Blog
Thoughts on engineering, design, and building great products.
Best Practices: Project Structure and Design
Pulling everything into standards: project directory structure, good role design, naming conventions and FQCN, idempotency, secrets management, and using ansible-lint to catch best-practice issues automatically. With a real lint example.
Testing Roles with Molecule
Before pushing a role to hundreds of hosts, test it. Molecule spins up a throwaway container, applies the role, checks idempotency, and verifies the result — automatically. This article: scenario structure, the create→converge→idempotence→verify→destroy test loop, and version caveats.
Optimization and Execution Strategy
Running Ansible fast and safely across hundreds of hosts: forks and strategy control parallelism, serial for zero-downtime rolling updates, delegate_to/run_once, async for long tasks, fact caching and pipelining for speed, tags and check mode for control.
Extending Ansible: Filter, Lookup, and Callback Plugins
Modules extend the work done on the host; plugins extend Ansible itself, running on the control node. This article: filter plugins (transform data in Jinja2), lookup plugins (fetch external data), callback plugins (customize output), and the module vs plugin distinction.
Writing a Custom Module in Python
Deep dive: write your own Ansible module in Python. Understand AnsibleModule, argument_spec, exit_json/fail_json, supporting check_mode, and the pattern for achieving idempotency. This is where the mechanism from Article 1 (shipping a module over SSH) comes full circle.
Ansible Vault: Managing Secrets
Passwords and API keys can't sit in plaintext in Git. Ansible Vault encrypts secrets with AES256, decrypting automatically at run time. This article: encrypt/view/edit secret files, encrypt_string for individual values, using them in a playbook, and best practices.
Ansible Galaxy and Collections
Ansible's modern packaging and distribution: a collection bundles modules, roles, and plugins under one namespace; FQCN for explicit calls; installing collections from Galaxy with requirements.yml; and distinguishing ansible-core from the full ansible package.