Variables, facts and registered results

Why variables?

Hard-coding "httpd" or "10.0.5.20" in tasks works for one case. Variables let the same playbook install nginx in one environment and httpd in another, or point test servers at the test database. Variables are referenced with Jinja2 syntax: {{ variable_name }}. Names use letters, numbers and underscores, and start with a letter.

Where to define them

- name: Web servers
  hosts: webservers
  vars:
    web_package: httpd
    web_port: 8080
  vars_files:
    - vars/common.yml
  tasks:
    - name: Install the web server
      ansible.builtin.dnf:
        name: "{{ web_package }}"
        state: present

project/
├── ansible.cfg
├── inventory
├── site.yml
├── group_vars/
│   ├── all.yml           # every host
│   └── webservers.yml    # hosts in the webservers group
└── host_vars/
    └── web01.example.com.yml   # one host

Who wins? Precedence, simplified

If the same variable is set in several places, Ansible uses the one with the highest precedence. The full list has over twenty levels; this simplified order (lowest to highest) covers daily work:

1. Role defaults (roles/x/defaults/main.yml): meant to be overridden.
2. group_vars/all
3. group_vars/<group>
4. host_vars/<host>
5. Facts gathered from the host
6. Play vars, vars_files
7. Role vars (roles/x/vars/main.yml), task vars
8. Extra vars on the command line (-e "web_port=9090"): ALWAYS win.

Rule of thumb: put sensible defaults low (role defaults, group_vars/all), put differences per group or host, and use -e only for one-off overrides.

Facts: what Ansible knows about each host

$ ansible web01.example.com -m ansible.builtin.setup -a "filter=ansible_distribution*"
web01.example.com | SUCCESS => {
    "ansible_facts": {
        "ansible_distribution": "RedHat",
        "ansible_distribution_file_variety": "RedHat",
        "ansible_distribution_major_version": "9",
        "ansible_distribution_version": "9.4"
    },
    "changed": false
}

- name: Show some facts
  ansible.builtin.debug:
    msg: >-
      {{ ansible_facts['hostname'] }} runs {{ ansible_facts['distribution'] }}
      {{ ansible_facts['distribution_version'] }} with
      {{ ansible_facts['memtotal_mb'] }} MB RAM at
      {{ ansible_facts['default_ipv4']['address'] }}

Magic variables are always available: inventory_hostname (the host's name in the inventory), groups (all groups and their hosts), hostvars (every host's variables and facts, so one host can read another's IP), group_names (the groups this host is in).

register: keep a task's result

- name: Check if the app config exists
  ansible.builtin.stat:
    path: /etc/notes/app.conf
  register: conf

- name: Report
  ansible.builtin.debug:
    msg: "Config present: {{ conf.stat.exists }}"

- name: Get the kernel version
  ansible.builtin.command: uname -r
  register: kernel
  changed_when: false        # reading is not a change

- name: Print it
  ansible.builtin.debug:
    var: kernel.stdout

Common mistakes

• Variable names with dashes (web-port): not allowed. Use underscores.
• Expecting a group_vars file to load when it is in the wrong folder or named differently from the group.
• Comparing a version fact to a number: ansible_facts['distribution_major_version'] == 9 is false, because the fact is the string "9". Compare with "9", or use | int.
• Turning off gather_facts and then using facts in the play.