Ansible Configuration Management: Beginner Guide

What Is Configuration Management?

Configuration management is the process of maintaining servers and systems in a consistent, required state.

Instead of manually installing packages, creating users, copying files, or starting services on every server, engineers describe the required configuration in code and apply it automatically.

Configuration management makes infrastructure:

Repeatable
Testable
Version-controlled
Consistent
Easier to audit

It reduces manual errors, configuration drift, downtime, and repetitive administrative work.

What Is Ansible?

Ansible is an open-source IT automation tool commonly used for:

Configuration management
Application deployment
Server provisioning
Patch management
Task automation
Multi-server orchestration

Ansible allows administrators and DevOps engineers to define the desired state of systems and automate the steps required to reach that state.

Simple Explanation

Suppose you must install Apache on 100 servers.

Without Ansible, you might log in to every server and install Apache manually. With Ansible, you create one playbook and run it against all 100 servers.

Why Is Ansible Popular?

1. Agentless Architecture

Ansible does not require the Ansible application or a permanent agent on managed servers.

It normally connects to Linux and other POSIX systems through SSH. Windows systems commonly use WinRM or PowerShell Remoting, although SSH is also supported.

2. Human-Readable YAML

Ansible playbooks use YAML, which is easier to read than many programming languages.

3. Push-Based Automation

Ansible normally pushes automation from the control node to managed nodes. Ansible also supports a pull option through ansible-pull, but push mode is more common.

4. Idempotency

Idempotency means running the same automation repeatedly should maintain the same final state instead of producing unnecessary changes.

For example, if Apache is already installed, an idempotent package module does not install it again. However, not every module or playbook is automatically idempotent.

How Does Ansible Work?

An Ansible environment normally contains three main components.

Control Node

The machine where Ansible is installed and where engineers run Ansible commands and playbooks.

Inventory

The inventory contains the managed servers’ hostnames or IP addresses. Hosts can be organized into groups such as webservers, databases, or production.

Example:

[webservers]
web1.example.com
web2.example.com

[databases]

db1.example.com

Managed Nodes

Managed nodes are the Linux, Windows, cloud, network, or other systems controlled by Ansible.

The basic workflow is:

Ansible reads the inventory.
It identifies the targeted hosts.
It connects to those hosts.
It executes the required modules.
It reports whether each task succeeded, failed, or changed the system.

Important Ansible Components

Modules

Modules perform individual actions, such as:

Installing a package
Creating a user
Copying a file
Starting a service
Managing cloud resources

Examples include package, service, copy, file, and user.

Tasks

A task calls a module to perform one specific action.

Plays

A play maps a group of managed hosts to an ordered list of tasks.

Playbooks

A playbook is a YAML file containing one or more plays. Playbooks provide repeatable automation for configuration management and multi-machine deployments.

Run a playbook with:

ansible-playbook -i inventory.ini webserver.yml

Variables

Variables prevent hard-coding and allow the same playbook to work in different environments.

Facts

Facts are system details gathered from managed nodes, such as operating system, IP address, memory, and hostname. The setup module gathers standard facts.

Conditionals

Conditionals execute tasks only when a condition is true.

Example: install httpd on Red Hat systems but install apache2 on Ubuntu systems.

Loops

Loops repeat a task for multiple items, such as creating several users or installing several packages.

Handlers

A handler is a special task that runs only after another task notifies it and reports a changed state.

Handlers are commonly used to restart a service after its configuration file changes.

Roles

Roles organize tasks, variables, handlers, templates, and files into a standard reusable directory structure. They make large automation projects easier to maintain and share.

Ansible Vault

Ansible Vault encrypts sensitive information such as passwords, keys, and secret variables instead of storing them as plain text.

Ansible Ad-Hoc Commands

An ad-hoc command performs a quick, one-time task without creating a playbook.

Test connectivity:

ansible all -i inventory.ini -m ping

Install Apache:

ansible webservers -i inventory.ini \
  -m package \
  -a "name=httpd state=present" \
  --become

Ad-hoc commands can use Ansible modules and can be idempotent when the selected module supports idempotency. However, they are not saved for repeated use.

Use:

Ad-hoc commands: Quick or temporary operations
Playbooks: Repeatable, complex, and version-controlled automation

Simple Ansible Playbook Example

---
- name: Configure Apache web servers
  hosts: webservers
  become: true

  vars:
    web_package: httpd
    web_service: httpd

  tasks:
    - name: Install Apache
      ansible.builtin.package:
        name: "{{ web_package }}"
        state: present

    - name: Start and enable Apache
      ansible.builtin.service:
        name: "{{ web_service }}"
        state: started
        enabled: true

This playbook:

Targets the webservers inventory group.
Uses privilege escalation.
Installs Apache.
Starts the service.
Enables it during system startup.

Testing an Ansible Playbook

Use check mode to predict changes without applying them:

ansible-playbook -i inventory.ini webserver.yml --check

Use check and diff mode together:

ansible-playbook -i inventory.ini webserver.yml --check --diff

Check mode does not guarantee a perfect test because its behavior depends on module support. Diff mode can show before-and-after configuration changes.

Real-World Ansible Uses

DevOps and system-administration teams use Ansible to:

Install and update software
Create users and groups
Configure services
Apply security settings
Perform server patching
Deploy applications
Configure web servers
Manage cloud resources
Maintain development, testing, and production environments

Ansible Best Practices

Use modules instead of shell commands whenever possible.
Store playbooks in Git.
Use meaningful task names.
Use variables instead of hard-coded values.
Separate development and production inventories.
Organize large projects with roles.
Encrypt secrets with Ansible Vault.
Test changes using check and diff modes.
Use fully qualified module names such as ansible.builtin.package.

Important Ansible Interview Questions

What is Ansible?

Ansible is an agentless IT automation tool used for configuration management, deployment, provisioning, and orchestration.

What is an inventory?

An inventory is a list or dynamic source of managed hosts organized individually or into groups.

What is a playbook?

A playbook is a YAML automation blueprint that maps managed hosts to ordered tasks.

What is idempotency?

Idempotency means repeated automation maintains the same desired final state without unnecessary changes.

What is the difference between a module and a playbook?

A module performs one action. A playbook combines multiple tasks and modules into a repeatable workflow.

What is a handler?

A handler is a special task that runs when notified by another task that produced a change.

What is Ansible Vault?

Ansible Vault protects sensitive variables and files through encryption.

What are Ansible roles?

Roles provide a standard structure for creating reusable and maintainable Ansible automation.

Ansible Tower Terminology Update

Ansible Tower should not be described as the current enterprise edition. It was replaced and renamed as automation controller, which is part of Red Hat Ansible Automation Platform.

Conclusion

Ansible helps DevOps engineers and system administrators manage multiple systems through repeatable automation.

For jobs and interviews, focus first on:

Inventory
Modules
Ad-hoc commands
Playbooks
Variables and facts
Idempotency
Handlers
Roles
Ansible Vault
Check mode

The best way to learn Ansible is to automate a real task, such as installing and configuring a web server across multiple Linux machines.