Ansible Interview Guide: Configuration Management Fundamentals

# 1. Terraform creates infrastructure
terraform apply
 
# 2. Ansible configures it
ansible-playbook -i inventory configure.yml

# inventory/hosts.ini
 
[webservers]
web1.example.com
web2.example.com
web3.example.com
 
[databases]
db1.example.com
db2.example.com
 
[production:children]
webservers
databases
 
[webservers:vars]
http_port=80

# inventory/hosts.yml
all:
  children:
    webservers:
      hosts:
        web1.example.com:
        web2.example.com:
      vars:
        http_port: 80
    databases:
      hosts:
        db1.example.com:
          db_port: 5432
        db2.example.com:
          db_port: 5432

# group_vars/webservers.yml
http_port: 80
nginx_worker_processes: auto
ssl_enabled: true
 
# host_vars/web1.example.com.yml
nginx_worker_processes: 4  # Override for this host

# AWS EC2 dynamic inventory
ansible-inventory -i aws_ec2.yml --list
 
# Using plugin
ansible-playbook -i aws_ec2.yml playbook.yml

# aws_ec2.yml
plugin: amazon.aws.aws_ec2
regions:
  - us-east-1
  - us-west-2
filters:
  tag:Environment: production
keyed_groups:
  - key: tags.Role
    prefix: role
  - key: placement.availability_zone
    prefix: az
compose:
  ansible_host: public_ip_address

# Target specific hosts
ansible webservers -m ping
 
# Multiple groups
ansible 'webservers:databases' -m ping
 
# Intersection (in both groups)
ansible 'webservers:&production' -m ping
 
# Exclusion
ansible 'webservers:!web3.example.com' -m ping
 
# Regex
ansible '~web[0-9]+\.example\.com' -m ping

# playbook.yml
---
- name: Configure web servers
  hosts: webservers
  become: yes  # Run as root
  vars:
    http_port: 80
 
  tasks:
    - name: Install nginx
      apt:
        name: nginx
        state: present
        update_cache: yes
 
    - name: Start nginx
      service:
        name: nginx
        state: started
        enabled: yes
 
  handlers:
    - name: Restart nginx
      service:
        name: nginx
        state: restarted

# Debian/Ubuntu
- name: Install packages
  apt:
    name:
      - nginx
      - postgresql
      - python3
    state: present
    update_cache: yes
 
# RHEL/CentOS
- name: Install packages
  yum:
    name: nginx
    state: present
 
# Generic (detects OS)
- name: Install package
  package:
    name: nginx
    state: present

# Copy file
- name: Copy config
  copy:
    src: nginx.conf
    dest: /etc/nginx/nginx.conf
    owner: root
    group: root
    mode: '0644'
  notify: Restart nginx
 
# Template (Jinja2)
- name: Deploy config from template
  template:
    src: nginx.conf.j2
    dest: /etc/nginx/nginx.conf
  notify: Restart nginx
 
# Create directory
- name: Ensure directory exists
  file:
    path: /var/www/app
    state: directory
    owner: www-data
    mode: '0755'
 
# Create symlink
- name: Create symlink
  file:
    src: /etc/nginx/sites-available/app
    dest: /etc/nginx/sites-enabled/app
    state: link

- name: Ensure nginx is running
  service:
    name: nginx
    state: started
    enabled: yes
 
# systemd specific
- name: Reload systemd
  systemd:
    daemon_reload: yes

# Avoid when possible - not idempotent
- name: Run script
  command: /opt/scripts/setup.sh
  args:
    creates: /opt/app/.installed  # Only run if file doesn't exist
 
# Shell for pipes and redirects
- name: Check disk space
  shell: df -h | grep /dev/sda1
  register: disk_result
  changed_when: false  # Never report changed

- name: Install Apache on Debian
  apt:
    name: apache2
    state: present
  when: ansible_os_family == "Debian"
 
- name: Install Apache on RedHat
  yum:
    name: httpd
    state: present
  when: ansible_os_family == "RedHat"
 
# Multiple conditions
- name: Configure production
  template:
    src: prod.conf.j2
    dest: /etc/app/config
  when:
    - env == "production"
    - ansible_memory_mb.real.total > 4096
 
# Based on previous task
- name: Check if app exists
  stat:
    path: /opt/app
  register: app_stat
 
- name: Install app
  command: /opt/install.sh
  when: not app_stat.stat.exists

# Simple list
- name: Create users
  user:
    name: "{{ item }}"
    state: present
  loop:
    - alice
    - bob
    - charlie
 
# List of dictionaries
- name: Create users with groups
  user:
    name: "{{ item.name }}"
    groups: "{{ item.groups }}"
  loop:
    - { name: 'alice', groups: 'admin' }
    - { name: 'bob', groups: 'developers' }
 
# With index
- name: Create numbered files
  copy:
    content: "File {{ idx }}"
    dest: "/tmp/file{{ idx }}.txt"
  loop: "{{ range(1, 5) | list }}"
  loop_control:
    index_var: idx
 
# Dictionary iteration
- name: Set sysctl values
  sysctl:
    name: "{{ item.key }}"
    value: "{{ item.value }}"
  loop: "{{ sysctl_settings | dict2items }}"
  vars:
    sysctl_settings:
      net.ipv4.ip_forward: 1
      net.core.somaxconn: 65535

tasks:
  - name: Update nginx config
    template:
      src: nginx.conf.j2
      dest: /etc/nginx/nginx.conf
    notify:
      - Validate nginx config
      - Restart nginx
 
  - name: Update SSL cert
    copy:
      src: ssl.crt
      dest: /etc/nginx/ssl/
    notify: Restart nginx  # Same handler, runs once
 
handlers:
  - name: Validate nginx config
    command: nginx -t
    changed_when: false
 
  - name: Restart nginx
    service:
      name: nginx
      state: restarted

- name: Update config
  template:
    src: app.conf.j2
    dest: /etc/app/config
  notify: Restart app
 
- name: Force handlers now
  meta: flush_handlers
 
- name: Continue with app running
  uri:
    url: http://localhost:8080/health

# roles/nginx/defaults/main.yml
nginx_port: 80
nginx_worker_processes: auto
nginx_sites: []
 
# roles/nginx/tasks/main.yml
---
- name: Install nginx
  apt:
    name: nginx
    state: present
  when: ansible_os_family == "Debian"
 
- name: Configure nginx
  template:
    src: nginx.conf.j2
    dest: /etc/nginx/nginx.conf
  notify: Restart nginx
 
- name: Configure sites
  template:
    src: site.conf.j2
    dest: "/etc/nginx/sites-available/{{ item.name }}"
  loop: "{{ nginx_sites }}"
  notify: Restart nginx
 
- name: Enable sites
  file:
    src: "/etc/nginx/sites-available/{{ item.name }}"
    dest: "/etc/nginx/sites-enabled/{{ item.name }}"
    state: link
  loop: "{{ nginx_sites }}"
  notify: Restart nginx
 
- name: Start nginx
  service:
    name: nginx
    state: started
    enabled: yes
 
# roles/nginx/handlers/main.yml
---
- name: Restart nginx
  service:
    name: nginx
    state: restarted

# playbook.yml
---
- name: Configure web servers
  hosts: webservers
  become: yes
 
  roles:
    - nginx
    - { role: app, app_port: 3000 }
    - role: monitoring
      vars:
        monitoring_enabled: true
      when: env == "production"

# roles/app/meta/main.yml
---
dependencies:
  - role: nginx
    vars:
      nginx_port: 80
  - role: nodejs
    vars:
      nodejs_version: "18"

# Install role from Galaxy
ansible-galaxy install geerlingguy.nginx
 
# Install from requirements file
ansible-galaxy install -r requirements.yml
 
# List installed roles
ansible-galaxy list
 
# Create role skeleton
ansible-galaxy init my_role

roles:
  - name: geerlingguy.nginx
    version: "3.1.0"
  - name: geerlingguy.postgresql
    version: "3.4.0"
  - src: https://github.com/org/ansible-role-app.git
    scm: git
    version: v1.2.0
    name: app
 
collections:
  - name: amazon.aws
    version: ">=5.0.0"

# Gathering facts (automatic)
- name: Show OS info
  debug:
    msg: "OS: {{ ansible_distribution }} {{ ansible_distribution_version }}"
 
# Useful facts
ansible_hostname           # Short hostname
ansible_fqdn               # Fully qualified domain name
ansible_default_ipv4.address  # Primary IP
ansible_memtotal_mb        # Total memory
ansible_processor_vcpus    # CPU count
ansible_os_family          # Debian, RedHat, etc.
 
# Magic variables
inventory_hostname         # Name in inventory
groups['webservers']       # List of hosts in group
hostvars['web1']           # Variables for another host
ansible_play_hosts         # All hosts in current play

- name: Quick playbook
  hosts: all
  gather_facts: no  # Skip if not needed
  tasks:
    - name: Just copy a file
      copy:
        src: file.txt
        dest: /tmp/

{# templates/nginx.conf.j2 #}
worker_processes {{ nginx_worker_processes | default('auto') }};
 
events {
    worker_connections {{ nginx_worker_connections | default(1024) }};
}
 
http {
    {% for site in nginx_sites %}
    server {
        listen {{ site.port | default(80) }};
        server_name {{ site.domain }};
        root {{ site.root }};
 
        {% if site.ssl | default(false) %}
        listen 443 ssl;
        ssl_certificate {{ site.ssl_cert }};
        ssl_certificate_key {{ site.ssl_key }};
        {% endif %}
 
        {% for location in site.locations | default([]) %}
        location {{ location.path }} {
            {{ location.config }}
        }
        {% endfor %}
    }
    {% endfor %}
}

{{ variable | default('fallback') }}
{{ list | join(', ') }}
{{ string | lower }}
{{ string | upper }}
{{ path | basename }}
{{ path | dirname }}
{{ dict | to_json }}
{{ dict | to_yaml }}
{{ password | password_hash('sha512') }}
{{ list | first }}
{{ list | last }}
{{ number | int }}
{{ value | bool }}

# Create encrypted file
ansible-vault create secrets.yml
 
# Encrypt existing file
ansible-vault encrypt secrets.yml
 
# Edit encrypted file
ansible-vault edit secrets.yml
 
# View encrypted file
ansible-vault view secrets.yml
 
# Decrypt file
ansible-vault decrypt secrets.yml
 
# Encrypt single string
ansible-vault encrypt_string 'mysecret' --name 'db_password'

# group_vars/production/vault.yml (encrypted)
vault_db_password: supersecret
vault_api_key: abc123
 
# group_vars/production/vars.yml (plain, references vault)
db_password: "{{ vault_db_password }}"
api_key: "{{ vault_api_key }}"

# Run with vault password
ansible-playbook playbook.yml --ask-vault-pass
ansible-playbook playbook.yml --vault-password-file ~/.vault_pass

# BAD - always reports changed
- name: Add line to file
  shell: echo "export PATH=/opt/bin:$PATH" >> /etc/profile
 
# GOOD - idempotent
- name: Add line to file
  lineinfile:
    path: /etc/profile
    line: 'export PATH=/opt/bin:$PATH'
    state: present
 
# BAD - always runs
- name: Create database
  command: createdb myapp
 
# GOOD - check first
- name: Create database
  command: createdb myapp
  args:
    creates: /var/lib/postgresql/data/myapp  # Skip if exists

[defaults]
inventory = inventory/production
roles_path = roles
retry_files_enabled = False
host_key_checking = False
 
[privilege_escalation]
become = True
become_method = sudo
become_user = root

# Initialize molecule for existing role
cd roles/nginx
molecule init scenario -r nginx -d docker
 
# Run full test sequence
molecule test
 
# Just converge (apply role)
molecule converge
 
# Login to test instance
molecule login
 
# Destroy test environment
molecule destroy

dependency:
  name: galaxy
driver:
  name: docker
platforms:
  - name: ubuntu
    image: ubuntu:22.04
    pre_build_image: true
  - name: centos
    image: centos:8
    pre_build_image: true
provisioner:
  name: ansible
verifier:
  name: ansible

name: Ansible
 
on:
  push:
    branches: [main]
  pull_request:
 
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Run ansible-lint
        uses: ansible/ansible-lint@main
 
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
 
      - name: Install dependencies
        run: |
          pip install ansible molecule molecule-docker
 
      - name: Run Molecule tests
        run: molecule test
        working-directory: roles/nginx
 
  deploy:
    needs: [lint, test]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
 
      - name: Run playbook
        uses: dawidd6/action-ansible-playbook@v2
        with:
          playbook: playbooks/site.yml
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          vault_password: ${{ secrets.VAULT_PASSWORD }}
          options: |
            --inventory inventory/production

# Problem: shell always reports changed
- name: Check app status
  shell: curl -s http://localhost:8080/health
  register: health
 
# Solution 1: changed_when
- name: Check app status
  shell: curl -s http://localhost:8080/health
  register: health
  changed_when: false  # Never report changed
 
# Solution 2: Use uri module (idempotent)
- name: Check app status
  uri:
    url: http://localhost:8080/health
    return_content: yes
  register: health
 
# Problem: command always runs
- name: Initialize database
  command: /opt/app/init-db.sh
 
# Solution: creates argument
- name: Initialize database
  command: /opt/app/init-db.sh
  args:
    creates: /opt/app/.db_initialized

# 1. Increase parallelism
# ansible.cfg
[defaults]
forks = 50  # Default is 5
 
# 2. Use async for long-running tasks
- name: Update packages (async)
  apt:
    upgrade: dist
  async: 3600  # 1 hour timeout
  poll: 0      # Don't wait
  register: apt_update
 
- name: Check update status
  async_status:
    jid: "{{ apt_update.ansible_job_id }}"
  register: job_result
  until: job_result.finished
  retries: 60
  delay: 60
 
# 3. Use strategy
- hosts: all
  strategy: free  # Don't wait for slowest host
  tasks: ...
 
# 4. Pull mode with ansible-pull
# On each host, pull and run playbook
ansible-pull -U https://github.com/org/ansible-config.git
 
# 5. Use AWX/Tower for large scale
# Web UI, job scheduling, RBAC, audit logging

# Increase verbosity
ansible-playbook playbook.yml -vvv
 
# Step through tasks
ansible-playbook playbook.yml --step
 
# Start at specific task
ansible-playbook playbook.yml --start-at-task="Configure app"
 
# Check syntax
ansible-playbook playbook.yml --syntax-check
 
# Dry run
ansible-playbook playbook.yml --check --diff

# Debug task
- name: Debug variables
  debug:
    var: my_variable
 
- name: Debug message
  debug:
    msg: "Value is {{ my_variable }}"
 
# Pause for inspection
- name: Pause for manual check
  pause:
    prompt: "Check server state, press enter to continue"

# Register and use result
- command: whoami
  register: result
- debug:
    var: result.stdout
 
# Block with error handling
- block:
    - name: Try this
      command: /might/fail
  rescue:
    - name: Handle failure
      debug:
        msg: "Task failed, recovering..."
  always:
    - name: Always run
      debug:
        msg: "Cleanup"
 
# Delegate to another host
- name: Add to load balancer
  command: add-backend {{ inventory_hostname }}
  delegate_to: loadbalancer
 
# Run once (not on every host)
- name: Create shared resource
  command: create-resource
  run_once: true