ansible commands

56 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 56 shown

  • Run a playbook
    ansible-playbook -i inventory/prod playbook.yml --diff

    Run playbook with diff output to see what changes

  • Limit to specific host
    ansible-playbook -i inventory playbook.yml --limit host1,host2

    Run only against specific hosts from inventory

  • Run specific tag
    ansible-playbook -i inventory playbook.yml --tags install,configure

    Execute only tasks matching these tags

  • Skip specific tags
    ansible-playbook -i inventory playbook.yml --skip-tags cleanup

    Skip tasks with the specified tags

  • Dry run (check mode)
    ansible-playbook -i inventory playbook.yml --check --diff

    Simulate execution without making changes

  • Ad-hoc ping all hosts
    ansible all -i inventory -m ping

    Check connectivity to all hosts in inventory

  • Ad-hoc run shell command
    ansible all -i inventory -m shell -a 'uptime'

    Run a one-liner shell command on all hosts

  • Ad-hoc copy file
    ansible all -i inventory -m copy -a 'src=./file dest=/tmp/file'

    Copy a file to all hosts

  • Gather facts from host
    ansible <host> -i inventory -m setup | jq '._ansible_facts'

    Collect all Ansible facts (OS, CPU, network) from a host

    debug

  • Encrypt variable with vault
    ansible-vault encrypt_string 'secret_value' --name 'db_password'

    Inline-encrypt a string for use in playbooks

    secrets

  • Encrypt file with vault
    ansible-vault encrypt vars/secrets.yml

    Encrypt an entire variable file with Ansible Vault

    secrets

  • Decrypt vault file
    ansible-vault decrypt vars/secrets.yml

    Decrypt an Ansible Vault-encrypted file in place

    secrets

  • View encrypted file
    ansible-vault view vars/secrets.yml

    View contents of vault-encrypted file without decrypting on disk

    secrets

  • Install role from Galaxy
    ansible-galaxy install -r requirements.yml -p roles/

    Download roles listed in requirements.yml to local roles dir

  • Install collection
    ansible-galaxy collection install community.kubernetes

    Install an Ansible collection from Ansible Galaxy

  • List inventory hosts
    ansible-inventory -i inventory --list | jq 'keys'

    Show all hosts and groups parsed from inventory

  • Run with extra vars
    ansible-playbook playbook.yml -e 'env=prod version=2.0'

    Pass extra variables at runtime overriding playbook defaults

  • Verbose output
    ansible-playbook playbook.yml -vvv

    Maximum verbosity — shows every task, connection, output

    debug

  • Syntax check playbook
    ansible-playbook playbook.yml --syntax-check

    Validate YAML syntax without executing any tasks

  • Ad-hoc ping all hosts
    ansible all -m ping -i inventory.ini

    Check SSH connectivity and Python for all hosts

  • Run shell command on group
    ansible webservers -m shell -a 'uptime && free -h' -i inventory.ini

    Run a shell command on all hosts in the webservers group

  • Gather facts for a host
    ansible <host> -m setup -i inventory.ini | jq '.ansible_facts | {os: .ansible_distribution, mem: .ansible_memtotal_mb}'

    Collect and filter Ansible facts for a single host

    debug

  • Check mode (dry run)
    ansible-playbook site.yml --check --diff -i inventory.ini

    Show what would change without making any modifications

    debug

  • Run with extra variables
    ansible-playbook deploy.yml -e 'env=prod version=2.1.0' -i inventory.ini

    Override variables from the command line

  • Limit to specific hosts
    ansible-playbook site.yml --limit 'web-01,web-02' -i inventory.ini

    Run playbook only on specified hosts

  • Run specific tags
    ansible-playbook site.yml --tags 'config,restart' -i inventory.ini

    Execute only tasks marked with specified tags

  • Skip specific tags
    ansible-playbook site.yml --skip-tags 'slow,optional' -i inventory.ini

    Skip tasks with specified tags

  • Increase verbosity
    ansible-playbook site.yml -vvv -i inventory.ini 2>&1 | tee /tmp/ansible.log

    Maximum verbosity for debugging; save to log

    debug

  • Encrypt a variable with Vault
    ansible-vault encrypt_string 'supersecret' --name 'db_password'

    Inline-encrypt a value for use in playbook vars

    security

  • Decrypt vault file
    ansible-vault view group_vars/all/vault.yml

    Display decrypted content of a vault-encrypted file

    security

  • Copy file to remote
    ansible all -m copy -a 'src=./nginx.conf dest=/etc/nginx/nginx.conf owner=root mode=0644' -i inventory.ini

    Push a local file to all hosts with specific permissions

  • Restart service on all hosts
    ansible webservers -m service -a 'name=nginx state=restarted' -b -i inventory.ini

    Ad-hoc service restart with privilege escalation (-b)

  • Show inventory graph
    ansible-inventory -i inventory.ini --graph

    Display inventory group hierarchy as a tree

  • Test role locally with Molecule
    molecule test -s default

    Run full Molecule test suite: create, converge, verify, destroy

    debug

  • Test connectivity (ping)
    ansible all -i inventory.ini -m ping

    Verify SSH connectivity to all hosts in inventory

  • Run ad-hoc shell command
    ansible webservers -i inventory.ini -m shell -a 'df -h' -b

    Execute a shell command on all webservers with sudo (-b)

  • Gather facts for a host
    ansible myhost -i inventory.ini -m setup | jq '.ansible_facts.ansible_distribution'

    Collect and inspect Ansible facts for one host

    debug

  • Run playbook with tags
    ansible-playbook site.yml -i inventory.ini --tags 'nginx,ssl'

    Execute only tasks tagged nginx or ssl

  • Skip specific tags
    ansible-playbook site.yml -i inventory.ini --skip-tags 'slow,optional'

    Skip tasks tagged slow or optional

  • Encrypt variable with Vault
    ansible-vault encrypt_string 'mysecretpassword' --name 'db_password'

    Inline-encrypt a single string value for use in vars

    security

  • Limit to specific hosts
    ansible-playbook deploy.yml -i inventory.ini --limit 'web01,web02'

    Run playbook only on web01 and web02

  • Step through tasks interactively
    ansible-playbook site.yml -i inventory.ini --step

    Confirm each task before execution (debug mode)

    debug

  • Rekey vault file
    ansible-vault rekey vault.yml --new-vault-password-file new_pass.txt

    Re-encrypt vault with a new password without exposing plaintext; rotate secrets safely

    vault · secrets · security

  • Multiple vault IDs with prompt
    ansible-playbook site.yml --vault-id dev@dev_pass.txt --vault-id prod@prompt

    Mix vault IDs: file for dev, interactive prompt for prod; lets you stage secrets per env

    vault · secrets · security

  • Edit vault in place
    EDITOR=vim ansible-vault edit group_vars/prod/secrets.yml --vault-password-file ~/.vault_pass

    Decrypt, edit in $EDITOR, re-encrypt atomically — never writes plaintext to disk

    vault · secrets · security

  • Dynamic inventory graph
    ansible-inventory -i aws_ec2.yml --graph --vars

    Render dynamic cloud inventory tree with host vars; verify plugin grouping before a run

    cloud · troubleshooting · network

  • Inventory as YAML
    ansible-inventory -i aws_ec2.yml --list --yaml > resolved_inventory.yml

    Materialize a dynamic inventory to static YAML for diffing or offline debugging

    cloud · troubleshooting

  • Constructed keyed_groups
    plugin: constructed keyed_groups: - key: tags.Role prefix: role - key: placement.region prefix: region

    Auto-build host groups from facts/tags via constructed plugin; e.g. role_web, region_eu

    cloud · gitops

  • Molecule scaffold role
    molecule init role my_role --driver-name docker && cd my_role && MOLECULE_DISTRO=ubuntu2204 molecule create

    Scaffold a role with a Molecule scenario; MOLECULE_DISTRO picks the test image

    ci · troubleshooting

  • Molecule converge then verify
    molecule converge && molecule verify

    Apply the role to the test instance, then run assertions (testinfra/ansible verifiers)

    ci · monitoring

  • Molecule idempotence check
    molecule idempotence

    Re-run the role and fail if any task reports changed — catches non-idempotent tasks

    ci · troubleshooting

  • Molecule login to instance
    molecule login --host instance

    SSH into a live Molecule test container to inspect state mid-scenario before destroy

    ci · debug · troubleshooting

  • Resume at a specific task
    ansible-playbook site.yml --start-at-task "Deploy app config"

    Skip everything before a named task; resume a failed long playbook without redoing setup

    debug · troubleshooting

  • List tasks and hosts dry
    ansible-playbook site.yml --list-tasks --list-hosts -i prod

    Preview execution plan: every task and resolved target host, without connecting

    debug · troubleshooting

  • Per-task timing profile
    ANSIBLE_CALLBACKS_ENABLED=profile_tasks ansible-playbook site.yml

    Rank tasks by wall-clock time to find the slow steps; profile_roles is the per-role variant

    performance · observability

  • Keep remote temp files
    ANSIBLE_KEEP_REMOTE_FILES=1 ansible-playbook site.yml -vvvv --limit <host>

    Preserve pushed module scripts under ~/.ansible/tmp to debug a failing module by hand

    debug · troubleshooting