Ansible
Master enterprise Ansible automation: Agentless SSH, Inventory design (group_vars/host_vars), Idempotent playbooks, Jinja2 templating, Variable precedence, Handlers, Task Blocks & Rescue error handling, Modular Roles & Galaxy, Ansible Vault secrets, and AWX / Ansible Tower job templates.
Stage 1 — Architecture & Inventory
2 lessonsWhy Ansible requires no target agent, OpenSSH multiplexing, ControlPersist, ad-hoc CLI commands, and the 4-level ansible.cfg precedence hierarchy.
Master Ansible inventory design, human-meaningful aliases, nested child groups, group_vars and host_vars directory inheritance, and dynamic cloud inventory plugins.
Stage 2 — Playbooks, Templates & Vars
3 lessonsMaster YAML playbook structure, privilege escalation (become), core system modules (package, service, template, user, file), and the Idempotency state machine.
Compare lineinfile, blockinfile, replace, and template modules, Jinja2 expression syntax, filters, template validation, and ansible_managed headers.
Master the 22-level Ansible variable precedence hierarchy, system facts (setup module), custom local facts (/etc/ansible/facts.d/), and variable naming standards.
Stage 3 — Control Flow & Error Handling
2 lessonsMaster playbook control flow: conditional when expressions, Jinja2 tests, loops, delayed execution Handlers, async execution & polling, and serial rolling updates.
Master defensive playbook design: Task Blocks (block, rescue, always), error override flags (ignore_errors, failed_when), smoke testing with uri module, and --check mode.
Stage 4 — Security, Roles & Enterprise Automation
3 lessonsMaster Ansible Roles directory structure, generating roles with ansible-galaxy, role dependencies, meta configuration, and Red Hat 1-Git-repo-per-role standards.
Master Ansible Vault AES-256 encryption, encrypting files vs inline string variables, Vault password files, multiple Vault IDs, and CI/CD secret integration.
Master Red Hat Ansible Automation Platform / AWX, Job Templates, Inventories, RBAC, Surveys, Workflows, and a complete multi-tier deployment capstone.
🗺️ Beginner → Expert Roadmap
4 stages with prerequisites and a concrete mastery check at each.
🎯 What You'll Learn
- • Understand Ansible agentless architecture, SSH multiplexing, ad-hoc execution, and ansible.cfg precedence.
- • Design structured static and dynamic inventories using host groups, nested children, group_vars, and host_vars.
- • Write production-grade idempotent playbooks using core system modules (package, service, template, user, file).
- • Differentiate lineinfile, blockinfile, and Jinja2 templates using template validation and ansible_managed headers.
- • Navigate the 22-level variable precedence hierarchy, leverage system facts, and define local custom facts.
- • Control playbook execution flow with conditionals (when), Jinja2 tests, loops, async/polling, and handlers.
- • Build resilient playbooks with Task Blocks (block/rescue/always), smoke tests (uri module), and check mode (--check).
- • Create modular, reusable Ansible Roles with ansible-galaxy init, meta dependencies, and Red Hat single-repo standards.
- • Encrypt sensitive secrets, API tokens, and passwords using Ansible Vault AES-256 encryption and vault IDs.
- • Architect enterprise automation pipelines using AWX / Ansible Tower Job Templates, RBAC credentials, and Workflows.
🛡️ Best Practices in Production
The short version of this path. Every lesson also ends with the specific mistake it exists to prevent.
- ✓ Write tasks that are idempotent, and verify with
--check --diffbefore every real run. - ✓ Prefer purpose-built modules over
command/shell; when you must shell out, setcreates/removes. - ✓ Keep inventory in Git with
group_varsandhost_vars, and know the variable precedence order. - ✓ Structure reusable work as roles with a documented
defaults/main.ymlinterface. - ✓ Encrypt secrets with Ansible Vault, and keep the vault password out of the repository.
- ✓ Use handlers for restarts so a service bounces once per run, not once per task.
- ✓ Target changes with
--limitand--serialso a bad play cannot hit the whole fleet at once. - ✓ Pin collection and role versions in
requirements.yml.
- ✗
shell/commandfor something a module already does — you lose idempotency and check mode. - ✗
ignore_errors: yesused to make a play green. Usefailed_whenwith a real condition. - ✗ Secrets in plain
group_vars, or a vault password file committed alongside them. - ✗ Running against production with no
--limitand no--checkfirst. - ✗ Relying on task ordering across hosts without
serial, so a rolling change becomes simultaneous. - ✗ Roles that reach outside themselves into another role's internal variables.