• Playbook: A YAML file containing one or more plays that define automation workflows
• Play: A section within a playbook that maps hosts to tasks and defines how tasks should be executed
• Task: Individual units of work that call Ansible modules to perform specific actions

# Playbook
- name: Web server setup          # Play 1
  hosts: webservers
  tasks:
    - name: Install Apache        # Task 1
      yum:
        name: httpd
        state: present
    - name: Start Apache          # Task 2
      service:
        name: httpd
        state: started

Ansible Inventory defines the hosts and groups that Ansible manages. It specifies which machines your playbooks will run against.

Static Inventory (INI format):

[webservers]
web1.example.com
web2.example.com

[databases]
db1.example.com ansible_host=192.168.1.100

[production:children]
webservers
databases

Static Inventory (YAML format):

all:
  children:
    webservers:
      hosts:
        web1.example.com:
        web2.example.com:
    databases:
      hosts:
        db1.example.com:
          ansible_host: 192.168.1.100

Dynamic Inventory:

• Scripts that generate inventory from external sources (AWS, Azure, GCP)
• Returns JSON format with host and group information
• Useful for cloud environments where hosts change frequently
• Can be written in any language that outputs proper JSON

Ansible Facts are system information automatically collected from managed nodes when a playbook runs. They include details about hardware, OS, network configuration, and installed software.

Accessing facts:

- name: Display OS information
  debug:
    msg: "This host runs {{ ansible_distribution }} {{ ansible_distribution_version }}"
- name: Conditional based on facts
  yum:
    name: httpd
    state: present
  when: ansible_os_family == "RedHat"

Custom facts:

- name: Set custom fact
  set_fact:
    custom_variable: "custom_value"
- name: Gather facts manually
  setup:
- name: Disable fact gathering
  hosts: webservers
  gather_facts: false

Ansible Vault is the primary method for encrypting sensitive data like passwords, API keys, and certificates.

Basic Vault operations:

# Encrypt a file
ansible-vault encrypt secrets.yml

# Decrypt a file
ansible-vault decrypt secrets.yml

# Edit encrypted file
ansible-vault edit secrets.yml

# Run playbook with vault password
ansible-playbook site.yml --ask-vault-pass

# Use vault password file
ansible-playbook site.yml --vault-password-file .vault_pass

Encrypting specific variables:

# vars.yml
username: john
password: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  66386439653762356265343432393730...

Best practices:

• Store vault password in a file with restricted permissions (chmod 600)
• Use separate vault files for different environments
• Encrypt only sensitive variables, not entire playbooks
• Use no_log: true in tasks handling sensitive data
• Never commit vault passwords to version control