1. Target State

Deep Dive and Submission Example for Target State

A complete treatment of Target State contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Target State

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Target State

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Target State is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Target State

This section is not just a definition. In the workshop, Target State is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Target State

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Target State

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Target State

Operations Note for Target State

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

You work in a safe Ansible lab and build a reviewable automation model for Professional. The focus is repository standards, collections, CI, ansible-lint, Molecule, dynamic inventory, orchestration, runbooks, AWX, execution environments. At the end you can explain which hosts are targeted, which data sources are used, which modules create the desired state, and how success is evidenced.

2. Level Positioning

Deep Dive and Submission Example for Level Positioning

A complete treatment of Level Positioning contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Level Positioning

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Level Positioning

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Level Positioning is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Level Positioning

This section is not just a definition. In the workshop, Level Positioning is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Level Positioning

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Level Positioning

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Level Positioning

Operations Note for Level Positioning

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

This level belongs to the path Fundamentals -> Intermediate -> Professional -> Advanced + Security. Reliable automation is not just execution; it is scope control, idempotence, reviewability, and reversibility.

3. Exercise Sheet

Deep Dive and Submission Example for Exercise Sheet

A complete treatment of Exercise Sheet contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Exercise Sheet

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Exercise Sheet

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Exercise Sheet is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Exercise Sheet

This section is not just a definition. In the workshop, Exercise Sheet is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Exercise Sheet

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Exercise Sheet

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Exercise Sheet

Operations Note for Exercise Sheet

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

The detailed tasks are in exercises/03-professional-exercises-ansible-EN.md. Use this workshop file for explanation and review criteria, and the exercise sheet for concrete deliverables.

4. Safe Workflow

Deep Dive and Submission Example for Safe Workflow

A complete treatment of Safe Workflow contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Safe Workflow

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Safe Workflow

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Safe Workflow is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Safe Workflow

This section is not just a definition. In the workshop, Safe Workflow is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Safe Workflow

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Safe Workflow

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Safe Workflow

Operations Note for Safe Workflow

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

1. Check ansible --version and the active configuration.
2. Inspect inventory with ansible-inventory --graph.
3. Prove target scope with ansible-playbook --list-hosts.
4. Run a syntax check.
5. Use check mode and diff mode where supported.
6. Run against a narrow pattern or --limit.
7. Evaluate a second run for idempotence.
8. Document evidence, deviations, and cleanup.

ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

5. Diagrams

Deep Dive and Submission Example for Diagrams

A complete treatment of Diagrams contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Diagrams

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Diagrams

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Diagrams is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Diagrams

This section is not just a definition. In the workshop, Diagrams is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Diagrams

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Diagrams

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Diagrams

Operations Note for Diagrams

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

flowchart LR
  learner[Participant] --> control[Control Node]
  control --> inventory[Inventory]
  control --> playbook[Playbook]
  playbook --> tasks[Tasks]
  tasks --> modules[Modules]
  modules --> targets[Managed Nodes]
  playbook --> evidence[Evidence]

6. Lab Setup and Prerequisites

Deep Dive and Submission Example for Lab Setup and Prerequisites

A complete treatment of Lab Setup and Prerequisites contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Lab Setup and Prerequisites

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Lab Setup and Prerequisites

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Lab Setup and Prerequisites is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Lab Setup and Prerequisites

This section is not just a definition. In the workshop, Lab Setup and Prerequisites is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Lab Setup and Prerequisites

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Lab Setup and Prerequisites

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Lab Setup and Prerequisites

Operations Note for Lab Setup and Prerequisites

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

You need an Ubuntu-based shell, Python 3, Git, Ansible, an editor, and an isolated lab. Many examples safely target localhost; realistic exercises can use two VMs.

7. Technical Foundations

Deep Dive and Submission Example for Technical Foundations

A complete treatment of Technical Foundations contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Technical Foundations

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Technical Foundations

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Technical Foundations is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Technical Foundations

This section is not just a definition. In the workshop, Technical Foundations is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Technical Foundations

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Technical Foundations

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Technical Foundations

Operations Note for Technical Foundations

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

1. repository standards

repository standards is handled as part of a safe automation workflow. Always describe goal, scope, data source, module choice, validation, and cleanup. Prefer ansible.builtin modules and avoid shell workarounds without a technical reason.

2. collections

collections is handled as part of a safe automation workflow. Always describe goal, scope, data source, module choice, validation, and cleanup. Prefer ansible.builtin modules and avoid shell workarounds without a technical reason.

3. CI

CI is handled as part of a safe automation workflow. Always describe goal, scope, data source, module choice, validation, and cleanup. Prefer ansible.builtin modules and avoid shell workarounds without a technical reason.

4. ansible-lint

ansible-lint is handled as part of a safe automation workflow. Always describe goal, scope, data source, module choice, validation, and cleanup. Prefer ansible.builtin modules and avoid shell workarounds without a technical reason.

5. Molecule

Molecule is handled as part of a safe automation workflow. Always describe goal, scope, data source, module choice, validation, and cleanup. Prefer ansible.builtin modules and avoid shell workarounds without a technical reason.

6. dynamic inventory

dynamic inventory is handled as part of a safe automation workflow. Always describe goal, scope, data source, module choice, validation, and cleanup. Prefer ansible.builtin modules and avoid shell workarounds without a technical reason.

7. orchestration

orchestration is handled as part of a safe automation workflow. Always describe goal, scope, data source, module choice, validation, and cleanup. Prefer ansible.builtin modules and avoid shell workarounds without a technical reason.

8. runbooks

runbooks is handled as part of a safe automation workflow. Always describe goal, scope, data source, module choice, validation, and cleanup. Prefer ansible.builtin modules and avoid shell workarounds without a technical reason.

9. AWX

AWX is handled as part of a safe automation workflow. Always describe goal, scope, data source, module choice, validation, and cleanup. Prefer ansible.builtin modules and avoid shell workarounds without a technical reason.

10. execution environments

execution environments is handled as part of a safe automation workflow. Always describe goal, scope, data source, module choice, validation, and cleanup. Prefer ansible.builtin modules and avoid shell workarounds without a technical reason.

8. Practice Modules

Deep Dive and Submission Example for Practice Modules

A complete treatment of Practice Modules contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Practice Modules

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Practice Modules

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Practice Modules is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Practice Modules

This section is not just a definition. In the workshop, Practice Modules is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Practice Modules

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Practice Modules

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Practice Modules

Operations Note for Practice Modules

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Module 1: repository standards

Goal: apply repository standards in practice. Verify inventory and scope, write a small playbook, run syntax check, check mode, real run, and a second idempotence run.

Module 2: collections

Goal: apply collections in practice. Verify inventory and scope, write a small playbook, run syntax check, check mode, real run, and a second idempotence run.

Module 3: CI

Goal: apply CI in practice. Verify inventory and scope, write a small playbook, run syntax check, check mode, real run, and a second idempotence run.

Module 4: ansible-lint

Goal: apply ansible-lint in practice. Verify inventory and scope, write a small playbook, run syntax check, check mode, real run, and a second idempotence run.

Module 5: Molecule

Goal: apply Molecule in practice. Verify inventory and scope, write a small playbook, run syntax check, check mode, real run, and a second idempotence run.

Module 6: dynamic inventory

Goal: apply dynamic inventory in practice. Verify inventory and scope, write a small playbook, run syntax check, check mode, real run, and a second idempotence run.

Module 7: orchestration

Goal: apply orchestration in practice. Verify inventory and scope, write a small playbook, run syntax check, check mode, real run, and a second idempotence run.

Module 8: runbooks

Goal: apply runbooks in practice. Verify inventory and scope, write a small playbook, run syntax check, check mode, real run, and a second idempotence run.

9. Required Exercises

Deep Dive and Submission Example for Required Exercises

A complete treatment of Required Exercises contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Required Exercises

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Required Exercises

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Required Exercises is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Required Exercises

This section is not just a definition. In the workshop, Required Exercises is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Required Exercises

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Required Exercises

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Required Exercises

Operations Note for Required Exercises

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

• Exercise 1: explain, apply, break, diagnose, and validate repository standards.
• Exercise 2: explain, apply, break, diagnose, and validate collections.
• Exercise 3: explain, apply, break, diagnose, and validate CI.
• Exercise 4: explain, apply, break, diagnose, and validate ansible-lint.
• Exercise 5: explain, apply, break, diagnose, and validate Molecule.
• Exercise 6: explain, apply, break, diagnose, and validate dynamic inventory.
• Exercise 7: explain, apply, break, diagnose, and validate orchestration.
• Exercise 8: explain, apply, break, diagnose, and validate runbooks.

10. Knowledge Check and Success Criteria

Deep Dive and Submission Example for Knowledge Check and Success Criteria

A complete treatment of Knowledge Check and Success Criteria contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Knowledge Check and Success Criteria

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Knowledge Check and Success Criteria

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Knowledge Check and Success Criteria is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Knowledge Check and Success Criteria

This section is not just a definition. In the workshop, Knowledge Check and Success Criteria is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Knowledge Check and Success Criteria

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Knowledge Check and Success Criteria

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Knowledge Check and Success Criteria

Operations Note for Knowledge Check and Success Criteria

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

A solution is successful when scope, module choice, privilege use, variable sources, check/diff evidence, second-run idempotence, secret handling, and cleanup notes are clear.

11. Boundaries and Transition

Deep Dive and Submission Example for Boundaries and Transition

A complete treatment of Boundaries and Transition contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Boundaries and Transition

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Boundaries and Transition

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Boundaries and Transition is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Boundaries and Transition

This section is not just a definition. In the workshop, Boundaries and Transition is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Boundaries and Transition

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Boundaries and Transition

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Boundaries and Transition

Operations Note for Boundaries and Transition

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

This level does not replace production documentation or organization-specific security rules. It provides the technical foundation for later levels.

Sources and Further References

• Official Ansible Community Documentation: https://docs.ansible.com/
• Ansible Getting Started: https://docs.ansible.com/projects/ansible/latest/getting_started/index.html
• Inventory Guide: https://docs.ansible.com/projects/ansible/latest/inventory_guide/index.html
• Playbook Guide: https://docs.ansible.com/projects/ansible/latest/playbook_guide/index.html
• Module Index: https://docs.ansible.com/ansible/latest/collections/ansible/builtin/index.html
• Vault Guide: https://docs.ansible.com/projects/ansible/latest/vault_guide/index.html
• Ansible Lint: https://ansible.readthedocs.io/projects/lint/
• Molecule: https://ansible.readthedocs.io/projects/molecule/
• AWX: https://github.com/ansible/awx
• Red Hat Certifications: https://www.redhat.com/en/services/certifications