Ansible for Production Sysadmins

Part I

Why Configuration Management Exists

Manual administration, shell scripts, snowflake servers, drift, and when each approach is appropriate.

8 lessons

Part II

Ansible Architecture

Agentless execution, control node, managed nodes, SSH transport, and what actually happens during a run.

7 lessons

Part III

Installing and Designing the Controller

Packages, pipx, virtualenvs, ansible-core vs the community package, and a reproducible controller environment.

7 lessons

Part IV

Inventory Fundamentals

INI and YAML inventories, groups, children, host and group variables, and inventory inspection.

7 lessons

Part V

Inventory Design at Fleet Scale

Fleet taxonomy, environment and role dimensions, and why a poor inventory becomes an operational hazard.

7 lessons

Part VI

Configuration and Precedence

ansible.cfg locations, precedence, forks, timeouts, interpreter discovery, and settings not to weaken.

7 lessons

Part VII

Ad-Hoc Execution

When an ad-hoc command is the right tool, when a playbook is, and the auditability difference.

6 lessons

Part VIII

Modules and the Module Model

The module contract, return values, and choosing purpose-built modules over shell.

7 lessons

Part IX

command, shell and raw

Shell expansion, quoting, idempotency and security consequences of each execution module.

7 lessons

Part X

YAML for Reliable Automation

Types, quoting, multiline strings, and the YAML traps that silently change automation behaviour.

6 lessons

Part XI

Playbooks

Plays, tasks, become, execution order, and the anatomy of a maintainable playbook.

7 lessons

Part XII

Idempotency and Change Reporting

Declarative state, convergence, and why an inaccurate changed result destroys trust and handlers.

8 lessons

Part XIII

Variables and Precedence

Variable sources, practical precedence design, and why heavy -e use makes an estate hard to reason about.

8 lessons

Part XIV

Facts and Registered Variables

Fact gathering, ansible_facts, caching, register, and reading structured module results.

7 lessons

Part XV

Conditionals and Loops

when, modern loop syntax, loop control, and logic that belongs in inventory instead.

7 lessons

Part XVI

Handlers

notify, handler ordering, flush_handlers, and change-triggered restarts as a safety mechanism.

6 lessons

Part XVII

Templates and Jinja2

Jinja for sysadmins, filters, defaults, and validating rendered configuration before it goes live.

8 lessons

Part XVIII

Files and Configuration Management

copy, file, template, lineinfile and blockinfile, and when each is the maintainable choice.

7 lessons

Part XIX

Privilege Escalation

become, become_user, become_method, sudo integration, and least privilege on managed nodes.

6 lessons

Part XX

SSH Architecture and Connectivity

Keys, agents, host key verification, bastions, ProxyJump, connection reuse and pipelining.

7 lessons

Part XXI

Secrets Management

Vault, vault IDs, external secret managers, no_log, and the ways secrets actually leak.

8 lessons

Part XXII

Roles and Reuse

Role structure, boundaries, interfaces, dependencies, and include versus import semantics.

8 lessons

Part XXIII

Tags, Blocks and Error Handling

tags, block/rescue/always, failed_when, retries, and why blanket ignore_errors hides outages.

8 lessons

Part XXIV

Assertions and Guardrails

Preconditions, assert and fail, and automation that refuses to perform an unsafe operation.

6 lessons

Part XXV

Check Mode, Diff and Static Validation

What --check proves and what it cannot, --diff and secret exposure, syntax-check and ansible-lint.

7 lessons

Part XXVI

Testing Automation

The layered testing model, Molecule scenarios, and container versus VM fidelity.

8 lessons

Part XXVII

Collections, Galaxy and Dependency Trust

Namespaces, requirements files, version pinning, and evaluating third-party automation before running it.

8 lessons

Part XXVIII

Plugins, Lookups and Filters

The plugin architecture, controller-side lookup execution, and readable filter usage.

8 lessons

Part XXIX

Dynamic Inventory

Inventory plugins, caching, authentication, staleness, and the risk of newly appearing hosts.

8 lessons

Part XXX

Host Targeting and Blast Radius

Host patterns, --limit, verifying the effective host list, and blast radius as a design constraint.

8 lessons

Part XXXI

Serial Execution and Failure Tolerance

serial batches, max_fail_percentage, any_errors_fatal, and stopping a rollout before it becomes an outage.

8 lessons

Part XXXII

Rolling Deployments

Drain, deploy, health-check and return-to-service, built from serial, delegation and wait_for.

8 lessons

Part XXXIII

Delegation and Controller-Side Execution

delegate_to, run_once, local actions, and knowing which machine a task actually runs on.

7 lessons

Part XXXIV

Concurrency, Strategies and Performance

forks, linear versus free, pipelining, fact caching, and measuring before tuning.

7 lessons

Part XXXV

Large Fleet Architecture

Waves, scheduling, controller placement, and the operational shape of automation at thousands of hosts.

7 lessons

Part XXXVI

Drift and Convergence

Detecting drift, remediating it, recording intentional exceptions, and avoiding snowflake automation.

7 lessons

Part XXXVII

Environments and Repository Architecture

Environment separation, directory layout, promotion models, and a reference production repository.

7 lessons

Part XXXVIII

Git Workflow and CI for Ansible

Automation as production code: review, protected branches, lint, syntax, secret scanning and integration tests.

7 lessons

Part XXXIX

Automation Platforms, RBAC and Event-Driven

AWX and Automation Controller concepts, RBAC, schedules, workflows and event-driven automation safety.

7 lessons

Part XL

Patch and Reboot Management

Controlled fleet patching, reboot detection and recovery, and rolling kernel upgrades.

8 lessons

Part XLI

Service and Application Deployment

Package, configure, validate, health-check, and the extra caution database automation requires.

8 lessons

Part XLII

Ansible Beyond Linux Servers

Network devices, cloud APIs, Terraform hand-off, Docker hosts and Proxmox, with clear tool boundaries.

7 lessons

Part XLIII

Observability and Auditing of Automation

Callback output, run metrics, audit trails, and answering who changed three hundred servers.

7 lessons

Part XLIV

Failure Modes and Partial Fleet Failure

failed, unreachable, skipped and rescued; and judging whether a partial success is a failed change.

8 lessons

Part XLV

Debugging and Troubleshooting

Verbosity levels, variable and inventory inspection, Jinja errors, SSH and sudo faults, without leaking secrets.

7 lessons

Part XLVI

Python and Interpreter Discovery

Remote Python requirements, interpreter discovery, minimal hosts, raw bootstrapping and Windows in brief.

6 lessons

Part XLVII

Controller Security

Hardening the controller, SSH key management and rotation, and why controller compromise is fleet compromise.

7 lessons

Part XLVIII

Maintenance Windows and Rollback

Change windows, rollback patterns Ansible does not give you for free, and backups worth having.

7 lessons

Part XLIX

Compliance, Validation and Certificates

Audit versus enforce, infrastructure testing, health checks, certificate deployment and secret rotation.

7 lessons

Part L

Automation Disaster Recovery

Rebuilding a lost controller, pinned reproducible environments, and execution environments.

6 lessons

Part LI

Custom Modules and Tool Selection

When a custom module is justified, and when Ansible is the wrong tool entirely.

6 lessons

Part LII

Anti-Patterns

The recurring failure shapes: shell everywhere, secrets in Git, no limit, no canary, no rollback.

8 lessons

Part LIII

Labs

Hands-on exercises against disposable controller and managed-node topologies.

0 lessons

Part LIV

Runbooks

Step-by-step operational procedures for running and recovering Ansible automation.

0 lessons

Part LV

Checklists

Pre-execution, production change, patching and security review checklists.

0 lessons

Part LVI

Break/Fix Scenarios

Deliberate automation incidents diagnosed from evidence.

0 lessons

Part LVII

Capstone

A complete production Ansible estate, operated end to end.

0 lessons

Part ansible-final

Final Assessment

Practical assessment of a deliberately flawed Ansible repository.

0 lessons