ansible
56 commands
56 shown
Run a playbook
Run playbook with diff output to see what changes
ansible-playbook -i inventory/prod playbook.yml --diff
Limit to specific host
Run only against specific hosts from inventory
ansible-playbook -i inventory playbook.yml --limit host1,host2
Run specific tag
Execute only tasks matching these tags
ansible-playbook -i inventory playbook.yml --tags install,configure
Skip specific tags
Skip tasks with the specified tags
ansible-playbook -i inventory playbook.yml --skip-tags cleanup
Dry run (check mode)
Simulate execution without making changes
ansible-playbook -i inventory playbook.yml --check --diff
Ad-hoc ping all hosts
Check connectivity to all hosts in inventory
ansible all -i inventory -m ping
Ad-hoc run shell command
Run a one-liner shell command on all hosts
ansible all -i inventory -m shell -a 'uptime'
Ad-hoc copy file
Copy a file to all hosts
ansible all -i inventory -m copy -a 'src=./file dest=/tmp/file'
Gather facts from host
Collect all Ansible facts (OS, CPU, network) from a host
ansible <host> -i inventory -m setup | jq '._ansible_facts'
Encrypt variable with vault
Inline-encrypt a string for use in playbooks
ansible-vault encrypt_string 'secret_value' --name 'db_password'
Encrypt file with vault
Encrypt an entire variable file with Ansible Vault
ansible-vault encrypt vars/secrets.yml
Decrypt vault file
Decrypt an Ansible Vault-encrypted file in place
ansible-vault decrypt vars/secrets.yml
View encrypted file
View contents of vault-encrypted file without decrypting on disk
ansible-vault view vars/secrets.yml
Install role from Galaxy
Download roles listed in requirements.yml to local roles dir
ansible-galaxy install -r requirements.yml -p roles/
Install collection
Install an Ansible collection from Ansible Galaxy
ansible-galaxy collection install community.kubernetes
List inventory hosts
Show all hosts and groups parsed from inventory
ansible-inventory -i inventory --list | jq 'keys'
Run with extra vars
Pass extra variables at runtime overriding playbook defaults
ansible-playbook playbook.yml -e 'env=prod version=2.0'
Verbose output
Maximum verbosity — shows every task, connection, output
ansible-playbook playbook.yml -vvv
Syntax check playbook
Validate YAML syntax without executing any tasks
ansible-playbook playbook.yml --syntax-check
Ad-hoc ping all hosts
Check SSH connectivity and Python for all hosts
ansible all -m ping -i inventory.ini
Run shell command on group
Run a shell command on all hosts in the webservers group
ansible webservers -m shell -a 'uptime && free -h' -i inventory.ini
Gather facts for a host
Collect and filter Ansible facts for a single host
ansible <host> -m setup -i inventory.ini | jq '.ansible_facts | {os: .ansible_distribution, mem: .ansible_memtotal_mb}'
Check mode (dry run)
Show what would change without making any modifications
ansible-playbook site.yml --check --diff -i inventory.ini
Run with extra variables
Override variables from the command line
ansible-playbook deploy.yml -e 'env=prod version=2.1.0' -i inventory.ini
Limit to specific hosts
Run playbook only on specified hosts
ansible-playbook site.yml --limit 'web-01,web-02' -i inventory.ini
Run specific tags
Execute only tasks marked with specified tags
ansible-playbook site.yml --tags 'config,restart' -i inventory.ini
Skip specific tags
Skip tasks with specified tags
ansible-playbook site.yml --skip-tags 'slow,optional' -i inventory.ini
Increase verbosity
Maximum verbosity for debugging; save to log
ansible-playbook site.yml -vvv -i inventory.ini 2>&1 | tee /tmp/ansible.log
Encrypt a variable with Vault
Inline-encrypt a value for use in playbook vars
ansible-vault encrypt_string 'supersecret' --name 'db_password'
Decrypt vault file
Display decrypted content of a vault-encrypted file
ansible-vault view group_vars/all/vault.yml
Copy file to remote
Push a local file to all hosts with specific permissions
ansible all -m copy -a 'src=./nginx.conf dest=/etc/nginx/nginx.conf owner=root mode=0644' -i inventory.ini
Restart service on all hosts
Ad-hoc service restart with privilege escalation (-b)
ansible webservers -m service -a 'name=nginx state=restarted' -b -i inventory.ini
Show inventory graph
Display inventory group hierarchy as a tree
ansible-inventory -i inventory.ini --graph
Test role locally with Molecule
Run full Molecule test suite: create, converge, verify, destroy
molecule test -s default
Test connectivity (ping)
Verify SSH connectivity to all hosts in inventory
ansible all -i inventory.ini -m ping
Run ad-hoc shell command
Execute a shell command on all webservers with sudo (-b)
ansible webservers -i inventory.ini -m shell -a 'df -h' -b
Gather facts for a host
Collect and inspect Ansible facts for one host
ansible myhost -i inventory.ini -m setup | jq '.ansible_facts.ansible_distribution'
Run playbook with tags
Execute only tasks tagged nginx or ssl
ansible-playbook site.yml -i inventory.ini --tags 'nginx,ssl'
Skip specific tags
Skip tasks tagged slow or optional
ansible-playbook site.yml -i inventory.ini --skip-tags 'slow,optional'
Encrypt variable with Vault
Inline-encrypt a single string value for use in vars
ansible-vault encrypt_string 'mysecretpassword' --name 'db_password'
Limit to specific hosts
Run playbook only on web01 and web02
ansible-playbook deploy.yml -i inventory.ini --limit 'web01,web02'
Step through tasks interactively
Confirm each task before execution (debug mode)
ansible-playbook site.yml -i inventory.ini --step
Rekey vault file
Re-encrypt vault with a new password without exposing plaintext; rotate secrets safely
ansible-vault rekey vault.yml --new-vault-password-file new_pass.txt
Multiple vault IDs with prompt
Mix vault IDs: file for dev, interactive prompt for prod; lets you stage secrets per env
ansible-playbook site.yml --vault-id dev@dev_pass.txt --vault-id prod@prompt
Edit vault in place
Decrypt, edit in $EDITOR, re-encrypt atomically — never writes plaintext to disk
EDITOR=vim ansible-vault edit group_vars/prod/secrets.yml --vault-password-file ~/.vault_pass
Dynamic inventory graph
Render dynamic cloud inventory tree with host vars; verify plugin grouping before a run
ansible-inventory -i aws_ec2.yml --graph --vars
Inventory as YAML
Materialize a dynamic inventory to static YAML for diffing or offline debugging
ansible-inventory -i aws_ec2.yml --list --yaml > resolved_inventory.yml
Constructed keyed_groups
Auto-build host groups from facts/tags via constructed plugin; e.g. role_web, region_eu
plugin: constructed
keyed_groups:
- key: tags.Role
prefix: role
- key: placement.region
prefix: region
Molecule scaffold role
Scaffold a role with a Molecule scenario; MOLECULE_DISTRO picks the test image
molecule init role my_role --driver-name docker && cd my_role && MOLECULE_DISTRO=ubuntu2204 molecule create
Molecule converge then verify
Apply the role to the test instance, then run assertions (testinfra/ansible verifiers)
molecule converge && molecule verify
Molecule idempotence check
Re-run the role and fail if any task reports changed — catches non-idempotent tasks
molecule idempotence
Molecule login to instance
SSH into a live Molecule test container to inspect state mid-scenario before destroy
molecule login --host instance
Resume at a specific task
Skip everything before a named task; resume a failed long playbook without redoing setup
ansible-playbook site.yml --start-at-task "Deploy app config"
List tasks and hosts dry
Preview execution plan: every task and resolved target host, without connecting
ansible-playbook site.yml --list-tasks --list-hosts -i prod
Per-task timing profile
Rank tasks by wall-clock time to find the slow steps; profile_roles is the per-role variant
ANSIBLE_CALLBACKS_ENABLED=profile_tasks ansible-playbook site.yml
Keep remote temp files
Preserve pushed module scripts under ~/.ansible/tmp to debug a failing module by hand
ANSIBLE_KEEP_REMOTE_FILES=1 ansible-playbook site.yml -vvvv --limit <host>
no commands match