1---2name: ansible3description: Use when automating infrastructure with Ansible — playbook development (tasks, handlers, variables, templates, conditionals, loops), role design (Galaxy structure, defaults, dependencies), inventory management (static/dynamic, groups, host_vars/group_vars), collections (ansible.builtin, community, custom), Ansible Vault (encryption), AWX/Ansible Automation Platform (job templates, workflows, RBAC, surveys), module development, testing (Molecule, ansible-lint), and performance tuning (forks, pipelining, async). Part of the automation-* skill family.4---56# Ansible Automation — Admin & Developer78Covers Ansible core (ansible-core 2.15+/2.16+/2.17+), collections ecosystem, AWX/Ansible Automation Platform, and testing. For target node configuration see: `rhel-server-admin`, `ubuntu-server-admin`, `windows-powershell`.910<HARD-RULE>11Never store plaintext secrets in playbooks or inventory — always use Ansible Vault or external secret managers (HashiCorp Vault, AWS Secrets Manager).12</HARD-RULE>1314<HARD-RULE>15Always use fully qualified collection names (FQCN) for modules — bare module names are deprecated and cause ambiguity with collections.16</HARD-RULE>1718<HARD-RULE>19Never use command/shell modules when a purpose-built module exists — idempotent modules (apt, yum, copy, template, service) are safer and provide proper changed/ok reporting.20</HARD-RULE>2122<HARD-RULE>23Always set changed_when on command/shell tasks — without it, Ansible always reports changed, making idempotency checks useless.24</HARD-RULE>2526---2728## Reference Files2930Detailed code examples, patterns, and configuration are in the reference files below. Read the relevant file when working on that area.3132| File | Covers |33|---|---|34| [awx-security-performance-testing.md](awx-security-performance-testing.md) | AWX/Ansible Automation Platform (job templates, workflows, RBAC, surveys, API), security patterns (secret management, SSH hardening, lint rules), performance tuning (forks, pipelining, mitogen, fact caching), and testing (Molecule, ansible-lint, CI integration) |35| [fundamentals-playbooks.md](fundamentals-playbooks.md) | installation, playbook structure, ad-hoc commands, ansible.cfg, connection types, tasks (core patterns, variables, conditionals, loops, blocks, error handling), handlers, includes vs imports |36| [inventory-vault-advanced.md](inventory-vault-advanced.md) | inventory management (static/dynamic, group_vars/host_vars, patterns), Ansible Vault (encryption commands, vault IDs, rekeying), and advanced patterns (delegation, serial/rolling, async, custom modules, callback plugins, dynamic includes) |37| [templates-roles-collections.md](templates-roles-collections.md) | Jinja2 templates, file management modules, role design (Galaxy structure, defaults, dependencies), and collections (installing, using, creating custom collections) |3839---4041## Anti-Patterns4243| Anti-Pattern | Why It Fails | Correct Approach |44|---|---|---|45| Using `command`/`shell` for package installs | Not idempotent — reruns always show changed, no rollback, no version pinning | Use `ansible.builtin.dnf`, `ansible.builtin.apt`, or platform-specific package modules |46| Hardcoding IPs and hostnames in playbooks | Breaks when inventory changes, makes playbooks non-portable | Use inventory variables, `host_vars`/`group_vars`, and dynamic inventory plugins |47| One massive playbook with no roles | Becomes unmaintainable past 200 lines, no reuse across projects | Break into roles with Galaxy structure; one role = one concern |48| Storing vault password in the repo | Anyone with repo access can decrypt all secrets | Use `--vault-password-file` pointing to a file outside the repo, or integrate with external secret manager |49| Running playbooks without `--check --diff` first in production | Unexpected changes hit live systems with no preview | Always dry-run with `--check --diff` on production inventories before applying |50| Ignoring `ansible-lint` warnings | Leads to deprecated syntax, bare module names, and missing `changed_when` — breaks on ansible-core upgrades | Run `ansible-lint` in CI; treat warnings as errors for production playbooks |5152---5354## Related Skills5556| Domain | Skill |57|---|---|58| RHEL server admin (targets) | `rhel-server-admin` |59| Ubuntu server admin (targets) | `ubuntu-server-admin` |60| Windows PowerShell (WinRM targets) | `windows-powershell` |61| Docker containers | `docker-admin` |62| Database config on RHEL | `rhel-databases` |63| Database config on Ubuntu | `ubuntu-databases` |64| IBM MQ automation | `ibm-mq` |65| IBM WebSphere automation | `ibm-websphere` |66| Centrify/AD integration | `linux-centrify` |67| BMC Control-M job scheduling | `control-m` |
joogy06