Ansible cheat sheet

A scannable Ansible reference: 12 short snippets across 7 topics, each linking back to the lesson it came from.

At a glance

Quick snippets

Inventories and ad-hoc commands

Configuration and safety

# ansible.cfg — keep it beside your playbooks
[defaults]
inventory = ./inventory.ini
host_key_checking = True
forks = 20
retry_files_enabled = False

[privilege_escalation]
become = True
become_method = sudo
become_ask_pass = False

Full lesson: Inventories and ad-hoc commands →

Playbooks and modules

A first playbook

ansible-playbook -i inventory.ini site.yml
ansible-playbook -i inventory.ini site.yml --check --diff   # rehearse
ansible-playbook -i inventory.ini site.yml --limit web1     # a single host

Full lesson: Playbooks and modules →

Roles, Vault and idempotency

Roles

ansible-galaxy init roles/nginx
# roles/nginx/
#   defaults/main.yml    lowest-precedence variables, meant to be overridden
#   vars/main.yml        higher-precedence variables, rarely changed
#   tasks/main.yml       the work
#   handlers/main.yml    notified handlers
#   templates/           Jinja2 sources for the template module
#   files/               static files for the copy module
#   meta/main.yml        dependencies on other roles

Roles

# site.yml
- hosts: web
  become: true
  roles:
    - role: nginx
      vars:
        nginx_server_name: shop.example.com
    - common          # order in this list is the order they run in

Idempotency and check mode

# converge twice; the second run should report changed=0
ansible-playbook -i inventory.ini site.yml
ansible-playbook -i inventory.ini site.yml

# rehearse on one host and show the diffs
ansible-playbook -i inventory.ini site.yml --check --diff --limit web1

Full lesson: Roles, Vault and idempotency →

Installing Ansible and setting up a control node

Which Ansible to install

# a control node needs Python; the managed nodes need only SSH and Python
python3 -m venv ~/.venvs/ansible
source ~/.venvs/ansible/bin/activate
pip install "ansible-core==2.17.*"

# the community bundle adds hundreds of collections on top of core
pip install "ansible==10.*"

ansible --version
# note the config file path it reports: that is the one it will actually read

SSH, become and a first check

ssh-keygen -t ed25519 -C "ansible-control-node"
ssh-copy-id -i ~/.ssh/id_ed25519.pub [email protected]

ansible all -i inventory/hosts.ini -m ping
ansible web -m setup -a 'filter=ansible_distribution*'
ansible-playbook -i inventory/hosts.ini site.yml --check --diff

# install collections and roles from a pinned requirements file
ansible-galaxy collection install -r requirements.yml -p ./collections
ansible-galaxy role install -r requirements.yml -p ./roles

Full lesson: Installing Ansible and setting up a control node →

Collections, Galaxy and the module ecosystem

Collections and roles

ansible-galaxy collection install -r requirements.yml -p ./collections
ansible-galaxy collection list
ansible-galaxy collection verify ansible.posix
ansible-galaxy role install -r requirements.yml -p ./roles
ansible-galaxy role info geerlingguy.nginx

Full lesson: Collections, Galaxy and the module ecosystem →

Testing automation: lint, check mode and Molecule

Linting the code

# .ansible-lint
profile: production        # or: min, basic, moderate, safety
exclude_paths:
  - .cache/
  - collections/
  - molecule/
warn_list:
  - experimental
skip_list:
  - jinja[spacing]         # only if you disagree, and say why in a comment
use_default_rules: true
offline: false

Linting the code

ansible-lint                      # human-readable
ansible-lint -f pep8              # machine-readable for CI
ansible-lint --fix                # applies what it can safely rewrite
ansible-lint roles/web/tasks/main.yml

# the rules that catch the most real problems
# no-changed-when        a command task without a change condition
# risky-shell-pipe       a shell pipeline without pipefail
# command-instead-of-module   using command where a module exists
# name[template]         a task name built from variables

Check mode and diff

# a dry run: report what would change, change nothing
ansible-playbook -i inventory site.yml --check --diff --limit web1

# check mode with a tag filter is the fastest useful review
ansible-playbook -i inventory site.yml --check --diff --tags config

# syntax and inventory checks that need no connection at all
ansible-playbook site.yml --syntax-check
ansible-inventory -i inventory/hosts.ini --list
ansible-inventory -i inventory/hosts.ini --graph

Full lesson: Testing automation: lint, check mode and Molecule →

Scaling: dynamic inventory and AWX

Dynamic inventory

# a dynamic inventory is reached like any other
ansible-inventory -i inventory/aws_ec2.yml --graph
ansible-inventory -i inventory/aws_ec2.yml --host ec2-host-1
ansible all -i inventory/aws_ec2.yml -m ping --limit role_web

# combine sources: static inventory plus two clouds
# ansible.cfg:
# [defaults]
# inventory = ./inventory/static.ini,./inventory/aws_ec2.yml,./inventory/gcp.yml

Full lesson: Scaling: dynamic inventory and AWX →

FAQ

Related cheat sheets

Git Linux Docker Kubernetes Nginx CI / CD

Last refreshed 2026-09-27.