:
    name: staging
    url: https://staging.example.com
  only:
    - tags
# Deploy to production — manual gate
deploy-prod:
  <<: *ansible_setup
  stage: deploy-prod
  script:
    - |
      ansible-playbook deploy.yml \
        -i inventories/production/hosts.yml \
        --vault-password-file /tmp/vault_pass \
        -e app_version=$CI_COMMIT_TAG \
        -e env=production \
        --diff
  environment:
    name: production
    url: https://example.com
  when: manual                        # Manual trigger
  allow_failure: false
  only:
    - tags

# .github/workflows/deploy.yml
name: Deploy with Ansible
on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment'
        required: true
        type: choice
        options: [dev, staging, production]
      version:
        description: 'Version to deploy'
        required: true
        default: 'latest'
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - name: Install Ansible
        run: pip install ansible ansible-lint
      - name: Run ansible-lint
        run: ansible-lint
      - name: Syntax check
        run: ansible-playbook deploy.yml --syntax-check -i inventories/dev/
  molecule-test:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v4
      - name: Install dependencies
        run: pip install ansible molecule[docker]
      - name: Run Molecule tests
        run: |
          for role in roles/*/; do
            cd "$role" && molecule test && cd -
          done
  deploy:
    runs-on: ubuntu-latest
    needs: molecule-test
    environment: ${{ github.event.inputs.environment || 'dev' }}
    steps:
      - uses: actions/checkout@v4
      - name: Install Ansible + collections
        run: |
          pip install ansible
          ansible-galaxy collection install -r requirements.yml
      - name: Write vault password
        run: echo "${{ secrets.VAULT_PASSWORD }}" > /tmp/vault_pass
      - name: Write SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
      - name: Deploy
        run: |
          ansible-playbook deploy.yml \
            -i inventories/${{ github.event.inputs.environment }}/hosts.yml \
            --vault-password-file /tmp/vault_pass \
            --private-key ~/.ssh/id_rsa \
            -e app_version=${{ github.event.inputs.version }} \
            -e env=${{ github.event.inputs.environment }}
      - name: Cleanup secrets
        if: always()
        run: |
          rm -f /tmp/vault_pass ~/.ssh/id_rsa

# aap_trigger.py — trigger AAP job from CI pipeline
import requests
import time
import sys
AAP_URL = "https://aap.example.com"
TOKEN = os.environ["AAP_TOKEN"]
JOB_TEMPLATE_ID = 42
def launch_job(extra_vars):
    response = requests.post(
        f"{AAP_URL}/api/v2/job_templates/{JOB_TEMPLATE_ID}/launch/",
        headers={"Authorization": f"Bearer {TOKEN}"},
        json={"extra_vars": extra_vars},
        verify=True
    )
    response.raise_for_status()
    return response.json()["id"]
def wait_for_job(job_id, timeout=3600):
    start = time.time()
    while time.time() - start < timeout:
        response = requests.get(
            f"{AAP_URL}/api/v2/jobs/{job_id}/",
            headers={"Authorization": f"Bearer {TOKEN}"}
        )
        job = response.json()
        status = job["status"]
        print(f"Job {job_id} status: {status}")
        if status == "successful":
            return True
        elif status in ["failed", "error", "canceled"]:
            return False
        time.sleep(15)
    raise TimeoutError(f"Job {job_id} timed out")
# Usage in CI
job_id = launch_job({
    "env": "production",
    "version": os.environ["APP_VERSION"]
})
success = wait_for_job(job_id)
sys.exit(0 if success else 1)

- name: Rolling deployment
  hosts: webservers
  serial: 1                         # One host at a time
  # serial: "25%"                   # Or 25% at a time
  max_fail_percentage: 0            # Stop on any failure
  pre_tasks:
    - name: Remove from load balancer
      uri:
        url: "http://lb.example.com/api/drain/{{ inventory_hostname }}"
        method: POST
      delegate_to: localhost
  roles:
    - deploy-app
  post_tasks:
    - name: Health check
      uri:
        url: "http://{{ ansible_host }}:8080/health"
        status_code: 200
      retries: 5
      delay: 10
    - name: Re-add to load balancer
      uri:
        url: "http://lb.example.com/api/enable/{{ inventory_hostname }}"
        method: POST
      delegate_to: localhost

- name: Blue-Green deployment
  hosts: localhost
  vars:
    active_env: "{{ lookup('file', '/tmp/active_env') | default('blue') }}"
    new_env: "{{ 'green' if active_env == 'blue' else 'blue' }}"
  tasks:
    - name: Deploy to inactive environment
      include_role:
        name: deploy-app
      vars:
        target_hosts: "{{ new_env }}_servers"
        app_version: "{{ deploy_version }}"
    - name: Smoke test new environment
      uri:
        url: "http://{{ new_env }}.internal/health"
        status_code: 200
    - name: Switch load balancer to new environment
      uri:
        url: http://lb.example.com/api/switch
        method: POST
        body_format: json
        body:
          active: "{{ new_env }}"
    - name: Record new active environment
      copy:
        content: "{{ new_env }}"
        dest: /tmp/active_env

# no_log example
- name: Set database password
  mysql_user:
    name: appuser
    password: "{{ db_password }}"
  no_log: true                      # Suppresses task output in logs

[webservers]
web1.example.com
web2.example.com
[dbservers]
db1.example.com

tasks:
  - name: Copy Nginx configuration
    ansible.builtin.copy:
      src: nginx.conf
      dest: /etc/nginx/nginx.conf
    notify: Restart Nginx
handlers:
  - name: Restart Nginx
    ansible.builtin.service:
      name: nginx
      state: restarted

# This entire file = Playbook
- name: Play 1 - Configure webservers    # ← Play
  hosts: webservers
  tasks:
    - name: Install nginx
      yum:
        name: nginx
        state: present
- name: Play 2 - Configure databases     # ← Play
  hosts: dbservers
  tasks:
    - name: Install postgresql
      yum:
        name: postgresql
        state: present

# Static inventory — INI format
[webservers]
web1.example.com
web2.example.com ansible_user=ec2-user ansible_port=2222
[dbservers]
db1.example.com
db2.example.com
[production:children]    # Group of groups
webservers
dbservers
[webservers:vars]        # Group variables
http_port=80

# Static inventory — YAML format
all:
  children:
    webservers:
      hosts:
        web1.example.com:
          ansible_user: ec2-user
        web2.example.com:
    dbservers:
      hosts:
        db1.example.com:
        db2.example.com:

# Dynamic inventory — script or plugin
ansible-inventory -i aws_ec2.yml --list   # AWS dynamic inventory
ansible-inventory -i inventory/ --graph   # View inventory tree

1.  Role defaults          (roles/x/defaults/main.yml)
2.  Inventory file vars
3.  Inventory group_vars/all
4.  Playbook group_vars/all
5.  Inventory group_vars/*
6.  Playbook group_vars/*
7.  Inventory host_vars/*
8.  Playbook host_vars/*
9.  Host facts (gathered)
10. Play vars
11. Play vars_prompt
12. Play vars_files
13. Role vars               (roles/x/vars/main.yml)
14. Block vars
15. Task vars
16. include_vars
17. set_facts / registered vars
18. Role params
19. Extra vars (-e)         ← HIGHEST PRIORITY

# Extra vars always win
ansible-playbook site.yml -e "env=prod db_password=secret"

- debug:
    msg: |
      Current host:     {{ inventory_hostname }}
      Short hostname:   {{ inventory_hostname_short }}
      All groups:       {{ group_names }}
      All hosts:        {{ groups['all'] }}
      Playbook dir:     {{ playbook_dir }}
      Role path:        {{ role_path }}
      Hostvars of web1: {{ hostvars['web1']['ansible_default_ipv4'] }}

- name: Set derived variable
  set_fact:
    app_url: "https://{{ ansible_hostname }}:{{ app_port }}/{{ app_path }}"
    is_production: "{{ env == 'prod' }}"
    cacheable: true           # Persists fact across plays in same run

# command — safe, no shell interpretation
- command: /usr/bin/systemctl restart nginx
# shell — needed for pipes/redirects
- shell: ps aux | grep nginx | wc -l
# raw — no Python required on target
- raw: apt-get install -y python3

# File management
- ansible.builtin.copy:
    src: files/nginx.conf
    dest: /etc/nginx/nginx.conf
    owner: root
    group: root
    mode: '0644'
- ansible.builtin.template:
    src: templates/app.conf.j2
    dest: /etc/app/app.conf
- ansible.builtin.file:
    path: /var/log/myapp
    state: directory           # absent | directory | file | link | touch
    mode: '0755'
# Package management
- ansible.builtin.yum:
    name:
      - nginx
      - python3
    state: present             # present | absent | latest
- ansible.builtin.apt:
    name: nginx
    state: present
    update_cache: true
# Service management
- ansible.builtin.service:
    name: nginx
    state: started             # started | stopped | restarted | reloaded
    enabled: true
# User management
- ansible.builtin.user:
    name: appuser
    uid: 1001
    groups: wheel
    shell: /bin/bash
    state: present
# Fetch file from remote
- ansible.builtin.fetch:
    src: /var/log/app.log
    dest: /local/logs/
    flat: true

- name: Check if file exists
  ansible.builtin.stat:
    path: /etc/nginx/nginx.conf
  register: nginx_conf_stat
- name: Show result
  debug:
    msg: "File exists: {{ nginx_conf_stat.stat.exists }}"
- name: Only run if file missing
  ansible.builtin.copy:
    src: nginx.conf
    dest: /etc/nginx/nginx.conf
  when: not nginx_conf_stat.stat.exists

# Simple condition
- name: Install on RedHat only
  yum:
    name: nginx
    state: present
  when: ansible_os_family == "RedHat"
# Multiple conditions
- name: Install on RHEL 8+
  yum:
    name: nginx
    state: present
  when:
    - ansible_os_family == "RedHat"
    - ansible_distribution_major_version | int >= 8
# OR condition
- name: Run on web or proxy nodes
  service:
    name: nginx
    state: started
  when: >
    inventory_hostname in groups['webservers'] or
    inventory_hostname in groups['proxies']
# Check registered result
- name: Restart only if config changed
  service:
    name: nginx
    state: restarted
  when: config_result.changed
# Check if variable is defined
- name: Use custom port if defined
  debug:
    msg: "Port is {{ custom_port }}"
  when: custom_port is defined

# Simple loop
- name: Create multiple users
  ansible.builtin.user:
    name: "{{ item }}"
    state: present
  loop:
    - alice
    - bob
    - carol
# Loop with dictionaries
- name: Create users with attributes
  ansible.builtin.user:
    name: "{{ item.name }}"
    uid: "{{ item.uid }}"
    groups: "{{ item.groups }}"
  loop:
    - { name: alice, uid: 1001, groups: wheel }
    - { name: bob,   uid: 1002, groups: docker }
# Loop with index
- name: Show item and index
  debug:
    msg: "Item {{ ansible_loop.index }}: {{ item }}"
  loop: "{{ packages }}"
  loop_control:
    label: "{{ item }}"           # Cleaner output
    index_var: idx
# Loop over dict
- name: Set sysctl values
  sysctl:
    name: "{{ item.key }}"
    value: "{{ item.value }}"
  loop: "{{ sysctl_settings | dict2items }}"
  vars:
    sysctl_settings:
      vm.swappiness: 10
      net.core.somaxconn: 65535
# until loop — retry until condition met
- name: Wait for service to respond
  uri:
    url: http://localhost:8080/health
    status_code: 200
  register: result
  until: result.status == 200
  retries: 10
  delay: 5

vars:
  my_list: [3, 1, 4, 1, 5, 9]
  my_string: "  Hello World  "
  my_dict: {a: 1, b: 2}
  packages: ["nginx", "python3"]
tasks:
  - debug:
      msg:
        # String filters
        upper:       "{{ my_string | upper }}"
        lower:       "{{ my_string | lower }}"
        trim:        "{{ my_string | trim }}"
        replace:     "{{ my_string | replace('World', 'Ansible') }}"
        default:     "{{ undefined_var | default('fallback') }}"
        # List filters
        sorted:      "{{ my_list | sort }}"
        unique:      "{{ my_list | unique }}"
        joined:      "{{ packages | join(', ') }}"
        first:       "{{ my_list | first }}"
        last:        "{{ my_list | last }}"
        length:      "{{ my_list | length }}"
        # Type conversion
        int_val:     "{{ '42' | int }}"
        bool_val:    "{{ 'true' | bool }}"
        list_val:    "{{ my_dict | dict2items }}"
        # Math
        max_val:     "{{ my_list | max }}"
        min_val:     "{{ my_list | min }}"
        # Conditional
        ternary:     "{{ (env == 'prod') | ternary('production', 'staging') }}"
        # Path
        basename:    "{{ '/etc/nginx/nginx.conf' | basename }}"
        dirname:     "{{ '/etc/nginx/nginx.conf' | dirname }}"

tasks:
  - name: Update nginx config
    template:
      src: nginx.conf.j2
      dest: /etc/nginx/nginx.conf
    notify:
      - Reload nginx
      - Send alert
  - name: Update SSL cert
    copy:
      src: cert.pem
      dest: /etc/ssl/cert.pem
    notify: Reload nginx       # Same handler — only fires ONCE
handlers:
  - name: Reload nginx
    service:
      name: nginx
      state: reloaded
  - name: Send alert
    uri:
      url: https://hooks.slack.com/...
      method: POST
      body: '{"text": "nginx config updated"}'

tasks:
  - name: Update config
    template:
      src: app.conf.j2
      dest: /etc/app/app.conf
    notify: Restart app
  - name: Flush handlers now
    meta: flush_handlers        # Runs handlers immediately here
  - name: Run health check      # Now runs after restart
    uri:
      url: http://localhost/health

tasks:
  - name: Install packages
    yum:
      name: nginx
      state: present
    tags:
      - install
      - packages
  - name: Configure nginx
    template:
      src: nginx.conf.j2
      dest: /etc/nginx/nginx.conf
    tags:
      - configure
      - nginx
  - name: Start nginx
    service:
      name: nginx
      state: started
    tags:
      - start
      - always              # 'always' tag runs even with --tags filter

# Run only tagged tasks
ansible-playbook site.yml --tags install
ansible-playbook site.yml --tags "install,configure"
# Skip tagged tasks
ansible-playbook site.yml --skip-tags configure
# List all tags in a playbook
ansible-playbook site.yml --list-tags

# Ignore errors and continue
- name: Try to stop service (may not exist)
  service:
    name: myapp
    state: stopped
  ignore_errors: true
# Custom failure condition
- name: Run script
  command: /usr/local/bin/check-status.sh
  register: result
  failed_when:
    - result.rc != 0
    - '"CRITICAL" in result.stdout'
# Custom changed condition
- name: Run idempotent script
  command: /usr/local/bin/configure.sh
  register: result
  changed_when: '"already configured" not in result.stdout'
# Blocks for error handling (try/catch/finally)
- block:
    - name: Try risky operation
      command: /usr/bin/risky-script.sh
    - name: Another task in block
      service:
        name: myapp
        state: started
  rescue:
    - name: Handle the error
      debug:
        msg: "Something went wrong: {{ ansible_failed_result }}"
    - name: Rollback
      command: /usr/bin/rollback.sh
  always:
    - name: Always run cleanup
      file:
        path: /tmp/lockfile
        state: absent

# Run task on a DIFFERENT host
- name: Add to load balancer
  uri:
    url: http://lb.example.com/api/add
    method: POST
    body: '{"host": "{{ inventory_hostname }}"}'
  delegate_to: localhost          # Run on control node
- name: Take DB backup before deploy
  command: pg_dump mydb > /backup/pre-deploy.sql
  delegate_to: db1.example.com   # Run on DB server
# Run only once across all hosts
- name: Create database schema
  command: psql -f schema.sql
  run_once: true                  # Runs on first host in play only
  delegate_to: db1.example.com

# import — static, parsed upfront
- import_tasks: tasks/setup.yml       # No loop/conditional on the import
# include — dynamic, parsed at runtime
- include_tasks: "tasks/{{ ansible_os_family }}.yml"   # Dynamic path OK
  when: setup_needed
  loop: "{{ environments }}"

ansible-pull -U https://github.com/myorg/ansible-config.git \
  -C main \
  --inventory localhost, \
  local.yml

# aws_ec2.yml — AWS dynamic inventory
plugin: amazon.aws.aws_ec2
regions:
  - us-east-1
  - us-west-2
filters:
  instance-state-name: running
  tag:Environment: production
keyed_groups:
  - key: tags.Role
    prefix: role
  - key: placement.region
    prefix: region
hostnames:
  - private-ip-address
compose:
  ansible_host: private_ip_address

# Test dynamic inventory
ansible-inventory -i aws_ec2.yml --graph
ansible-inventory -i aws_ec2.yml --list

- name: Manage OpenShift resources
  hosts: localhost
  collections:
    - kubernetes.core
    - redhat.openshift
  tasks:
    - name: Create namespace
      kubernetes.core.k8s:
        state: present
        definition:
          apiVersion: v1
          kind: Namespace
          metadata:
            name: my-app
            labels:
              environment: production
    - name: Apply manifest from file
      kubernetes.core.k8s:
        state: present
        src: /path/to/deployment.yaml
    - name: Apply from template
      kubernetes.core.k8s:
        state: present
        definition: "{{ lookup('template', 'deployment.j2') }}"
    - name: Wait for deployment rollout
      kubernetes.core.k8s_rollout_status:
        name: my-deployment
        namespace: my-app
        timeout: 300
    - name: Get pod info
      kubernetes.core.k8s_info:
        kind: Pod
        namespace: my-app
        label_selectors:
          - app=my-app
      register: pod_info
    - name: Scale deployment
      kubernetes.core.k8s_scale:
        name: my-deployment
        namespace: my-app
        replicas: 5

# ansible.cfg optimizations
[defaults]
# SSH pipelining — reduces SSH connections
pipelining = True
# Parallel execution
forks = 20
# Fact caching — don't re-gather every run
fact_caching = jsonfile
fact_caching_connection = /tmp/ansible_facts
fact_caching_timeout = 3600
[ssh_connection]
# Reuse SSH connections
ssh_args = -o ControlMaster=auto -o ControlPersist=60s
control_path_dir = /tmp/ansible-ssh
# Disable fact gathering when not needed
- hosts: webservers
  gather_facts: false           # Skip if you don't need facts
  tasks: ...
# Gather only specific facts
- hosts: webservers
  gather_facts: true
  gather_subset:
    - network
    - hardware
    - "!all"                    # Only gather what's listed

# Dry run
ansible-playbook site.yml --check --diff
# Syntax check
ansible-playbook site.yml --syntax-check
# List hosts that would be affected
ansible-playbook site.yml --list-hosts
# Step through tasks one at a time
ansible-playbook site.yml --step

# Install
pip install molecule molecule-docker
# Initialize molecule in a role
cd roles/my-role
molecule init scenario --driver-name docker

# molecule/default/molecule.yml
driver:
  name: docker
platforms:
  - name: rhel8-instance
    image: registry.access.redhat.com/ubi8/ubi
    pre_build_image: true
    privileged: true
provisioner:
  name: ansible
  playbooks:
    converge: converge.yml
    verify: verify.yml
verifier:
  name: ansible

# molecule/default/verify.yml
- name: Verify
  hosts: all
  tasks:
    - name: Check nginx is running
      service_facts:
    - name: Assert nginx is active
      assert:
        that:
          - "'nginx' in services"
          - "services['nginx'].state == 'running'"
    - name: Check port 80 is listening
      wait_for:
        port: 80
        timeout: 5

# Run full test cycle
molecule test
# Individual stages
molecule create       # Spin up containers
molecule converge     # Run the role
molecule verify       # Run tests
molecule destroy      # Tear down
molecule login        # SSH into instance for debugging

roles/
└── my-webserver/
    ├── tasks/
    │   └── main.yml          # Entry point — all tasks
    ├── handlers/
    │   └── main.yml          # Handlers (restart, reload)
    ├── templates/
    │   └── nginx.conf.j2     # Jinja2 templates
    ├── files/
    │   └── index.html        # Static files to copy
    ├── vars/
    │   └── main.yml          # High-priority variables
    ├── defaults/
    │   └── main.yml          # Low-priority defaults (overridable)
    ├── meta/
    │   └── main.yml          # Role metadata, dependencies
    └── README.md

---
- name: Install nginx
  ansible.builtin.yum:
    name: nginx
    state: present
- name: Deploy config from template
  ansible.builtin.template:
    src: nginx.conf.j2
    dest: /etc/nginx/nginx.conf
  notify: Restart nginx
- name: Ensure nginx is started
  ansible.builtin.service:
    name: nginx
    state: started
    enabled: true

---
nginx_port: 80
nginx_worker_processes: auto
nginx_max_connections: 1024

worker_processes {{ nginx_worker_processes }};
events {
    worker_connections {{ nginx_max_connections }};
}
server {
    listen {{ nginx_port }};
    server_name {{ ansible_hostname }};
}

---
dependencies:
  - role: common
  - role: firewall
    vars:
      open_ports:
        - 80
        - 443

- name: Configure web servers
  hosts: webservers
  become: true
  roles:
    - common
    - my-webserver                  # Simple include
  # OR with parameters:
  roles:
    - role: my-webserver
      vars:
        nginx_port: 8080

pre_tasks → role dependencies → roles → tasks → post_tasks → handlers

namespace.collection_name
    └── ansible.builtin         # Core Ansible modules
    └── redhat.openshift        # OCP-specific modules
    └── community.kubernetes    # K8s modules
    └── amazon.aws              # AWS modules

my_namespace/my_collection/
├── galaxy.yml                  # Collection metadata
├── README.md
├── roles/
│   └── my_role/
├── plugins/
│   ├── modules/                # Custom modules
│   ├── inventory/              # Dynamic inventory plugins
│   └── filter/                 # Custom Jinja2 filters
├── playbooks/
└── docs/

# From Ansible Galaxy
ansible-galaxy collection install redhat.openshift
# From requirements file (preferred)
ansible-galaxy collection install -r requirements.yml
# From Automation Hub (AAP)
ansible-galaxy collection install redhat.openshift \
  --server https://cloud.redhat.com/api/automation-hub/
# Offline / from tarball
ansible-galaxy collection install my_namespace-my_collection-1.0.0.tar.gz

---
collections:
  - name: redhat.openshift
    version: ">=2.0.0"
  - name: community.kubernetes
    version: "2.0.0"
  - name: amazon.aws
    version: ">=5.0.0"
roles:
  - name: geerlingguy.nginx
    version: "3.0.0"

- name: Deploy OCP application
  hosts: localhost
  collections:
    - redhat.openshift
    - kubernetes.core
  tasks:
    - name: Create namespace
      kubernetes.core.k8s:
        state: present
        definition:
          apiVersion: v1
          kind: Namespace
          metadata:
            name: my-app
    - name: Deploy from template
      kubernetes.core.k8s:
        state: present
        src: deployment.yaml
    - name: Create OCP Route
      redhat.openshift.openshift_route:
        namespace: my-app
        service: my-service
        state: present

# Encrypt an entire file
ansible-vault encrypt secrets.yml
# Decrypt a file
ansible-vault decrypt secrets.yml
# View without decrypting to disk
ansible-vault view secrets.yml
# Edit encrypted file
ansible-vault edit secrets.yml
# Re-key (change password)
ansible-vault rekey secrets.yml
# Encrypt a single string value
ansible-vault encrypt_string 'mysecretpassword' \
  --name 'db_password'

# Output of encrypt_string — paste directly into vars file
db_password: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  61386634653335343832333938343039303664653764323035
  64356635333562303937363135626565353537306261363539
  ...

# group_vars/all/vault.yml  ← encrypted file
vault_db_password: supersecret123
vault_api_key: abc123xyz
# group_vars/all/vars.yml   ← plaintext, references vault vars
db_password: "{{ vault_db_password }}"
api_key: "{{ vault_api_key }}"

# Prompt for password
ansible-playbook site.yml --ask-vault-pass
# Use password file
ansible-playbook site.yml --vault-password-file ~/.vault_pass
# Use environment variable
export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass
ansible-playbook site.yml
# Multiple vault IDs (different passwords for different files)
ansible-playbook site.yml \
  --vault-id dev@~/.vault_pass_dev \
  --vault-id prod@prompt

# Encrypt with a specific vault ID label
ansible-vault encrypt_string 'prodpassword' \
  --name 'db_password' \
  --vault-id prod@~/.vault_pass_prod
# Result:
db_password: !vault |
  $ANSIBLE_VAULT;1.2;AES256;prod    ← vault ID label
  ...

┌──────────────────────────────────────────────────┐
│              Ansible Automation Platform         │
│                                                  │
│  ┌────────────┐    ┌──────────────────────────┐  │
│  │ Automation │    │   Automation Controller  │  │
│  │    Hub     │    │  (formerly Tower)        │  │
│  │(Collections│    │  - Job Templates         │  │
│  │  & roles)  │    │  - Workflows             │  │
│  └────────────┘    │  - Schedules             │  │
│                    │  - RBAC                  │  │
│  ┌────────────┐    │  - Credentials           │  │
│  │  Event     │    └──────────────────────────┘  │
│  │  Driven    │                                  │
│  │  Ansible   │    ┌──────────────────────────┐  │
│  │  (EDA)     │    │  Execution Environments  │  │
│  └────────────┘    │  (containerized runtime) │  │
│                    └──────────────────────────┘  │
└──────────────────────────────────────────────────┘

# execution-environment.yml
version: 1
build_arg_defaults:
  EE_BASE_IMAGE: registry.redhat.io/ansible-automation-platform/ee-minimal-rhel8
dependencies:
  galaxy: requirements.yml
  python: requirements.txt
  system: bindep.txt
additional_build_steps:
  prepend:
    - RUN pip3 install boto3

# Build EE with ansible-builder
pip install ansible-builder
ansible-builder build -t my-ee:1.0 -f execution-environment.yml
# Push to registry
podman push my-ee:1.0 registry.example.com/my-ee:1.0

# rulebook.yml
- name: Respond to alerts
  hosts: all
  sources:
    - ansible.eda.webhook:          # Listen on webhook
        host: 0.0.0.0
        port: 5000
    - ansible.eda.kafka:            # Or Kafka topic
        host: kafka.example.com
        topic: alerts
  rules:
    - name: Restart service on alert
      condition: event.payload.alertname == "ServiceDown"
      action:
        run_job_template:
          name: Restart Service
          organization: Default
    - name: Scale up on high CPU
      condition: event.payload.metric > 80
      action:
        run_playbook:
          name: scale-up.yml

- name: Install OpenShift cluster
  hosts: localhost
  collections:
    - redhat.openshift_installer
  tasks:
    - name: Generate install-config
      template:
        src: install-config.yaml.j2
        dest: "{{ install_dir }}/install-config.yaml"
    - name: Run openshift-install
      command: >
        openshift-install create cluster
        --dir {{ install_dir }}
        --log-level info

- name: OCP Day-2 Configuration
  hosts: localhost
  collections:
    - redhat.openshift
    - kubernetes.core
  tasks:
    - name: Create htpasswd identity provider
      kubernetes.core.k8s:
        state: present
        definition: "{{ lookup('template', 'oauth.yaml.j2') }}"
    - name: Apply resource quotas
      kubernetes.core.k8s:
        state: present
        definition:
          apiVersion: v1
          kind: ResourceQuota
          metadata:
            name: team-quota
            namespace: "{{ item }}"
          spec:
            hard:
              pods: "20"
              requests.cpu: "4"
              requests.memory: 8Gi
      loop: "{{ namespaces }}"
    - name: Deploy OADP operator
      kubernetes.core.k8s:
        state: present
        src: oadp-subscription.yaml
    - name: Wait for operator to be ready
      kubernetes.core.k8s_info:
        kind: ClusterServiceVersion
        namespace: openshift-adp
      register: csv
      until: >
        csv.resources | selectattr('status.phase','equalto','Succeeded') | list | length > 0
      retries: 20
      delay: 30

- name: Install and start nginx
  hosts: webservers
  become: true              # sudo
  tasks:
    - name: Install nginx
      ansible.builtin.yum:
        name: nginx
        state: present
    - name: Start and enable nginx
      ansible.builtin.service:
        name: nginx
        state: started
        enabled: true
    - name: Copy config file
      ansible.builtin.copy:
        src: nginx.conf
        dest: /etc/nginx/nginx.conf
      notify: Restart nginx   # triggers handler only if file changed
  handlers:
    - name: Restart nginx
      ansible.builtin.service:
        name: nginx
        state: restarted