Ansible — Simple & Powerful IT Automation Platform

What Ansible Does

• Configuration Management: Define desired system state in YAML, apply consistently across machines
• Application Deployment: Deploy applications across multiple servers with zero downtime
• Orchestration: Coordinate complex multi-tier deployments across environments
• Provisioning: Provision cloud resources (AWS, Azure, GCP) and virtual machines
• Security & Compliance: Enforce security policies and compliance standards
• Network Automation: Configure routers, switches, and firewalls from 30+ vendors
• Continuous Delivery: Integrate with CI/CD pipelines for automated deployment

Architecture

┌──────────────┐
│ Control Node │  (Where Ansible is installed)
│  (Your       │
│   Laptop)    │
└──────┬───────┘
       │ SSH
       │
   ┌───┴────────────────────┐
   │                        │
┌──┴───┐  ┌────┐  ┌────┐  ┌┴───┐
│ Web1 │  │Web2│  │DB1 │  │DB2 │  ← No Ansible agent needed
│      │  │    │  │    │  │    │
└──────┘  └────┘  └────┘  └────┘
   Managed Nodes (any SSH-accessible machine)

Agentless design: Only Python needs to be installed on managed nodes (and most Linux systems have it by default).

Core Concepts

Inventory

# inventory.ini
[webservers]
web1.example.com
web2.example.com ansible_user=deploy

[dbservers]
db1.example.com
db2.example.com

[production:children]
webservers
dbservers

[webservers:vars]
nginx_port=80
app_env=production

Or YAML format:

# inventory.yml
all:
  children:
    webservers:
      hosts:
        web1.example.com:
        web2.example.com:
          ansible_user: deploy
      vars:
        nginx_port: 80
    dbservers:
      hosts:
        db1.example.com:
        db2.example.com:

Playbooks

# deploy-web.yml
---
- name: Deploy web application
  hosts: webservers
  become: true

  vars:
    app_version: "2.1.0"
    app_dir: /var/www/myapp

  tasks:
    - name: Install nginx
      apt:
        name: nginx
        state: present
        update_cache: true

    - name: Clone repository
      git:
        repo: https://github.com/myorg/myapp.git
        dest: "{{ app_dir }}"
        version: "v{{ app_version }}"

    - name: Install dependencies
      npm:
        path: "{{ app_dir }}"
        state: present

    - name: Copy nginx config
      template:
        src: nginx.conf.j2
        dest: /etc/nginx/sites-available/myapp
      notify: Restart nginx

    - name: Enable site
      file:
        src: /etc/nginx/sites-available/myapp
        dest: /etc/nginx/sites-enabled/myapp
        state: link

  handlers:
    - name: Restart nginx
      service:
        name: nginx
        state: restarted

Roles (Reusable Components)

roles/
└── webserver/
    ├── tasks/main.yml
    ├── handlers/main.yml
    ├── templates/nginx.conf.j2
    ├── files/
    ├── vars/main.yml
    ├── defaults/main.yml
    └── meta/main.yml

# Using roles in a playbook
- hosts: webservers
  roles:
    - common
    - { role: webserver, nginx_port: 8080 }
    - { role: appserver, app_version: "2.0.0" }

Common Modules

# File operations
- file:
    path: /etc/myapp
    state: directory
    mode: '0755'

# Package management
- apt:          # Debian/Ubuntu
    name: nginx
    state: present

- yum:          # RHEL/CentOS
    name: httpd
    state: latest

# Service management
- service:
    name: postgresql
    state: started
    enabled: true

# Users and groups
- user:
    name: deploy
    groups: sudo
    shell: /bin/bash

# Templates
- template:
    src: config.j2
    dest: /etc/myapp/config.ini

# Command execution
- shell: |
    cd /app
    npm run build

# Cloud modules
- amazon.aws.ec2_instance:
    name: "web-{{ item }}"
    instance_type: t3.micro
    image_id: ami-12345
  loop: [1, 2, 3]

Ad-Hoc Commands

# Ping all servers
ansible all -m ping

# Check disk space
ansible all -m shell -a "df -h"

# Restart service
ansible webservers -m service -a "name=nginx state=restarted" --become

# Copy file
ansible all -m copy -a "src=/local/file dest=/remote/file"

# Install package
ansible all -m apt -a "name=htop state=present" --become

Ansible vs Alternatives

常见问题

Q: Ansible 需要在被管理机器上安装 agent 吗？ A: 不需要。只需要 Python（大多数 Linux 系统默认已安装）和 SSH 访问权限。Windows 系统需要配置 WinRM。

Q: 适合多大规模的基础设施？ A: 从个人服务器到数千台机器都适用。对于大规模部署，可以使用 Ansible Tower/AWX（Web UI + 任务调度）或 Ansible Pull 模式。

Q: 和 Terraform 有什么区别？ A: Terraform 主要用于基础设施供应（创建云资源），Ansible 主要用于配置管理（在机器上安装软件和配置）。两者经常配合使用：Terraform 创建服务器，Ansible 配置服务器。

来源与致谢

• GitHub: ansible/ansible — 68.4K+ ⭐ | GPL-3.0
• 官网: ansible.com