Ansible · Cheat sheet

Ansible cheat sheet

The complete Ansible reference, beginner to advanced: inventory and connectivity, ad-hoc modules, running and controlling playbooks, variables and facts, Vault, roles and Galaxy, templating, and debugging — with example output.

Inventory & connectivityBeginner

ansible --version

Core version and config file in use.

ansible all -m ping -i hosts

Check SSH + Python on every host.

web1 | SUCCESS => {
  "changed": false,
  "ping": "pong"
}

ansible-inventory -i hosts --list

Dump the parsed inventory as JSON.

ansible-inventory --graph

Tree view of groups and hosts.

@all:
  |--@web:
  |  |--web1
  |  |--web2
  |--@db:
  |  |--db1

ansible web -m ping --limit web1

Target one host in a group.

ansible all --list-hosts

Show which hosts a pattern matches.

Ad-hoc commandsBeginner

ansible all -a "uptime"

Run a shell command everywhere (command module).

ansible all -m shell -a "df -h | grep /$"

Use shell when you need pipes/redirects.

ansible all -m copy -a "src=a.conf dest=/etc/a.conf"

Push a file.

ansible all -m apt -a "name=nginx state=present" -b

Install a package as root (-b = become).

ansible all -m service -a "name=nginx state=restarted" -b

Restart a service.

ansible all -m setup

Gather and print all facts about a host.

ansible all -m setup -a "filter=ansible_mem*"

Show only matching facts.

Running playbooksBeginner

ansible-playbook site.yml

Run a playbook against its inventory.

PLAY RECAP ***
web1 : ok=7  changed=2  unreachable=0  failed=0

ansible-playbook site.yml --check

Dry run — report changes, make none.

ansible-playbook site.yml --diff

Show before/after for changed files.

ansible-playbook site.yml --check --diff

Safest preview: no changes + full diff.

ansible-playbook site.yml --syntax-check

Validate YAML/structure without running.

ansible-playbook site.yml --list-tasks

Show the tasks that would run.

Controlling a runIntermediate

ansible-playbook site.yml --limit web

Restrict the run to a host/group.

ansible-playbook site.yml --tags deploy

Run only tasks with these tags.

ansible-playbook site.yml --skip-tags slow

Run everything except these tags.

ansible-playbook site.yml --start-at-task="Copy config"

Resume from a named task.

ansible-playbook site.yml --step

Confirm each task interactively.

ansible-playbook site.yml -e "ver=1.4.0"

Pass extra variables (highest precedence).

ansible-playbook site.yml -f 20

Run on 20 hosts at once (forks).

ansible-playbook site.yml -b -K

Become root and prompt for the sudo password.

Variables & factsIntermediate

ansible-playbook s.yml -e @vars.yml

Load extra vars from a file.

group_vars/web.yml

Variables automatically applied to the web group.

host_vars/web1.yml

Variables scoped to a single host.

Use a gathered fact in a template/task.

gather_facts: false

Skip fact gathering to speed up a play.

Capture a task’s output into a variable.

when: result.rc != 0

Run a task conditionally on prior output.

Ansible VaultIntermediate

ansible-vault create secrets.yml

Create a new encrypted file.

ansible-vault edit secrets.yml

Decrypt to $EDITOR, re-encrypt on save.

ansible-vault view secrets.yml

Print decrypted contents without editing.

ansible-vault encrypt vars.yml

Encrypt an existing plaintext file.

ansible-vault rekey secrets.yml

Change the vault password.

ansible-vault encrypt_string "s3cr3t" --name db_pass

Encrypt one value to paste inline.

ansible-playbook s.yml --ask-vault-pass

Prompt for the vault password at run time.

ansible-playbook s.yml --vault-password-file .vpass

Read the password from a file (CI).

Roles & GalaxyIntermediate

ansible-galaxy init myrole

Scaffold a role (tasks/, handlers/, templates/…).

- Role myrole was created successfully

ansible-galaxy install geerlingguy.nginx

Install a role from Galaxy.

ansible-galaxy install -r requirements.yml

Install all pinned roles/collections.

ansible-galaxy collection install community.docker

Install a collection.

ansible-galaxy role list

List installed roles and versions.

Templating & handlersAdvanced

Jinja2 filter — fall back when unset.

Filters: length, upper, join, to_json, b64encode…

{% for h in groups["web"] %}...{% endfor %}

Loop in a template (e.g. build a config).

notify: Restart nginx

Trigger a handler when a task changes something.

loop: "{{ users }}"

Iterate a task over a list.

block: / rescue: / always:

Group tasks with error handling (try/catch/finally).

delegate_to: localhost

Run a task on a different host than the target.

Debug & performanceAdvanced

ansible-playbook s.yml -vvv

Verbose (add v’s up to -vvvv for connection debug).

- debug: var=result

Print a variable mid-play.

- debug: msg="ip is {{ ip }}"

Print a formatted message.

ANSIBLE_STRATEGY=free ansible-playbook s.yml

Let hosts run ahead independently.

ansible-lint site.yml

Lint for anti-patterns and deprecations.

ANSIBLE_STDOUT_CALLBACK=yaml ...

Prettier, multi-line task output.

Go deeper

Full, hands-on DevSecOps courses

Browse courses