Command Reference: Ansible · Ansible

1. Safe Working Rules

Deep Dive and Submission Example for Safe Working Rules

A complete treatment of Safe Working Rules contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for Safe Working Rules

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Safe Working Rules

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Safe Working Rules is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Safe Working Rules

This section is not just a definition. In the workshop, Safe Working Rules is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for Safe Working Rules

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Safe Working Rules

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Safe Working Rules

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for Safe Working Rules

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Safe Working Rules is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

2. Notation and Placeholders

Deep Dive and Submission Example for Notation and Placeholders

A complete treatment of Notation and Placeholders contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for Notation and Placeholders

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Notation and Placeholders

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Notation and Placeholders is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Notation and Placeholders

This section is not just a definition. In the workshop, Notation and Placeholders is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for Notation and Placeholders

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Notation and Placeholders

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Notation and Placeholders

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for Notation and Placeholders

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Notation and Placeholders is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

3. Installation and Versions

Deep Dive and Submission Example for Installation and Versions

A complete treatment of Installation and Versions contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for Installation and Versions

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Installation and Versions

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Installation and Versions is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Installation and Versions

This section is not just a definition. In the workshop, Installation and Versions is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for Installation and Versions

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Installation and Versions

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Installation and Versions

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for Installation and Versions

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Installation and Versions is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

4. ansible-config

Deep Dive and Submission Example for ansible-config

A complete treatment of ansible-config contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for ansible-config

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for ansible-config

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, ansible-config is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of ansible-config

This section is not just a definition. In the workshop, ansible-config is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for ansible-config

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for ansible-config

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for ansible-config

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for ansible-config

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

ansible-config is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

5. ansible-inventory

Deep Dive and Submission Example for ansible-inventory

A complete treatment of ansible-inventory contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for ansible-inventory

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for ansible-inventory

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, ansible-inventory is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of ansible-inventory

This section is not just a definition. In the workshop, ansible-inventory is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for ansible-inventory

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for ansible-inventory

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for ansible-inventory

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for ansible-inventory

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

ansible-inventory is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

6. Ad-hoc Commands

Deep Dive and Submission Example for Ad-hoc Commands

A complete treatment of Ad-hoc Commands contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for Ad-hoc Commands

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Ad-hoc Commands

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Ad-hoc Commands is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Ad-hoc Commands

This section is not just a definition. In the workshop, Ad-hoc Commands is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for Ad-hoc Commands

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Ad-hoc Commands

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Ad-hoc Commands

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for Ad-hoc Commands

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Ad-hoc Commands is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

7. ansible-playbook

Deep Dive and Submission Example for ansible-playbook

A complete treatment of ansible-playbook contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for ansible-playbook

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for ansible-playbook

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, ansible-playbook is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of ansible-playbook

This section is not just a definition. In the workshop, ansible-playbook is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for ansible-playbook

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for ansible-playbook

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for ansible-playbook

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for ansible-playbook

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

ansible-playbook is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

8. Syntax Check

Deep Dive and Submission Example for Syntax Check

A complete treatment of Syntax Check contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for Syntax Check

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Syntax Check

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Syntax Check is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Syntax Check

This section is not just a definition. In the workshop, Syntax Check is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for Syntax Check

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Syntax Check

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Syntax Check

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for Syntax Check

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Syntax Check is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

9. Check Mode and Diff Mode

Deep Dive and Submission Example for Check Mode and Diff Mode

A complete treatment of Check Mode and Diff Mode contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for Check Mode and Diff Mode

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Check Mode and Diff Mode

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Check Mode and Diff Mode is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Check Mode and Diff Mode

This section is not just a definition. In the workshop, Check Mode and Diff Mode is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for Check Mode and Diff Mode

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Check Mode and Diff Mode

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Check Mode and Diff Mode

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for Check Mode and Diff Mode

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Check Mode and Diff Mode is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

10. Limit, Tags, and Start-at-task

Deep Dive and Submission Example for Limit, Tags, and Start-at-task

A complete treatment of Limit, Tags, and Start-at-task contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for Limit, Tags, and Start-at-task

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Limit, Tags, and Start-at-task

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Limit, Tags, and Start-at-task is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Limit, Tags, and Start-at-task

This section is not just a definition. In the workshop, Limit, Tags, and Start-at-task is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for Limit, Tags, and Start-at-task

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Limit, Tags, and Start-at-task

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Limit, Tags, and Start-at-task

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for Limit, Tags, and Start-at-task

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Limit, Tags, and Start-at-task is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

11. Vault Commands

Deep Dive and Submission Example for Vault Commands

A complete treatment of Vault Commands contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for Vault Commands

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Vault Commands

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Vault Commands is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Vault Commands

This section is not just a definition. In the workshop, Vault Commands is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for Vault Commands

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Vault Commands

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Vault Commands

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for Vault Commands

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Vault Commands is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

12. Galaxy and Collections

Deep Dive and Submission Example for Galaxy and Collections

A complete treatment of Galaxy and Collections contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for Galaxy and Collections

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Galaxy and Collections

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Galaxy and Collections is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Galaxy and Collections

This section is not just a definition. In the workshop, Galaxy and Collections is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for Galaxy and Collections

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Galaxy and Collections

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Galaxy and Collections

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for Galaxy and Collections

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Galaxy and Collections is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

13. Roles and Skeletons

Deep Dive and Submission Example for Roles and Skeletons

A complete treatment of Roles and Skeletons contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for Roles and Skeletons

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Roles and Skeletons

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Roles and Skeletons is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Roles and Skeletons

This section is not just a definition. In the workshop, Roles and Skeletons is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for Roles and Skeletons

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Roles and Skeletons

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Roles and Skeletons

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for Roles and Skeletons

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Roles and Skeletons is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

14. ansible-lint

Deep Dive and Submission Example for ansible-lint

A complete treatment of ansible-lint contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for ansible-lint

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for ansible-lint

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, ansible-lint is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of ansible-lint

This section is not just a definition. In the workshop, ansible-lint is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for ansible-lint

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for ansible-lint

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for ansible-lint

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for ansible-lint

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

ansible-lint is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

15. Molecule

Deep Dive and Submission Example for Molecule

A complete treatment of Molecule contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for Molecule

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Molecule

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Molecule is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Molecule

This section is not just a definition. In the workshop, Molecule is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for Molecule

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Molecule

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Molecule

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for Molecule

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Molecule is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

16. Runner and AWX Orientation

Deep Dive and Submission Example for Runner and AWX Orientation

A complete treatment of Runner and AWX Orientation contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for Runner and AWX Orientation

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Runner and AWX Orientation

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Runner and AWX Orientation is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Runner and AWX Orientation

This section is not just a definition. In the workshop, Runner and AWX Orientation is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for Runner and AWX Orientation

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Runner and AWX Orientation

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Runner and AWX Orientation

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for Runner and AWX Orientation

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Runner and AWX Orientation is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

17. JSON, YAML, and Output Formats

Deep Dive and Submission Example for JSON, YAML, and Output Formats

A complete treatment of JSON, YAML, and Output Formats contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for JSON, YAML, and Output Formats

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for JSON, YAML, and Output Formats

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, JSON, YAML, and Output Formats is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of JSON, YAML, and Output Formats

This section is not just a definition. In the workshop, JSON, YAML, and Output Formats is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for JSON, YAML, and Output Formats

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for JSON, YAML, and Output Formats

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for JSON, YAML, and Output Formats

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for JSON, YAML, and Output Formats

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

JSON, YAML, and Output Formats is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

18. Troubleshooting Commands

Deep Dive and Submission Example for Troubleshooting Commands

A complete treatment of Troubleshooting Commands contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for Troubleshooting Commands

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Troubleshooting Commands

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Troubleshooting Commands is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Troubleshooting Commands

This section is not just a definition. In the workshop, Troubleshooting Commands is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for Troubleshooting Commands

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Troubleshooting Commands

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Troubleshooting Commands

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for Troubleshooting Commands

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Troubleshooting Commands is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

19. Operations Checklists

Deep Dive and Submission Example for Operations Checklists

A complete treatment of Operations Checklists contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Submission Part	Content	Minimum Quality
target description	what should be true after the run	measurable and without hidden assumptions
scope evidence	which hosts are affected	output from `--list-hosts` or inventory graph
implementation	which files were changed	small reviewable YAML files
validation	how it was checked	syntax check, check mode, diff, real run, second run
risk decision	what can go wrong	privileges, secrets, external dependencies, and rollback considered

Minimal Artifacts for Operations Checklists

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Operations Checklists

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Operations Checklists is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Operations Checklists

This section is not just a definition. In the workshop, Operations Checklists is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Review Question	Expected Answer
Which hosts are affected?	Pattern, group, `--limit`, and inventory output are documented.
Which data sources apply?	`group_vars`, `host_vars`, defaults, extra vars, and facts are known.
Which privileges are required?	`become` is close to the task and justified.
How is success proven?	Syntax check, check mode, diff, play recap, and second run are present.

Example Flow for Operations Checklists

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Operations Checklists

Inventory and patterns are narrower than all unless a reason is documented.
Modules from ansible.builtin or reviewed collections are preferred.
Shell or command tasks include changed_when, failed_when, or a clear reason.
Variables are placed predictably and do not override each other surprisingly.
Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
The playbook can run repeatedly without unnecessary changes.
Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Operations Checklists

Failure	Cause	Diagnosis
wrong hosts targeted	pattern or inventory misunderstood	`--list-hosts`, `ansible-inventory --host`
`unreachable`	SSH, user, Python, or network issue	`-vvvv`, SSH test, inventory variables
unexpected change	module not idempotent or wrong data source	second run, diff, variable inspection
secret leak	debug, diff, or log not scoped	check `no_log`, Vault, CI artifacts
handler does not run	no `changed` result or wrong handler name	inspect task result and handler name

Operations Note for Operations Checklists

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Operations Checklists is a practical building block of the Ansible workshop. The desired state must be described, executed against a controlled scope, and validated before and after the run. A solid Ansible workflow answers four questions: which hosts are targeted, which change is performed, which privileges are required, and how success is measured.

Aspect	Workshop Meaning	Check
Scope	Inventory, pattern, `--limit`, tags, and environment select target systems.	`ansible-inventory --graph`, `ansible-playbook --list-hosts`
State	Modules should model desired state and produce repeatable results.	second run without unnecessary changes
Privilege	`become` is used close to the task and justified.	no broad global privilege without review
Evidence	Output, diffs, and summaries are documented.	play recap, diff, evidence file

Typical commands:

ansible --version
ansible-config dump --only-changed
ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff

For reviews, a playbook is ready only when it proves its target scope, exposes its data sources, protects sensitive values, describes failure paths, and remains stable after a second run. If a module does not fully support check mode or diff mode, that limitation belongs in the runbook.

Common mistakes are broad patterns such as all, unclear variable sources, shell workarounds without idempotence, secrets in debug output, missing rollback notes, and missing separation between lab and production inventory.

Additional command examples:

ansible all -i inventory/hosts.yml --list-hosts
ansible all -i inventory/hosts.yml -m ansible.builtin.ping
ansible all -i inventory/hosts.yml -m ansible.builtin.setup -a "filter=ansible_distribution*"
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --limit web --tags config
ansible-vault encrypt group_vars/all/vault.yml
ansible-galaxy collection install -r collections/requirements.yml

Sources and Further References

Official Ansible Community Documentation: https://docs.ansible.com/
Ansible Getting Started: https://docs.ansible.com/projects/ansible/latest/getting_started/index.html
Inventory Guide: https://docs.ansible.com/projects/ansible/latest/inventory_guide/index.html
Playbook Guide: https://docs.ansible.com/projects/ansible/latest/playbook_guide/index.html
Module Index: https://docs.ansible.com/ansible/latest/collections/ansible/builtin/index.html
Vault Guide: https://docs.ansible.com/projects/ansible/latest/vault_guide/index.html
Ansible Lint: https://ansible.readthedocs.io/projects/lint/
Molecule: https://ansible.readthedocs.io/projects/molecule/
AWX: https://github.com/ansible/awx
Red Hat Certifications: https://www.redhat.com/en/services/certifications