Ansible Playbook

Ansible Playbook

Write and review Ansible playbooks, roles, and tasks following best practices.

Instructions

When writing:

1. Understand the target configuration goal
2. Check existing playbooks/​roles for patterns to follow
3. Write idempotent tasks with proper error handling
4. Include appropriate tags and handlers

When reviewing:

1. Read the playbook/​role
2. Check for issues listed below
3. Suggest improvements

Playbook structure

---
- name: Configure web servers
  hosts: webservers
  become: true
  vars_files:
    - vars/​main.yml
  handlers:
    - name: Restart nginx
      ansible.builtin.service:
        name: nginx
        state: restarted
  tasks:
    - name: Install nginx
      ansible.builtin.apt:
        name: nginx
        state: present
        update_cache: true
      notify: Restart nginx
      tags: [nginx, packages]

Best practices

• MUST use FQCNs: ansible.builtin.copy not copy
• MUST use name: for every task
• MUST use become: explicitly, not assuming root
• Use handlers for service restarts
• Use block/​rescue/​always for error handling
• Use ansible-vault for secrets
• Use variables for anything environment-specific
• Use --check mode compatible tasks where possible

Security checks

• No plaintext passwords in playbooks
• Secrets in vault-encrypted files
• no_log: true on tasks with sensitive data
• File permissions explicitly set
• SSH keys not hardcoded

Common patterns

# Idempotent file content
- name: Configure app
  ansible.builtin.template:
    src: app.conf.j2
    dest: /​etc/​app/​config
    mode: "0644"
    owner: app
    group: app
    validate: "/​usr/​bin/​app --check %s"
  notify: Restart app

# Package installation
- name: Install packages
  ansible.builtin.apt:
    name: "{{ packages }}"
    state: present
  vars:
    packages:
      - nginx
      - certbot

Rules

• MUST use fully qualified collection names (FQCNs)
• MUST include task names
• Never hardcode secrets in playbooks
• Never use shell: when a module exists
• Always make tasks idempotent