Ansible at Scale

# inventory/aws_ec2.yml — AWS EC2 dynamic inventory plugin
plugin: amazon.aws.aws_ec2
regions:
  - us-east-1
  - eu-west-1

# Filter to only running instances
filters:
  instance-state-name: running

# Group hosts by their EC2 tags automatically
keyed_groups:
  - key: tags.Role          # group by Role tag: webserver, database, cache
    prefix: role_
  - key: tags.Environment   # group by Environment tag: production, staging
    prefix: env_
  - key: placement.region   # group by AWS region
    prefix: region_

# Set the connection address (private IP for internal access)
hostnames:
  - private-ip-address

# Compose variables from EC2 metadata
compose:
  ansible_host: private_ip_address
  ec2_instance_type: instance_type

# List the dynamic inventory to verify groups and hosts
ansible-inventory -i inventory/aws_ec2.yml --list
ansible-inventory -i inventory/aws_ec2.yml --graph

# Run against a tag-based group — no hosts.ini needed
ansible-playbook site.yml -i inventory/aws_ec2.yml

# Target all production web servers (Role=webserver AND Environment=production)
ansible-playbook deploy.yml -i inventory/aws_ec2.yml \
  --limit "role_webserver:&env_production"

# Trigger an AWX job template via REST API (from a CI/CD pipeline)
curl -X POST \
  https://awx.example.com/api/v2/job_templates/42/launch/ \
  -H "Authorization: Bearer ${AWX_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "extra_vars": {
      "app_version": "2.4.1",
      "environment": "production"
    }
  }'

# Install AWX on Kubernetes (official method)
# See: https://github.com/ansible/awx-operator

# Install ansible-pull on each managed host
pip install ansible --break-system-packages

# Manual pull — clone repo and run local.yml against localhost
ansible-pull \
  -U https://github.com/myorg/ansible-config.git \
  -C main \
  local.yml                  # the playbook to apply (targets localhost)

# Run with vault password from a file
ansible-pull \
  -U https://github.com/myorg/ansible-config.git \
  --vault-password-file /etc/ansible/.vault_pass \
  local.yml

# roles/ansible_pull/tasks/main.yml
# Deploy this role ONCE via push mode to bootstrap pull mode on each host
---
- name: Install Ansible on the managed host
  ansible.builtin.package:
    name: ansible
    state: present

- name: Install Git for ansible-pull
  ansible.builtin.package:
    name: git
    state: present

- name: Create vault password file
  ansible.builtin.copy:
    content: "{{ vault_ansible_pull_password }}"
    dest: /etc/ansible/.vault_pass
    owner: root
    mode: "0600"
  no_log: true

- name: Schedule ansible-pull via cron (every 30 minutes)
  ansible.builtin.cron:
    name: ansible-pull configuration management
    minute: "*/30"
    job: >
      ansible-pull
      -U https://github.com/myorg/ansible-config.git
      -C main
      --vault-password-file /etc/ansible/.vault_pass
      local.yml
      >> /var/log/ansible-pull.log 2>&1
    user: root
    state: present

# local.yml — applied by ansible-pull on each host to itself
---
- name: Apply configuration to this host
  hosts: localhost
  connection: local
  become: true

  vars_files:
    - vars/common.yml
    - vars/secrets.yml           # vault-encrypted

  roles:
    - role: common               # base packages, timezone, NTP
    - role: hardening            # SSH, firewall, sysctl
    - role: monitoring_agent     # Prometheus node exporter

    # Conditional roles — applied based on host facts or variables
    - role: nginx
      when: "'webserver' in ansible_hostname"
    - role: postgresql
      when: "'db' in ansible_hostname"

- name: Rolling deployment with load balancer management
  hosts: webservers
  serial: 1

  tasks:
    # This task runs on the load balancer host, not on the web server being updated
    - name: Remove this web server from load balancer
      community.general.haproxy:
        state: disabled
        host: "{{ inventory_hostname }}"    # still the current web server's name
        socket: /var/run/haproxy/admin.sock
      delegate_to: loadbalancer.example.com  # but runs on the LB host

    - name: Deploy new application release
      ansible.builtin.unarchive:
        src: "releases/{{ app_version }}.tar.gz"
        dest: "{{ deploy_dir }}/releases/{{ app_version }}"

    - name: Update current symlink
      ansible.builtin.file:
        src: "{{ deploy_dir }}/releases/{{ app_version }}"
        dest: "{{ deploy_dir }}/current"
        state: link

    - name: Restart application service
      ansible.builtin.service:
        name: myapp
        state: restarted

    - name: Health check — verify before re-adding to LB
      ansible.builtin.uri:
        url: "http://{{ ansible_default_ipv4.address }}:{{ app_port }}/health"
        status_code: 200
      retries: 5
      delay: 6
      until: health.status == 200
      register: health

    # Run on the LB again — re-add only after health check passes
    - name: Re-add web server to load balancer
      community.general.haproxy:
        state: enabled
        host: "{{ inventory_hostname }}"
        socket: /var/run/haproxy/admin.sock
      delegate_to: loadbalancer.example.com

    # Run on the control node (localhost) — update external monitoring
    - name: Record deployment in monitoring system
      ansible.builtin.uri:
        url: "https://monitoring.example.com/api/deployments"
        method: POST
        body_format: json
        body:
          host: "{{ inventory_hostname }}"
          version: "{{ app_version }}"
          timestamp: "{{ ansible_date_time.iso8601 }}"
      delegate_to: localhost
      run_once: false

---
- name: Production rolling update — 200 web servers
  hosts: webservers
  become: true
  serial: "10%"             # update 20 servers at a time (10% of 200)
  max_fail_percentage: 5    # abort if more than 5% of hosts fail in any batch

  tasks:
    - name: Run database migration (once per batch, not once per host)
      ansible.builtin.command:
        cmd: python manage.py migrate --no-input
        chdir: "{{ deploy_dir }}/current"
      run_once: true          # runs once on the first host in the batch
      delegate_to: "{{ groups['databases'][0] }}"  # actually runs on the DB server

    - name: Pull new Docker image
      community.docker.docker_image:
        name: "registry.example.com/myapp:{{ app_version }}"
        source: pull
      throttle: 5            # only 5 hosts pull simultaneously — protects registry

    - name: Update application container
      community.docker.docker_container:
        name: myapp
        image: "registry.example.com/myapp:{{ app_version }}"
        state: started

    - name: Send deployment notification (once for the whole fleet)
      ansible.builtin.uri:
        url: "https://hooks.slack.com/services/{{ vault_slack_webhook }}"
        method: POST
        body_format: json
        body:
          text: "Deployed {{ app_version }} to {{ ansible_play_hosts | length }} web servers"
      run_once: true
      delegate_to: localhost