Skip to main content
RunBook Academy

Ansible · Curriculum

Curriculum

374 lessons across 58 parts. Lessons build on each other; later parts assume familiarity with earlier material.

Part I

Why Configuration Management Exists

Manual administration, shell scripts, snowflake servers, drift, and when each approach is appropriate.

8 lessons
  1. 01Welcome to Ansible for Production SysadminsCourse introduction · foundation · ~9 min
  2. 02Drift, and how a snowflake is actually madeThe problem before the tool · foundation · ~16 min
  3. 03Manual administration, honestlyThe problem before the tool · foundation · ~15 min
  4. 04Shell scripts: the first automation, and where it breaksThe problem before the tool · foundation · ~18 min
  5. 05The configuration management modelThe four approaches · foundation · ~17 min
  6. 06Immutable infrastructure, and why it does not delete this courseThe four approaches · foundation · ~17 min
  7. 07What automation costsThe four approaches · foundation · ~16 min
  8. 08Choosing an approach for a given estateThe four approaches · foundation · ~20 min

Part II

Ansible Architecture

Agentless execution, control node, managed nodes, SSH transport, and what actually happens during a run.

7 lessons
  1. 01What agentless actually meansThe execution model · foundation · ~16 min
  2. 02Control node and managed node responsibilitiesThe execution model · foundation · ~18 min
  3. 03Anatomy of a run, start to finishThe execution model · foundation · ~22 min
  4. 04How a module gets to the target: AnsiballZ and pipeliningThe execution model · intermediate · ~20 min
  5. 05Connection plugins: SSH is a default, not a lawThe execution model · intermediate · ~18 min
  6. 06The push model and who can reach whomThe execution model · intermediate · ~19 min
  7. 07What Ansible does not do for youThe execution model · intermediate · ~17 min

Part III

Installing and Designing the Controller

Packages, pipx, virtualenvs, ansible-core vs the community package, and a reproducible controller environment.

7 lessons
  1. 01ansible-core versus the ansible community packageChoosing what to install · foundation · ~16 min
  2. 02The support matrix, and which Python is whichChoosing what to install · foundation · ~18 min
  3. 03Installing: pipx, virtualenv, pip and the distro packageInstalling the controller · foundation · ~20 min
  4. 04A controller you can rebuild identicallyInstalling the controller · intermediate · ~22 min
  5. 05Controller filesystem layout and ownershipController design · intermediate · ~21 min
  6. 06Whose machine runs production change?Controller design · intermediate · ~19 min
  7. 07Upgrading Ansible without surprising the fleetController design · intermediate · ~22 min

Part IV

Inventory Fundamentals

INI and YAML inventories, groups, children, host and group variables, and inventory inspection.

7 lessons
  1. 01INI and YAML inventories, side by sideInventory mechanics · foundation · ~20 min
  2. 02Groups, children, and the two groups you never wroteInventory mechanics · foundation · ~20 min
  3. 03group_vars and host_vars on diskInventory mechanics · intermediate · ~22 min
  4. 04Ranges, aliases and connection variablesInventory mechanics · intermediate · ~20 min
  5. 05Proving what your inventory containsInventory inspection · intermediate · ~21 min
  6. 06More than one inventory sourceInventory inspection · intermediate · ~20 min
  7. 07When two groups disagreeInventory inspection · advanced · ~22 min

Part V

Inventory Design at Fleet Scale

Fleet taxonomy, environment and role dimensions, and why a poor inventory becomes an operational hazard.

7 lessons
  1. 01The four dimensions of a fleetFleet taxonomy · intermediate · ~16 min
  2. 02Environment separation you can rely onFleet taxonomy · intermediate · ~16 min
  3. 03Role groups and who owns themFleet taxonomy · intermediate · ~17 min
  4. 04Lifecycle stages and hosts you must not touchFleet taxonomy · intermediate · ~18 min
  5. 05Contradictory membership is an outage waitingFleet taxonomy · advanced · ~19 min
  6. 06Reading an inventory as a blast-radius mapFleet taxonomy · advanced · ~17 min
  7. 07Where the truth about the fleet livesFleet taxonomy · advanced · ~18 min

Part VI

Configuration and Precedence

ansible.cfg locations, precedence, forks, timeouts, interpreter discovery, and settings not to weaken.

7 lessons
  1. 01Which ansible.cfg is actually in effectConfiguration and precedence · intermediate · ~16 min
  2. 02The config file Ansible refuses to readConfiguration and precedence · intermediate · ~15 min
  3. 03Proving a setting's value and its sourceConfiguration and precedence · intermediate · ~17 min
  4. 04Forks, timeouts and what they costConfiguration and precedence · intermediate · ~17 min
  5. 05Interpreter discovery, configuredConfiguration and precedence · advanced · ~17 min
  6. 06The settings you will be tempted to weakenConfiguration and precedence · advanced · ~20 min
  7. 07The project config is part of the automationConfiguration and precedence · advanced · ~18 min

Part VII

Ad-Hoc Execution

When an ad-hoc command is the right tool, when a playbook is, and the auditability difference.

6 lessons
  1. 01Anatomy of an ad-hoc commandAd-hoc execution · foundation · ~16 min
  2. 02When ad-hoc is right, and when it is notAd-hoc execution · foundation · ~14 min
  3. 03Ad-hoc as a fleet inspection instrumentAd-hoc execution · foundation · ~18 min
  4. 04Blast radius of a one-line commandAd-hoc execution · advanced · ~18 min
  5. 05What an ad-hoc change leaves behindAd-hoc execution · intermediate · ~17 min
  6. 06Promoting an ad-hoc command to a playbookAd-hoc execution · intermediate · ~20 min

Part VIII

Modules and the Module Model

The module contract, return values, and choosing purpose-built modules over shell.

7 lessons
  1. 01The module contractThe module model · intermediate · ~19 min
  2. 02Reading module documentation like an operatorThe module model · intermediate · ~18 min
  3. 03Fully qualified names and how a module is foundThe module model · intermediate · ~17 min
  4. 04Not everything runs on the targetThe module model · intermediate · ~18 min
  5. 05Choosing a module, and what you lose without oneThe module model · intermediate · ~19 min
  6. 06Check-mode support is a per-module propertyThe module model · intermediate · ~18 min
  7. 07How modules fail, and what the error meansThe module model · intermediate · ~20 min

Part IX

command, shell and raw

Shell expansion, quoting, idempotency and security consequences of each execution module.

7 lessons
  1. 01command: no shell, and why that is the safe onecommand, shell and raw · intermediate · ~16 min
  2. 02shell: when you genuinely need a shell, and what you acceptcommand, shell and raw · intermediate · ~17 min
  3. 03A variable inside a shell line is an injection pointcommand, shell and raw · advanced · ~20 min
  4. 04raw: the escape hatch, and its exact pricecommand, shell and raw · advanced · ~16 min
  5. 05Making an unavoidable shell task idempotentcommand, shell and raw · advanced · ~18 min
  6. 06script: transferring a script and running itcommand, shell and raw · intermediate · ~15 min
  7. 07A worked replacement: one shell-heavy play, rewrittencommand, shell and raw · advanced · ~20 min

Part X

YAML for Reliable Automation

Types, quoting, multiline strings, and the YAML traps that silently change automation behaviour.

6 lessons
  1. 01The YAML a playbook actually isYAML for reliable automation · foundation · ~15 min
  2. 02Types you did not ask forYAML for reliable automation · intermediate · ~18 min
  3. 03Quoting, and the double-brace ruleYAML for reliable automation · intermediate · ~16 min
  4. 04Multiline values that surviveYAML for reliable automation · intermediate · ~15 min
  5. 05File modes: quote themYAML for reliable automation · intermediate · ~14 min
  6. 06The traps that do not raise an errorYAML for reliable automation · intermediate · ~17 min

Part XI

Playbooks

Plays, tasks, become, execution order, and the anatomy of a maintainable playbook.

7 lessons
  1. 01Anatomy of a playPlaybooks · intermediate · ~14 min
  2. 02Execution order inside a playPlaybooks · intermediate · ~16 min
  3. 03The hosts: line is the blast radiusPlaybooks · intermediate · ~15 min
  4. 04The pre-flight options, and what each one provesPlaybooks · intermediate · ~18 min
  5. 05Composing a site.ymlPlaybooks · intermediate · ~15 min
  6. 06A playbook someone else can operatePlaybooks · intermediate · ~16 min
  7. 07Reading the recap, and the exit codePlaybooks · intermediate · ~18 min

Part XII

Idempotency and Change Reporting

Declarative state, convergence, and why an inaccurate changed result destroys trust and handlers.

8 lessons
  1. 01Describing state instead of stepsIdempotency and change reporting · intermediate · ~15 min
  2. 02What idempotent means, preciselyIdempotency and change reporting · intermediate · ~14 min
  3. 03How Ansible decides ok versus changedIdempotency and change reporting · intermediate · ~18 min
  4. 04changed_when: telling the truth about a commandIdempotency and change reporting · intermediate · ~18 min
  5. 05failed_when: when non-zero is not a failureIdempotency and change reporting · intermediate · ~17 min
  6. 06Why a wrong changed breaks the machineryIdempotency and change reporting · intermediate · ~17 min
  7. 07changed=0 as the cheapest signal an estate producesIdempotency and change reporting · intermediate · ~16 min
  8. 08The operations that cannot be idempotentIdempotency and change reporting · intermediate · ~17 min

Part XIII

Variables and Precedence

Variable sources, practical precedence design, and why heavy -e use makes an estate hard to reason about.

8 lessons
  1. 01Every place a variable can come fromVariable sources · intermediate · ~16 min
  2. 02The precedence order, verified by experimentVariable sources · intermediate · ~22 min
  3. 03Finding out what a variable actually isDiagnosis · intermediate · ~20 min
  4. 04A layering rule you can hold in your headDesign · intermediate · ~22 min
  5. 05defaults/ and vars/ are a policy decisionDesign · intermediate · ~18 min
  6. 06-e always wins, and that is the problemDesign · intermediate · ~19 min
  7. 07Names that do not collideDesign · intermediate · ~18 min
  8. 08A precedence incident, worked end to endDiagnosis · intermediate · ~21 min

Part XIV

Facts and Registered Variables

Fact gathering, ansible_facts, caching, register, and reading structured module results.

7 lessons
  1. 01What fact gathering actually costsFact gathering · intermediate · ~24 min
  2. 02Reading ansible_facts properlyFact gathering · intermediate · ~21 min
  3. 03Which facts you can trustFact gathering · intermediate · ~23 min
  4. 04Custom facts with facts.dFact gathering · intermediate · ~22 min
  5. 05Fact caching and stale truthFact gathering · advanced · ~26 min
  6. 06register and the shape of a resultRegistered variables · intermediate · ~25 min
  7. 07set_fact, register or inventory?Registered variables · advanced · ~24 min

Part XV

Conditionals and Loops

when, modern loop syntax, loop control, and logic that belongs in inventory instead.

7 lessons
  1. 01when expressions that hold upConditionals · intermediate · ~24 min
  2. 02Conditioning on a previous taskConditionals · intermediate · ~22 min
  3. 03loop, and when not to use oneLoops · intermediate · ~24 min
  4. 04loop_control and readable runsLoops · intermediate · ~21 min
  5. 05Retry loops for genuinely transient faultsLoops · intermediate · ~22 min
  6. 06Reading inherited with_* codeLoops · intermediate · ~22 min
  7. 07Conditionals that should have been groupsConditionals · advanced · ~26 min

Part XVI

Handlers

notify, handler ordering, flush_handlers, and change-triggered restarts as a safety mechanism.

6 lessons
  1. 01Handlers as a safety mechanismHandlers · intermediate · ~18 min
  2. 02Handler ordering and flush_handlersHandlers · intermediate · ~20 min
  3. 03listen topics as a handler interfaceHandlers · intermediate · ~18 min
  4. 04The handler that never ranHandlers · advanced · ~21 min
  5. 05Naming handlers, and role collisionsHandlers · advanced · ~19 min
  6. 06Restart, reload, and doing it to everyone at onceHandlers · advanced · ~20 min

Part XVII

Templates and Jinja2

Jinja for sysadmins, filters, defaults, and validating rendered configuration before it goes live.

8 lessons
  1. 01Jinja2 for sysadminsTemplates and Jinja2 · intermediate · ~20 min
  2. 02The template module in productionTemplates and Jinja2 · intermediate · ~19 min
  3. 03The filters you will actually useTemplates and Jinja2 · intermediate · ~20 min
  4. 04Undefined variables and silent wrong outputTemplates and Jinja2 · advanced · ~20 min
  5. 05Validate before it becomes liveTemplates and Jinja2 · advanced · ~22 min
  6. 06Where validate is not enoughTemplates and Jinja2 · advanced · ~22 min
  7. 07Template a drop-in, not the whole fileTemplates and Jinja2 · intermediate · ~19 min
  8. 08Templates that survive reviewTemplates and Jinja2 · intermediate · ~19 min

Part XVIII

Files and Configuration Management

copy, file, template, lineinfile and blockinfile, and when each is the maintainable choice.

7 lessons
  1. 01Which file module, and whyFiles and configuration management · intermediate · ~18 min
  2. 02file and the meaning of stateFiles and configuration management · intermediate · ~16 min
  3. 03lineinfile without the idempotency trapFiles and configuration management · advanced · ~22 min
  4. 04Owning a region of a file you do not ownFiles and configuration management · intermediate · ~18 min
  5. 05Permissions and context as desired stateFiles and configuration management · intermediate · ~18 min
  6. 06backup: and atomic replacementFiles and configuration management · intermediate · ~18 min
  7. 07Knowing what is there before you change itFiles and configuration management · intermediate · ~18 min

Part XIX

Privilege Escalation

become, become_user, become_method, sudo integration, and least privilege on managed nodes.

6 lessons
  1. 01What become actually doesPrivilege escalation · intermediate · ~18 min
  2. 02Escalation methods and where they applyPrivilege escalation · intermediate · ~16 min
  3. 03Escalation passwords without leaking themPrivilege escalation · intermediate · ~17 min
  4. 04Least privilege for the automation accountPrivilege escalation · advanced · ~22 minLab
  5. 05Unprivileged-to-unprivileged escalationPrivilege escalation · advanced · ~20 min
  6. 06Reading a become failurePrivilege escalation · advanced · ~20 min

Part XX

SSH Architecture and Connectivity

Keys, agents, host key verification, bastions, ProxyJump, connection reuse and pipelining.

7 lessons
  1. 01What happens on the wire during a runSSH architecture and connectivity · intermediate · ~22 min
  2. 02Keys and agents for unattended runsSSH architecture and connectivity · intermediate · ~24 min
  3. 03Host key verification is a security controlSSH architecture and connectivity · advanced · ~25 min
  4. 04Reaching a fleet through a bastionSSH architecture and connectivity · advanced · ~24 min
  5. 05Connection reuse and why runs get slowSSH architecture and connectivity · advanced · ~23 min
  6. 06Pipelining and its preconditionsSSH architecture and connectivity · advanced · ~22 min
  7. 07Triaging unreachable hostsSSH architecture and connectivity · advanced · ~24 min

Part XXI

Secrets Management

Vault, vault IDs, external secret managers, no_log, and the ways secrets actually leak.

8 lessons
  1. 01The ways secrets actually leakSecrets management · intermediate · ~24 min
  2. 02Vault file operationsSecrets management · intermediate · ~22 min
  3. 03Encrypting one variable, not the whole fileSecrets management · intermediate · ~22 min
  4. 04Vault IDs across environmentsSecrets management · advanced · ~24 min
  5. 05Where the vault password livesSecrets management · advanced · ~24 min
  6. 06What Vault does not protectSecrets management · advanced · ~22 min
  7. 07no_log, and what it costs youSecrets management · advanced · ~24 min
  8. 08When the secret should not be in the repository at allSecrets management · advanced · ~24 min

Part XXII

Roles and Reuse

Role structure, boundaries, interfaces, dependencies, and include versus import semantics.

8 lessons
  1. 01Role anatomy and where roles are foundRoles and reuse · intermediate · ~18 min
  2. 02What belongs in one roleRoles and reuse · intermediate · ~18 min
  3. 03defaults/ is the interface, vars/ is notRoles and reuse · intermediate · ~19 min
  4. 04Roles that refuse bad inputRoles and reuse · intermediate · ~20 min
  5. 05Static and dynamic role reuseRoles and reuse · intermediate · ~22 min
  6. 06Dependencies and the roles you did not ask forRoles and reuse · intermediate · ~20 min
  7. 07Handlers across role boundariesRoles and reuse · advanced · ~19 min
  8. 08Refactoring a monolith into rolesRoles and reuse · advanced · ~22 min

Part XXIII

Tags, Blocks and Error Handling

tags, block/rescue/always, failed_when, retries, and why blanket ignore_errors hides outages.

8 lessons
  1. 01Tags as an operational controlError handling · intermediate · ~19 min
  2. 02always, never, tagged and untaggedError handling · intermediate · ~17 min
  3. 03The tag that selected nothingError handling · advanced · ~19 min
  4. 04Blocks and shared directivesError handling · intermediate · ~18 min
  5. 05rescue and alwaysError handling · advanced · ~22 min
  6. 06Overriding the module verdictError handling · intermediate · ~18 min
  7. 07Why ignore_errors: true hides outagesError handling · advanced · ~21 min
  8. 08When a retry makes it worseError handling · advanced · ~20 min

Part XXIV

Assertions and Guardrails

Preconditions, assert and fail, and automation that refuses to perform an unsafe operation.

6 lessons
  1. 01Check the world before you change itAssertions and guardrails · intermediate · ~20 min
  2. 02Writing assertions operators can act onAssertions and guardrails · intermediate · ~22 min
  3. 03Automation that refusesAssertions and guardrails · intermediate · ~22 min
  4. 04Guarding against the wrong fleetAssertions and guardrails · advanced · ~24 min
  5. 05Preconditions on capacity and healthAssertions and guardrails · advanced · ~25 min
  6. 06Guardrails operators will not bypassAssertions and guardrails · advanced · ~22 min

Part XXV

Check Mode, Diff and Static Validation

What --check proves and what it cannot, --diff and secret exposure, syntax-check and ansible-lint.

7 lessons
  1. 01The cheapest gates: syntax and listingCheck mode, diff and static validation · intermediate · ~24 min
  2. 02ansible-lint on an existing repositoryCheck mode, diff and static validation · intermediate · ~24 min
  3. 03How check mode worksCheck mode, diff and static validation · intermediate · ~22 min
  4. 04What a clean --check does not proveCheck mode, diff and static validation · advanced · ~24 min
  5. 05Designing a play whose dry run is informativeCheck mode, diff and static validation · advanced · ~24 min
  6. 06--diff and what it printsCheck mode, diff and static validation · advanced · ~22 min
  7. 07The sequence before a production runCheck mode, diff and static validation · advanced · ~24 min

Part XXVI

Testing Automation

The layered testing model, Molecule scenarios, and container versus VM fidelity.

8 lessons
  1. 01The layered testing model: what each rung actually provesTesting automation · intermediate · ~24 min
  2. 02The second run is a testTesting automation · intermediate · ~20 min
  3. 03Where container fidelity stopsTesting automation · intermediate · ~22 min
  4. 04Molecule: a first scenarioTesting automation · intermediate · ~24 minLab
  5. 05One role, three distributionsTesting automation · intermediate · ~20 minLab
  6. 06Verify the outcome, not the task resultTesting automation · intermediate · ~22 min
  7. 07Staging that is worth havingTesting automation · advanced · ~21 min
  8. 08What you cannot test before productionTesting automation · advanced · ~20 min

Part XXVII

Collections, Galaxy and Dependency Trust

Namespaces, requirements files, version pinning, and evaluating third-party automation before running it.

8 lessons
  1. 01Collections, namespaces and the FQCNCollections and dependency trust · intermediate · ~18 min
  2. 02Proving which artefact you installedCollections and dependency trust · intermediate · ~17 min
  3. 03Where collections live and which copy winsCollections and dependency trust · intermediate · ~19 min
  4. 04requirements.yml and version pinningCollections and dependency trust · intermediate · ~21 min
  5. 05Reading a collection before you run itCollections and dependency trust · advanced · ~24 min
  6. 06Checksums, GPG signatures and what they proveCollections and dependency trust · advanced · ~20 min
  7. 07Private Galaxy, mirrors and air-gapped installCollections and dependency trust · advanced · ~21 min
  8. 08Shipping your own internal collectionCollections and dependency trust · advanced · ~22 min

Part XXVIII

Plugins, Lookups and Filters

The plugin architecture, controller-side lookup execution, and readable filter usage.

8 lessons
  1. 01The plugin types and how they loadPlugins, lookups and filters · intermediate · ~19 min
  2. 02Lookups execute on the controllerPlugins, lookups and filters · intermediate · ~20 min
  3. 03lookup, query and loopsPlugins, lookups and filters · intermediate · ~17 min
  4. 04Lookups that touch secretsPlugins, lookups and filters · advanced · ~21 min
  5. 05Filters that make data readablePlugins, lookups and filters · intermediate · ~22 min
  6. 06Jinja tests and conditionals that fail safePlugins, lookups and filters · intermediate · ~20 min
  7. 07Callback plugins and run outputPlugins, lookups and filters · intermediate · ~19 min
  8. 08Writing a filter plugin (and when not to)Plugins, lookups and filters · advanced · ~22 min

Part XXIX

Dynamic Inventory

Inventory plugins, caching, authentication, staleness, and the risk of newly appearing hosts.

8 lessons
  1. 01Inventory plugins, not inventory scriptsDynamic inventory foundations · advanced · ~22 min
  2. 02Building and proving a dynamic sourceDynamic inventory foundations · intermediate · ~24 min
  3. 03Turning provider metadata into targetable groupsDynamic inventory foundations · intermediate · ~26 min
  4. 04Inventory caching and stalenessOperating a dynamic source · advanced · ~24 min
  5. 05Authenticating an inventory sourceOperating a dynamic source · advanced · ~23 min
  6. 06When new hosts appear on their ownOperating a dynamic source · advanced · ~28 min
  7. 07Merging static and dynamic inventoryOperating a dynamic source · advanced · ~25 min
  8. 08When the inventory source failsOperating a dynamic source · advanced · ~26 min

Part XXX

Host Targeting and Blast Radius

Host patterns, --limit, verifying the effective host list, and blast radius as a design constraint.

8 lessons
  1. 01Blast radius as a design constraintBlast radius · intermediate · ~22 min
  2. 02Host pattern syntaxPatterns · intermediate · ~28 min
  3. 03How Ansible evaluates a patternPatterns · intermediate · ~21 min
  4. 04--limit and limit filesNarrowing a run · intermediate · ~26 min
  5. 05Verifying the effective host list before you runNarrowing a run · intermediate · ~27 min
  6. 06Zero hosts: warning or errorNarrowing a run · intermediate · ~24 min
  7. 07ansible_play_hosts, ansible_play_batch and friendsScope from inside the play · advanced · ~24 min
  8. 08Guardrails: refusing to run too wideScope from inside the play · advanced · ~30 min

Part XXXI

Serial Execution and Failure Tolerance

serial batches, max_fail_percentage, any_errors_fatal, and stopping a rollout before it becomes an outage.

8 lessons
  1. 01serial: batching a playSerial Execution · advanced · ~24 min
  2. 02Handlers flush per batchSerial Execution · advanced · ~20 min
  3. 03max_fail_percentage, preciselyFailure Tolerance · advanced · ~26 min
  4. 04any_errors_fatal and what fatal meansFailure Tolerance · advanced · ~23 min
  5. 05Choosing a failure policyFailure Tolerance · advanced · ~22 min
  6. 06Unreachable is not failedFailure Tolerance · advanced · ~24 min
  7. 07Ending a batch or a play deliberatelyFailure Tolerance · advanced · ~22 min
  8. 08Stopping a rollout at 02:00Failure Tolerance · advanced · ~25 min

Part XXXII

Rolling Deployments

Drain, deploy, health-check and return-to-service, built from serial, delegation and wait_for.

8 lessons
  1. 01The shape of a rolling deploymentRolling Deployments · advanced · ~22 min
  2. 02Draining a host from the load balancerRolling Deployments · advanced · ~24 min
  3. 03Health checks that actually assert somethingRolling Deployments · advanced · ~26 min
  4. 04Restart, reload and handler timingRolling Deployments · advanced · ~22 min
  5. 05Return to service and the soak intervalRolling Deployments · advanced · ~23 min
  6. 06When the rollout fails halfwayRolling Deployments · expert · ~27 min
  7. 07Version skew: what must be true to roll at allRolling Deployments · expert · ~25 min
  8. 08The complete rolling playbookRolling Deployments · expert · ~28 minLab

Part XXXIII

Delegation and Controller-Side Execution

delegate_to, run_once, local actions, and knowing which machine a task actually runs on.

7 lessons
  1. 01Which machine does this task run on?Delegation and controller-side execution · advanced · ~22 min
  2. 02delegate_to and the variables that follow itDelegation and controller-side execution · advanced · ~26 min
  3. 03delegate_facts: whose facts are these?Delegation and controller-side execution · advanced · ~24 min
  4. 04Four ways to run something locallyDelegation and controller-side execution · advanced · ~25 min
  5. 05run_once means once per batchDelegation and controller-side execution · advanced · ~28 min
  6. 06Making "exactly once" actually mean onceDelegation and controller-side execution · advanced · ~26 min
  7. 07Delegating to a host that is not in inventoryDelegation and controller-side execution · advanced · ~24 min

Part XXXIV

Concurrency, Strategies and Performance

forks, linear versus free, pipelining, fact caching, and measuring before tuning.

7 lessons
  1. 01Measure first, tune secondConcurrency, strategies and performance · advanced · ~26 min
  2. 02forks and the controller real limitsConcurrency, strategies and performance · advanced · ~27 min
  3. 03linear, free and host_pinnedConcurrency, strategies and performance · advanced · ~25 min
  4. 04throttle: protecting shared dependenciesConcurrency, strategies and performance · intermediate · ~22 min
  5. 05Pipelining, ControlPersist and connection costConcurrency, strategies and performance · advanced · ~26 min
  6. 06Fact gathering is usually the billConcurrency, strategies and performance · advanced · ~25 min
  7. 07Fact caching and the risk of stale factsConcurrency, strategies and performance · advanced · ~26 min

Part XXXV

Large Fleet Architecture

Waves, scheduling, controller placement, and the operational shape of automation at thousands of hosts.

7 lessons
  1. 01Waves: ordering a fleet by consequenceLarge fleet architecture · advanced · ~22 min
  2. 02Inventory structure that survives growthLarge fleet architecture · advanced · ~23 min
  3. 03Where the controller livesLarge fleet architecture · advanced · ~24 min
  4. 04Scheduling and the thundering herdLarge fleet architecture · advanced · ~22 min
  5. 05Partitioning a run so it can be resumedLarge fleet architecture · advanced · ~24 min
  6. 06Inventory performance and truth at scaleLarge fleet architecture · advanced · ~23 min
  7. 07Estimating runtime before you commit to a windowLarge fleet architecture · advanced · ~22 min

Part XXXVI

Drift and Convergence

Detecting drift, remediating it, recording intentional exceptions, and avoiding snowflake automation.

7 lessons
  1. 01Drift, and what convergence actually meansDrift and convergence · intermediate · ~20 min
  2. 02Check mode as a drift detectorDrift and convergence · intermediate · ~22 min
  3. 03What check mode cannot tell youDrift and convergence · advanced · ~24 min
  4. 04Reading diff output properlyDrift and convergence · advanced · ~21 min
  5. 05Detect, decide, enforceDrift and convergence · advanced · ~24 min
  6. 06Recording an approved deviationDrift and convergence · advanced · ~23 min
  7. 07Snowflakes and the uniqueness budgetDrift and convergence · advanced · ~22 min

Part XXXVII

Environments and Repository Architecture

Environment separation, directory layout, promotion models, and a reference production repository.

7 lessons
  1. 01Environments are inventories, not variablesEnvironments and repository layout · advanced · ~18 min
  2. 02The reference repository layoutEnvironments and repository layout · advanced · ~22 min
  3. 03Layering group_vars across environmentsEnvironments and repository layout · intermediate · ~19 min
  4. 04One role, many environmentsEnvironments and repository layout · intermediate · ~20 min
  5. 05Promoting a change from development to productionEnvironments and repository layout · advanced · ~20 min
  6. 06Secrets separated by environmentEnvironments and repository layout · advanced · ~20 min
  7. 07Conventions, ownership and the 03:00 READMEEnvironments and repository layout · intermediate · ~18 min

Part XXXVIII

Git Workflow and CI for Ansible

Automation as production code: review, protected branches, lint, syntax, secret scanning and integration tests.

7 lessons
  1. 01This repository can take down the fleetAutomation as production code · intermediate · ~19 min
  2. 02Branch protection and what production runs fromAutomation as production code · advanced · ~18 min
  3. 03Syntax check, yamllint and ansible-lint as CI stagesAutomation as production code · intermediate · ~21 min
  4. 04Keeping secrets out of the repositoryAutomation as production code · advanced · ~20 min
  5. 05Check mode as a merge gateAutomation as production code · advanced · ~20 min
  6. 06Role testing with Molecule in the pipelineAutomation as production code · advanced · ~21 minLab
  7. 07The complete pipelineAutomation as production code · advanced · ~22 min

Part XXXIX

Automation Platforms, RBAC and Event-Driven

AWX and Automation Controller concepts, RBAC, schedules, workflows and event-driven automation safety.

7 lessons
  1. 01What a platform adds over the command lineAutomation platforms, RBAC and event-driven automation · intermediate · ~24 min
  2. 02Projects, inventories, credentials, job templatesAutomation platforms, RBAC and event-driven automation · advanced · ~26 min
  3. 03RBAC as a blast-radius controlAutomation platforms, RBAC and event-driven automation · advanced · ~28 min
  4. 04Credentials the operator never seesAutomation platforms, RBAC and event-driven automation · advanced · ~26 min
  5. 05Schedules, workflows and unattended runsAutomation platforms, RBAC and event-driven automation · advanced · ~28 min
  6. 06Event-driven Ansible: sources, rules, actionsAutomation platforms, RBAC and event-driven automation · advanced · ~26 min
  7. 07Automated response without automating the outageAutomation platforms, RBAC and event-driven automation · advanced · ~30 min

Part XL

Patch and Reboot Management

Controlled fleet patching, reboot detection and recovery, and rolling kernel upgrades.

8 lessons
  1. 01Sizing the patch run before you write itPatch and Reboot Management · advanced · ~24 min
  2. 02Patching Debian and UbuntuPatch and Reboot Management · advanced · ~26 min
  3. 03Patching RHEL, Rocky and AlmaPatch and Reboot Management · advanced · ~26 min
  4. 04The package module and the portability trapPatch and Reboot Management · advanced · ~22 min
  5. 05Deciding whether a reboot is requiredPatch and Reboot Management · advanced · ~25 min
  6. 06The reboot module actual contractPatch and Reboot Management · advanced · ~26 minLab
  7. 07Proving a host came back, not just answeredPatch and Reboot Management · advanced · ~27 minLab
  8. 08Rolling kernel upgrades across a fleetPatch and Reboot Management · expert · ~28 minLab

Part XLI

Service and Application Deployment

Package, configure, validate, health-check, and the extra caution database automation requires.

8 lessons
  1. 01What deploy means to a convergent toolService and Application Deployment · intermediate · ~23 min
  2. 02Service state, enablement and restart disciplineService and Application Deployment · advanced · ~24 min
  3. 03Validating configuration before it can break a serviceService and Application Deployment · advanced · ~24 min
  4. 04Health gates that actually gateService and Application Deployment · advanced · ~25 min
  5. 05Rolling a deployment through a load balancerService and Application Deployment · advanced · ~26 minLab
  6. 06Deploying a version, not latestService and Application Deployment · intermediate · ~24 min
  7. 07Why databases get different rulesService and Application Deployment · expert · ~28 min
  8. 08The limits of Ansible as a deployment toolService and Application Deployment · expert · ~25 min

Part XLII

Ansible Beyond Linux Servers

Network devices, cloud APIs, Terraform hand-off, Docker hosts and Proxmox, with clear tool boundaries.

7 lessons
  1. 01Why network modules run on the controllerBeyond Linux servers · advanced · ~26 min
  2. 02Changing a device you are connected throughBeyond Linux servers · expert · ~28 min
  3. 03Automating APIs instead of hostsBeyond Linux servers · advanced · ~27 min
  4. 04Ansible and Docker hosts: drawing the lineBeyond Linux servers · advanced · ~26 min
  5. 05Ansible and Proxmox VE: drawing the lineBeyond Linux servers · advanced · ~27 min
  6. 06Provisioning versus configurationBeyond Linux servers · advanced · ~26 min
  7. 07A decision table for mixed estatesBeyond Linux servers · advanced · ~24 min

Part XLIII

Observability and Auditing of Automation

Callback output, run metrics, audit trails, and answering who changed three hundred servers.

7 lessons
  1. 01Reading a PLAY RECAP like an operatorObservability and auditing · intermediate · ~26 min
  2. 02Changing what a run tells youObservability and auditing · intermediate · ~25 min
  3. 03The controller log nobody turned onObservability and auditing · advanced · ~25 min
  4. 04Machine-readable run artefactsObservability and auditing · advanced · ~26 min
  5. 05"Who changed three hundred servers?"Observability and auditing · advanced · ~28 min
  6. 06Metrics that predict an automation failureObservability and auditing · advanced · ~27 min
  7. 07Reporting outward without making it mandatoryObservability and auditing · advanced · ~25 min

Part XLIV

Failure Modes and Partial Fleet Failure

failed, unreachable, skipped and rescued; and judging whether a partial success is a failed change.

8 lessons
  1. 01The seven things that can happen to a hostFailure Modes and Partial Fleet Failure · advanced · ~22 min
  2. 02Three hundred hosts, two hundred and twenty successesFailure Modes and Partial Fleet Failure · advanced · ~26 min
  3. 03Why unreachable hosts are the dangerous onesFailure Modes and Partial Fleet Failure · advanced · ~25 min
  4. 04When the connection dies mid-taskFailure Modes and Partial Fleet Failure · expert · ~26 min
  5. 05Fighting the automatic updater for the package lockFailure Modes and Partial Fleet Failure · advanced · ~24 min
  6. 06Is it safe to run it again?Failure Modes and Partial Fleet Failure · advanced · ~26 min
  7. 07Retry, roll back, quarantine or investigateFailure Modes and Partial Fleet Failure · expert · ~27 min
  8. 08Stopping a bad change at host twelveFailure Modes and Partial Fleet Failure · expert · ~26 min

Part XLV

Debugging and Troubleshooting

Verbosity levels, variable and inventory inspection, Jinja errors, SSH and sudo faults, without leaking secrets.

7 lessons
  1. 01Verbosity is a disclosure decisionDebugging and Troubleshooting · advanced · ~24 min
  2. 02Proving which hosts you are about to touchDebugging and Troubleshooting · intermediate · ~22 min
  3. 03Finding out which variable wonDebugging and Troubleshooting · advanced · ~25 min
  4. 04Reading Jinja and templating errorsDebugging and Troubleshooting · advanced · ~25 min
  5. 05Diagnosing transport failuresDebugging and Troubleshooting · advanced · ~26 min
  6. 06Diagnosing privilege escalation failuresDebugging and Troubleshooting · advanced · ~24 min
  7. 07Reducing three hundred hosts to one reproductionDebugging and Troubleshooting · advanced · ~25 min

Part XLVI

Python and Interpreter Discovery

Remote Python requirements, interpreter discovery, minimal hosts, raw bootstrapping and Windows in brief.

6 lessons
  1. 01What actually runs on a managed nodeRemote Python and interpreter discovery · intermediate · ~20 min
  2. 02How Ansible chooses a PythonRemote Python and interpreter discovery · advanced · ~22 min
  3. 03Pinning the interpreter as a production decisionRemote Python and interpreter discovery · intermediate · ~20 min
  4. 04Bootstrapping a host with no PythonRemote Python and interpreter discovery · advanced · ~22 min
  5. 05Targets that cannot run PythonRemote Python and interpreter discovery · advanced · ~18 min
  6. 06Windows in brief, and why it is differentRemote Python and interpreter discovery · intermediate · ~20 min

Part XLVII

Controller Security

Hardening the controller, SSH key management and rotation, and why controller compromise is fleet compromise.

7 lessons
  1. 01Controller compromise is fleet compromiseController security · intermediate · ~18 min
  2. 02Building a controller worth trustingController security · advanced · ~22 min
  3. 03Who is allowed to run whatController security · advanced · ~22 min
  4. 04Keys that are only good for automationController security · advanced · ~24 min
  5. 05Rotating a key across a fleet without locking yourself outController security · expert · ~26 min
  6. 06Vault identity custody and rotationController security · advanced · ~22 min
  7. 07Every collection you install runs as root everywhereController security · advanced · ~22 min

Part XLVIII

Maintenance Windows and Rollback

Change windows, rollback patterns Ansible does not give you for free, and backups worth having.

7 lessons
  1. 01Ansible has no undoMaintenance windows and rollback · advanced · ~26 min
  2. 02The reverse is part of the changeMaintenance windows and rollback · advanced · ~26 min
  3. 03A catalogue of rollback patterns, and what each is forMaintenance windows and rollback · advanced · ~30 min
  4. 04Running the windowMaintenance windows and rollback · advanced · ~28 min
  5. 05Canary first, with criteria written downMaintenance windows and rollback · advanced · ~28 min
  6. 06A backup you have not restored is a hypothesisMaintenance windows and rollback · advanced · ~28 min
  7. 07Reconciling a fleet after a partial rollbackMaintenance windows and rollback · expert · ~30 min

Part XLIX

Compliance, Validation and Certificates

Audit versus enforce, infrastructure testing, health checks, certificate deployment and secret rotation.

7 lessons
  1. 01Reporting drift versus correcting itCompliance, validation and certificates · advanced · ~28 min
  2. 02What check mode actually proves in an auditCompliance, validation and certificates · expert · ~28 min
  3. 03Producing evidence an auditor can readCompliance, validation and certificates · advanced · ~28 min
  4. 04Validation plays that fail loudlyCompliance, validation and certificates · advanced · ~30 min
  5. 05Certificates, end to endCompliance, validation and certificates · advanced · ~30 min
  6. 06Rotating a secret across three hundred hostsCompliance, validation and certificates · expert · ~30 min
  7. 07Compliance on a schedule, read by someoneCompliance, validation and certificates · expert · ~28 min

Part L

Automation Disaster Recovery

Rebuilding a lost controller, pinned reproducible environments, and execution environments.

6 lessons
  1. 01The controller is permanently lostWhat the controller actually held · advanced · ~26 min
  2. 02What belongs in the repository, and what must notWhat the controller actually held · advanced · ~30 min
  3. 03A controller you can rebuild byte-for-byte enoughMaking the rebuild possible · advanced · ~32 min
  4. 04Backing up the things you must not lose or leakMaking the rebuild possible · expert · ~30 min
  5. 05Execution environments as a reproducibility answerMaking the rebuild possible · advanced · ~30 min
  6. 06The timed rebuild drillProving the rebuild works · expert · ~28 minLab

Part LI

Custom Modules and Tool Selection

When a custom module is justified, and when Ansible is the wrong tool entirely.

6 lessons
  1. 01Exhaust the alternatives firstDeciding to write code · advanced · ~28 min
  2. 02Writing a module that behaves like a real oneWriting and shipping a module · expert · ~34 min
  3. 03The contract a module owes its usersWriting and shipping a module · expert · ~30 min
  4. 04Testing it, then shipping it properlyWriting and shipping a module · expert · ~32 min
  5. 05Filter, lookup, module or action pluginChoosing the right tool · advanced · ~28 min
  6. 06When Ansible is the wrong toolChoosing the right tool · advanced · ~30 min

Part LII

Anti-Patterns

The recurring failure shapes: shell everywhere, secrets in Git, no limit, no canary, no rollback.

8 lessons
  1. 01Anti-pattern: shell everywhereAnti-patterns of construction · intermediate · ~26 min
  2. 02Anti-pattern: secrets in GitAnti-patterns of construction · advanced · ~28 min
  3. 03Anti-pattern: no limit, no canaryAnti-patterns of execution · advanced · ~26 min
  4. 04Anti-pattern: ignore_errors as a green-build buttonAnti-patterns of execution · intermediate · ~26 min
  5. 05Anti-pattern: tasks that always change, or never doAnti-patterns of reporting · intermediate · ~26 min
  6. 06Anti-pattern: encoding the inventory in whenAnti-patterns of reporting · intermediate · ~28 min
  7. 07Anti-pattern: latest everywhereAnti-patterns of neglect · intermediate · ~26 min
  8. 08Anti-pattern: automation nobody tests, and automation nobody dares runAnti-patterns of neglect · advanced · ~30 min

Part LIII

Labs

Hands-on exercises against disposable controller and managed-node topologies.

0 lessons

No lessons published in this part yet. The full curriculum is planned in docs/courses/ansible/curriculum.md on GitHub.

Part LIV

Runbooks

Step-by-step operational procedures for running and recovering Ansible automation.

0 lessons
23 runbooks →

Part LV

Checklists

Pre-execution, production change, patching and security review checklists.

0 lessons
13 checklists →

Part LVI

Break/Fix Scenarios

Deliberate automation incidents diagnosed from evidence.

0 lessons
22 break/fix scenarios →

Part LVII

Capstone

A complete production Ansible estate, operated end to end.

0 lessons

No lessons published in this part yet. The full curriculum is planned in docs/courses/ansible/curriculum.md on GitHub.

Part ansible-final

Final Assessment

Practical assessment of a deliberately flawed Ansible repository.

0 lessons

No lessons published in this part yet. The full curriculum is planned in docs/courses/ansible/curriculum.md on GitHub.