Inventory and access

Inventory tells Ansible which hosts exist and how they are grouped. Keep environment, region, and role visible so an operator can target the intended machines without memorizing hostnames.

Create a YAML inventory

all:
  children:
    web:
      hosts:
        web-01:
          ansible_host: 203.0.113.10
        web-02:
          ansible_host: 203.0.113.11
    workers:
      hosts:
        worker-01:
          ansible_host: 203.0.113.20
  vars:
    ansible_user: deploy
    ansible_ssh_private_key_file: ~/.ssh/cubis_production

Aliases such as web-01 remain stable if an IP changes. Groups let one playbook target servers by purpose. For a larger fleet, use group_vars/ and host_vars/ rather than filling the inventory with settings.

Keep shared values separate

---
ansible_become: true
timezone: UTC
operations_group: cloud-ops
common_packages:
  - curl
  - git
  - jq
  - rsync

Do not store passwords, private keys, cloud credentials, or unencrypted tokens in inventory or variable files. Use SSH keys for access and Ansible Vault or the team’s secret manager for values a playbook needs.

Validate what Ansible sees

ansible-inventory --graph
ansible-inventory --host web-01
ansible web --list-hosts

Read the host list before running a change. A correct playbook against the wrong group is still an outage.

Verify SSH and Python

First test SSH directly:

ssh -i ~/.ssh/cubis_production deploy@203.0.113.10

Then use Ansible’s ping module. It checks that Ansible can authenticate and run Python on the managed host; it is not an ICMP network ping.

ansible all -m ansible.builtin.ping
ansible web -m ansible.builtin.setup -a 'filter=ansible_distribution*'

The gathered facts include ansible_distribution and ansible_os_family. Playbooks can use these values when package names or configuration paths differ.

Prepare Python when it is missing

Minimal cloud images may not include Python. The raw module does not require Python and can bootstrap it.

ansible new_servers -m ansible.builtin.raw \
  -a 'apt-get update && apt-get install -y python3' \
  --become

Run this only for a tightly scoped new_servers group. After Python is present, use normal Ansible modules.