Ansible · DevOps & CI/CD Deep Dive

Anatomy

The Building Blocks

Inventory — list of hosts (static INI/YAML or dynamic from cloud APIs).
Module — a unit of work (apt, file, service, copy) executed on the target.
Task — invocation of a module with parameters; should be idempotent.
Playbook — YAML file mapping plays (host group → tasks).
Roles — reusable, structured bundles of tasks/templates/handlers.
Collections — distribution unit on Ansible Galaxy; modules + roles + plugins.
Vault — encrypt secrets at rest within the repo.

When It Shines

Configuring VMs and bare metal — exactly what it was built for.
Network device automation via Ansible network modules (Cisco, Arista, Juniper).
One-off ops tasks — patch this fleet, restart these services, rotate that key.
Hybrid environments where Terraform provisions and Ansible configures.
Air-gapped / regulated — agentless means nothing extra to certify on hosts.

Tradeoffs

Slow at scale. SSH-fanout and Python on every target add up; Mitogen helps.
YAML + Jinja2 templates blur into a pseudo-language; complex playbooks get hard to reason about.
Idempotence is on you. shell and command modules don't make tasks idempotent for free.
Containers/K8s usually have better-fit tools (Helm/Kustomize) — using Ansible there is uphill.
Module signing & supply chain matter; pin collection versions.

Continue