Blog
Thoughts on engineering, design, and building great products.
A Complete Project and Series Wrap-Up
Putting it all together: a complete Ansible project that deploys an application with a role following best practices, running idempotently on a real server. Then cleaning up the infrastructure, recapping the journey from ad-hoc to custom modules, and pointers for what to learn next.
Best Practices: Project Structure and Design
Pulling everything into standards: project directory structure, good role design, naming conventions and FQCN, idempotency, secrets management, and using ansible-lint to catch best-practice issues automatically. With a real lint example.
Testing Roles with Molecule
Before pushing a role to hundreds of hosts, test it. Molecule spins up a throwaway container, applies the role, checks idempotency, and verifies the result — automatically. This article: scenario structure, the create→converge→idempotence→verify→destroy test loop, and version caveats.
Optimization and Execution Strategy
Running Ansible fast and safely across hundreds of hosts: forks and strategy control parallelism, serial for zero-downtime rolling updates, delegate_to/run_once, async for long tasks, fact caching and pipelining for speed, tags and check mode for control.
Extending Ansible: Filter, Lookup, and Callback Plugins
Modules extend the work done on the host; plugins extend Ansible itself, running on the control node. This article: filter plugins (transform data in Jinja2), lookup plugins (fetch external data), callback plugins (customize output), and the module vs plugin distinction.
Writing a Custom Module in Python
Deep dive: write your own Ansible module in Python. Understand AnsibleModule, argument_spec, exit_json/fail_json, supporting check_mode, and the pattern for achieving idempotency. This is where the mechanism from Article 1 (shipping a module over SSH) comes full circle.
Ansible Vault: Managing Secrets
Passwords and API keys can't sit in plaintext in Git. Ansible Vault encrypts secrets with AES256, decrypting automatically at run time. This article: encrypt/view/edit secret files, encrypt_string for individual values, using them in a playbook, and best practices.