Inventory and ansible.cfg

The inventory

Ansible needs to know which machines exist and how to group them. Groups let you say "install httpd on webservers" instead of naming each host. A host can be in many groups. Two groups always exist: all (every host) and ungrouped (hosts in no other group).

# inventory (INI format)
bastion.example.com

[webservers]
web[01:03].example.com

[dbservers]
db01.example.com ansible_host=10.0.5.20

[datacenter_mumbai:children]
webservers
dbservers

# inventory.yml (the same in YAML)
all:
  hosts:
    bastion.example.com:
  children:
    webservers:
      hosts:
        web[01:03].example.com:
    dbservers:
      hosts:
        db01.example.com:
          ansible_host: 10.0.5.20
    datacenter_mumbai:
      children:
        webservers:
        dbservers:

$ ansible-inventory -i inventory --graph
@all:
  |--@ungrouped:
  |  |--bastion.example.com
  |--@datacenter_mumbai:
  |  |--@webservers:
  |  |  |--web01.example.com
  |  |  |--web02.example.com
  |  |  |--web03.example.com
  |  |--@dbservers:
  |  |  |--db01.example.com
$ ansible webservers -i inventory --list-hosts
  hosts (3):
    web01.example.com
    web02.example.com
    web03.example.com

ansible.cfg: your project settings

Ansible reads settings from ansible.cfg. It uses ONLY the first file it finds, in this order: the file named in the ANSIBLE_CONFIG environment variable, ansible.cfg in the current directory, ~/.ansible.cfg, then /etc/ansible/ansible.cfg. Most teams keep an ansible.cfg in each project directory and run Ansible from there. ansible --version shows which file is in use.

# ~/project/ansible.cfg
[defaults]
inventory = ./inventory
remote_user = devops
host_key_checking = False

[privilege_escalation]
become = True
become_method = sudo
become_user = root
become_ask_pass = False

Preparing the managed nodes

Ansible logs in over SSH as remote_user. The usual setup: create a dedicated user (for example devops) on every managed node, install the control node's SSH public key for it, and give it passwordless sudo with a sudoers drop-in. You will often do this once by hand or with a first playbook that uses a password.

# on each managed node, as root:
useradd devops
echo 'devops ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/devops
chmod 440 /etc/sudoers.d/devops
# on the control node, as your user:
ssh-copy-id devops@web01.example.com
ansible all -m ansible.builtin.ping

Common mistakes

• Running Ansible from a different directory, so a different ansible.cfg (or none) is used and the inventory is "empty". Check ansible --version.
• Indentation errors in YAML inventories. Use ansible-inventory --graph to see what Ansible understood.
• Writing group names with dashes (web-servers). Ansible warns; use underscores.
• Forgetting that :children lists GROUPS, not hosts.