Managing Ansible

Ansible Management Skill

Manage and execute Ansible playbooks, inventories, roles, and vault-encrypted secrets.

MANDATORY: Discovery-First Pattern

Always inspect inventory and available playbooks before executing tasks.

Phase 1: Discovery

#!/bin/bash

echo "=== Ansible Version ==="
ansible --version 2>/dev/null | head -5

echo ""
echo "=== Inventory Summary ==="
ansible-inventory --list --yaml 2>/dev/null | head -30 || \
ansible-inventory --graph 2>/dev/null | head -30

echo ""
echo "=== Available Playbooks ==="
find . -maxdepth 3 -name "*.yml" -o -name "*.yaml" | grep -i playbook | head -20

echo ""
echo "=== Available Roles ==="
ls roles/ 2>/dev/null || ansible-galaxy list 2>/dev/null | head -15

Core Helper Functions

#!/bin/bash

# Ansible wrapper with common options
ans_cmd() {
    ansible "$@" --forks=10 2>/dev/null
}

# Playbook execution with check mode
ans_playbook() {
    local playbook="$1"
    shift
    ansible-playbook "$playbook" "$@" 2>&1
}

# Vault wrapper
ans_vault() {
    ansible-vault "$@" 2>/dev/null
}

Output Rules

• TOKEN EFFICIENCY: Target <=50 lines per output
• Use --list-tasks or --list-tags for playbook inspection without execution
• Use --check (dry-run) before actual execution
• Never dump full inventories -- use --graph or filter by group

Common Operations

Inventory Analysis

#!/bin/bash
echo "=== Host Groups ==="
ansible-inventory --graph 2>/dev/null

echo ""
echo "=== Group Variables ==="
GROUP="${1:-all}"
ansible-inventory --host "${GROUP}" --yaml 2>/dev/null | head -30 || \
ansible-inventory --list 2>/dev/null | jq --arg g "$GROUP" '.[$g] // "Group not found"'

echo ""
echo "=== Host Count by Group ==="
ansible-inventory --list 2>/dev/null | jq '
    to_entries[] |
    select(.value | type == "object" and has("hosts")) |
    "\(.key): \(.value.hosts | length) hosts"
' 2>/dev/null

Playbook Dry Run and Inspection

#!/bin/bash
PLAYBOOK="${1:?Playbook path required}"

echo "=== Playbook Tasks ==="
ansible-playbook "$PLAYBOOK" --list-tasks 2>/dev/null

echo ""
echo "=== Playbook Tags ==="
ansible-playbook "$PLAYBOOK" --list-tags 2>/dev/null

echo ""
echo "=== Dry Run (Check Mode) ==="
ansible-playbook "$PLAYBOOK" --check --diff --limit "${2:-all}" 2>&1 | tail -30

Ad-Hoc Commands and Fact Gathering

#!/bin/bash
HOST_PATTERN="${1:?Host pattern required}"

echo "=== Host Facts ==="
ansible "$HOST_PATTERN" -m setup -a 'filter=ansible_distribution*,ansible_memtotal_mb,ansible_processor_vcpus' 2>/dev/null | head -40

echo ""
echo "=== Connectivity Check ==="
ansible "$HOST_PATTERN" -m ping 2>/dev/null

echo ""
echo "=== Uptime ==="
ansible "$HOST_PATTERN" -m command -a "uptime" 2>/dev/null | head -20

Vault Management

#!/bin/bash
ACTION="${1:?Action required: view|encrypt|decrypt|rekey}"

case "$ACTION" in
    view)
        echo "=== Encrypted Files ==="
        find . -name "*.yml" -o -name "*.yaml" | xargs grep -l 'ANSIBLE_VAULT' 2>/dev/null
        ;;
    encrypt)
        FILE="${2:?File path required}"
        echo "=== Encrypting: $FILE ==="
        ansible-vault encrypt "$FILE" 2>&1
        ;;
    decrypt)
        FILE="${2:?File path required}"
        echo "=== Decrypting: $FILE (view only) ==="
        ansible-vault view "$FILE" 2>/dev/null | head -20
        ;;
    rekey)
        FILE="${2:?File path required}"
        echo "=== Rekeying: $FILE ==="
        echo "Run: ansible-vault rekey $FILE"
        ;;
esac

Role Management

#!/bin/bash
echo "=== Installed Roles ==="
ansible-galaxy list 2>/dev/null

echo ""
echo "=== Role Dependencies ==="
for role in roles/*/; do
    if [ -f "${role}meta/main.yml" ]; then
        echo "--- $(basename $role) ---"
        grep -A 5 'dependencies:' "${role}meta/main.yml" 2>/dev/null
    fi
done | head -30

echo ""
echo "=== Requirements File ==="
cat requirements.yml 2>/dev/null || cat roles/requirements.yml 2>/dev/null | head -20

Safety Rules

• NEVER run playbooks without --check first unless explicitly confirmed
• Always use --limit to target specific hosts during testing
• Vault passwords must never be stored in plaintext -- use vault password files or prompt
• Use --diff with --check to see what would change before applying
• Tag dangerous tasks with never tag to prevent accidental execution

Output Format

Present results as a structured report:

Managing Ansible Report
═══════════════════════
Resources discovered: [count]

Resource       Status    Key Metric    Issues
──────────────────────────────────────────────
[name]         [ok/warn] [value]       [findings]

Summary: [total] resources | [ok] healthy | [warn] warnings | [crit] critical
Action Items: [list of prioritized findings]

Target ≤50 lines of output. Use tables for multi-resource comparisons.

Anti-Hallucination Rules

1. NEVER assume resource names — always discover via CLI/API in Phase 1 before referencing in Phase 2.
2. NEVER fabricate metric names or dimensions — verify against the service documentation or --help output.
3. NEVER mix CLI commands between service versions — confirm which version/API you are targeting.
4. ALWAYS use the discovery → verify → analyze chain — every resource referenced must have been discovered first.
5. ALWAYS handle empty results gracefully — an empty response is valid data, not an error to retry.

Counter-Rationalizations

Common Pitfalls

• SSH key issues: Most connection failures are SSH key or user permission problems -- test with ansible -m ping first
• Python interpreter: Remote hosts need Python -- set ansible_python_interpreter if not at default path
• Idempotency: Tasks using command/shell modules are not idempotent -- use creates/removes parameters
• Variable precedence: Ansible has 22 levels of variable precedence -- group_vars < host_vars < play vars < extra vars
• Vault ID mismatch: Using wrong vault password silently fails decryption -- check vault-id labels
• Become issues: become: yes requires sudo access on target -- check sudoers configuration
• Fact caching: Stale cached facts can cause unexpected behavior -- use gather_facts: yes or clear cache
• Handler ordering: Handlers run at end of play, not immediately -- use meta: flush_handlers if needed earlier