360 Secure SkillHub
360 安全技能中心

ansible

围绕 Ansible 无 agent 自动化运维，提供安装与控制节点配置、inventory 与变量优先级、playbook/role/模块编写、ansible、ansible-playbook、ansible-vault、ansible-galaxy 命令速查，并强调 --check --diff 预演、--limit 限定范围、vault 加密密钥等安全实践。

greedychipmunk
热度 0.00
最近更新 2026-10-18 21:21:07
分类：自动化依赖：代码执行 / 读写文件应用场景：自动化脚本 / DevOps / 工作流 / 代码生成

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add greedychipmunk/agent-skills/ansible
Metadata
name
ansible
description
Automate configuration management and application deployment with Ansible. Use when tasks mention ansible-playbook, inventory files, Ansible roles, ad-hoc commands, ansible-galaxy, or agentless SSH automation.
license
MIT
metadata
{"author":"greedychipmunk","version":"1.0"}

Ansible

Intent Router

Request Reference Load When
Install tool, SSH setup, ansible.cfg resources/install-and-setup.md User needs to install Ansible or configure control node
Inventory files, group_vars, host_vars resources/inventory-and-variables.md User needs inventory structure or variable precedence
Playbook authoring, roles, modules resources/playbook-patterns.md User needs play structure, task patterns, or common modules
CLI commands, vault, galaxy resources/command-cookbook.md User needs ansible/ansible-playbook/ansible-vault/galaxy commands

Quick Start

# 1. Define your inventory
cat > inventory.ini <<'EOF'
[web]
web1.example.com
web2.example.com

[db]
db1.example.com
EOF

# 2. Test connectivity (ad-hoc ping)
ansible all -i inventory.ini -m ping

# 3. Run a playbook
ansible-playbook -i inventory.ini site.yml

# 4. Dry-run a playbook (check mode — no changes)
ansible-playbook -i inventory.ini site.yml --check --diff

Core Concepts

Concept Description
Control node Machine where Ansible runs (requires Python; no agent needed on targets)
Managed node Target host reached via SSH (Linux) or WinRM (Windows)
Inventory List of managed nodes (INI, YAML, or dynamic script)
Playbook YAML file defining ordered plays and tasks
Role Reusable directory structure (tasks, handlers, templates, vars)
Module Idempotent unit of work (copy, service, package, user, command…)
Collection Packaged set of roles, modules, and plugins from Ansible Galaxy

Safety Guardrails

  • Always run with --check --diff first to preview changes without applying them.
  • Use --limit to target a subset of hosts before running against all inventory.
  • Avoid command and shell modules when an idempotent module exists.
  • Running as root (become: true) requires explicit approval — confirm privilege escalation scope.
  • Protect secrets with ansible-vault encrypt — never commit plaintext passwords.
# Install a role then dry-run the playbook to preview changes
ansible-galaxy role install geerlingguy.java
ansible-playbook -i inventory.ini site.yml --check --diff

Workflow

  1. Define or update inventory.
  2. Test connectivity: ansible all -m ping -i inventory.ini
  3. Write or update playbook.
  4. Dry-run: ansible-playbook site.yml -i inventory.ini --check --diff
  5. Run against a subset: ansible-playbook site.yml -i inventory.ini --limit web1.example.com
  6. Run against all: ansible-playbook site.yml -i inventory.ini

Related Skills

  • terraform — provision infrastructure; Ansible configures after provisioning
  • pulumi — IaC with code; Ansible handles post-provision configuration

References