Glossary

151 terms from Ansible and Server Automation, in plain words, each with the chapter that teaches it.

Search the glossary

#

--force-handlers: A flag that runs queued handlers even when a task has failed on that host.
--limit: A flag that narrows a command or playbook run to certain hosts, such as `--limit web1`.
--list-hosts / --list-tasks: Flags that print the hosts a play matches or every task in order, without running anything.
--start-at-task: A flag that skips every task before the named one and runs from there, useful after a failure partway through.
-e (--extra-vars): A command-line flag that sets a variable for one run. It has the highest precedence and beats every other place.
-i (inventory flag): A flag that picks a different inventory, such as `-i inventories/production`.
-K (--ask-become-pass): A flag that asks once for the sudo password, used together with `-b` on real servers.
-v / -vvv (verbosity): Flags that print more detail: `-v` shows each task's result and `-vvv` shows how Ansible connects.

A

Ad hoc command: A single module run straight from the terminal with the `ansible` command, without writing a playbook. It suits quick one-off jobs such as checking that web1 and web2 are up.
Agentless: Ansible needs no special program running on the servers it manages. It logs in over SSH and uses the Python already on the server.
all: A built-in inventory group that contains every host. Variables set under `all` apply to web1 and web2 alike.
Ansible Galaxy: A free public site where people share roles and collections. The `ansible-galaxy` command installs them and can create an empty role skeleton.
Ansible Vault: Ansible's tool for encrypting files that hold secrets, such as Alex's staff password, using the AES256 cipher. The encrypted file can be committed to Git, and Ansible decrypts it in memory during a run.
ansible-core: The Ansible engine plus the built-in modules (`ansible.builtin`). The full `ansible` package adds many extra collections on top of it.
ansible-doc: A command that shows a module's built-in documentation in your terminal. `-s` prints only its settings and `-l` lists every module.
ansible-inventory: A command that shows what Ansible read from your inventory. `--graph` draws the groups and hosts, `--list` prints everything as JSON, and `--host NAME` shows one host's variables.
ansible-lint: A tool that checks playbooks and roles against rules of good practice without running them. It reports rule names such as `fqcn` or `risky-file-permissions`.
ansible-playbook: The command that runs a playbook, for example `ansible-playbook site.yml`. It runs each task on every host in turn and prints a PLAY RECAP.
ansible-pull: A mode in which each server fetches a playbook from a repository and applies it to itself, instead of being configured by a control node that pushes changes over SSH.
ansible.cfg: Ansible's settings file, read from the folder where you run commands. It can name the default inventory, the Python setting (`interpreter_python = auto_silent` finds Python on each server without a warning) and the vault password file.
ansible_become: An inventory variable that makes every task run as root through sudo. It is the file version of the `-b` flag.
ansible_facts: The map that holds the facts gathered about each host. You read it with square brackets, such as `ansible_facts['hostname']`.
ansible_managed: A template variable that prints "Ansible managed". It goes in a comment at the top of a generated file so nobody edits the file by hand.
API (Application Programming Interface): The address and rules that programs use to talk to a service. Terraform uses a cloud provider's API to create servers.
apt: The module that installs or removes packages on Ubuntu. `state: present` means installed, and `update_cache` refreshes the package list first.
assert: A module that fails the host when a condition under `that:` is false. verify.yml uses it to confirm the home page exists.
auth_basic: nginx settings that put a password prompt on a URL area. `auth_basic_user_file` names the htpasswd file that holds the users and hashes.
authorized_key: A module that adds a public SSH key to a user's `authorized_keys`, once. It comes from the `ansible.posix` collection.
AWX / Red Hat Ansible Automation Platform: A web interface for running Ansible playbooks as a team, with logs and permissions.

B

base role: A role that installs nginx and ufw, opens the firewall ports for SSH and web traffic, and keeps nginx running. It prepares every web server before the web role configures the site.
Become: Running tasks as another user, usually root, through sudo. The `-b` flag or `become: true` turns it on, and `-K` supplies the sudo password.
block and rescue: Playbook keywords that group tasks together (`block`) and run clean-up tasks (`rescue`) if one of the grouped tasks fails.

C

cache_valid_time: An apt setting that skips refreshing the package list if it was refreshed within that many seconds. 3600 means one hour.
certbot: A tool that gets free HTTPS certificates for a website. In Ansible it can be run from a `command` task guarded by `creates:`, so it runs only once.
changed: Result labels in a run. `ok` means the host was already right, `changed` means Ansible changed something, and `skipping` means a `when` condition stopped the task.
changed_when: Keywords that let you decide when a task counts as changed or failed, for example `changed_when: false` on a read-only command. Conditions can use `in`, true when the text on the left appears in the text on the right.
Check mode: A dry run (`--check`) in which each module reports what it would change without changing anything.
check_mode: false: A task setting that makes a read-only task run even under `--check`, so later tasks that need its result still work.
CI (continuous integration): A service that automatically runs checks, such as lint and tests, every time you push to Git.
Collection: A bundle of modules and roles shared under one name, such as `community.general` or `ansible.builtin`.
command: The default module, which runs one program directly without a shell, so `|`, `>` and `*` don't work. Ansible always reports it as `changed` unless you say otherwise.
community.general: A large collection of extra modules, including the ufw firewall module. It comes with the full `ansible` package but not with `ansible-core`.
Configuration: What goes on a server once it exists: packages, users, files and services. Ansible does this job.
Configuration drift: Servers slowly becoming different from each other because of manual fixes, like web1 and web2 if set up by hand.
Configuration management: Writing down how servers should be set up in files and letting a tool make each server match, the same way every time.
Connection variables: Variables with special names that tell Ansible how to reach a host: `ansible_host` (address), `ansible_user` (login user), `ansible_port` (SSH port, default 22), `ansible_connection` (`ssh` or `local`) and `ansible_ssh_private_key_file` (which private key).
Control node: The computer you run Ansible on, usually your laptop.
copy: A module that puts a file on the server, either from `src` or from text given in `content`.
creates / removes: Settings on the command module. `creates` skips the command if a file exists, and `removes` skips it if the file is missing, making commands run once or only when needed.
cron: A module that writes a scheduled job (crontab line), such as the nightly shop backup. Naming the job means a rerun updates it instead of adding a duplicate.

D

debug: A module that prints a message (`msg`) or a variable's value (`var`) and changes nothing.
default (filter): A Jinja2 filter that supplies a fallback when a variable isn't set. `default(omit)` leaves the setting out of the task entirely.
delegate_to: A task keyword that runs the task on a different machine than the one being configured, for example to take a server out of a load balancer.
Desired state: What should be true on a server, such as "nginx is installed". You describe it, and each module works out what to change.
Diff mode: A flag that prints the lines a task would change in a file, with `-` for removed lines and `+` for added ones.
Dynamic inventory: An inventory plugin that asks a cloud provider for the current list of servers on every run, so nobody copies addresses by hand.

E

encrypt_string: An `ansible-vault` command that encrypts a single value, producing a `!vault` variable you paste into a normal variables file.

F

Facts: Information Ansible gathers about each host, such as its operating system and memory, stored in `ansible_facts`.
file: A module that manages files and folders: `state: directory` makes a folder, `link` makes a symbolic link and `absent` deletes.
Filter: A function applied after `|` in Jinja2 that changes a value, such as `upper`, `default`, `format` or `to_nice_json`. Filters can be chained left to right.
flush_handlers: A `meta` task that runs any queued handlers immediately instead of waiting for the end of the play.
Forks: How many hosts Ansible works on at once. The default is 5 and `-f 10` makes it 10.
FQCN (fully qualified collection name): A module's full name, made of its collection and module name, such as `ansible.builtin.ping`. It is never ambiguous, so it is the safest way to name a module.

G

gather_facts: A play setting that, when set to false, skips the Gathering Facts step to save time.
Gathering Facts: The automatic first task of every play, which runs the `setup` module to collect facts about each host.
Git: A version-control tool that records every change to files. Keeping an Ansible project in Git lets changes be reviewed, attributed to a person and undone.
Group: A named set of hosts in an inventory, such as `web`, so you can act on every web server at once.
group_vars: A folder of variable files per group, kept next to the inventory's `hosts.yml`. Each inventory's group_vars hold what differs between lab and production.

H

Handler: A task that runs only when another task notifies it and reports `changed`, once at the end of the play. It is used to reload nginx only when its config changed.
Hash: A one-way scrambled form of a password that can be checked but not read back. The `password_hash` filter makes a SHA-512 hash for nginx.
HCL (HashiCorp Configuration Language): Terraform's own configuration language, used to describe the servers you want.
Host: One machine in the inventory, such as web1.
host_vars: A folder of variable files for a single host, next to the inventory.
htpasswd: A password file for nginx with one `name:hash` line per user. The staff page checks logins against it.
HTTP status codes: Numbers a web server returns with each answer: 200 OK (page served), 401 Unauthorized (login required) and 404 Not Found (no such page).
HTTPS: The encrypted version of the web protocol. Port 80 carries ordinary web (HTTP) traffic.

I

Idempotent: Safe to run again: a second run changes nothing if nothing needs changing. A good playbook shows `ok` for every task on its second run.
Immutable server: A server that is never changed after it starts. To update it you build a new one and delete the old one.
import_role / include_role: Keywords that load a role or a tasks file in the middle of a play's tasks, instead of listing the role under `roles:`.
Infrastructure as code: Describing servers and their setup in files kept in Git, so changes can be reviewed, attributed and undone.
INI: The older inventory format that looks like a settings file, with `[group]` headings and one host per line. Ansible also accepts inventories written in YAML.
Inventory: The list of hosts and groups Ansible manages, along with their variables. A project can keep several, such as a lab inventory for practice and a production inventory for the real servers.
inventory_hostname: A built-in variable holding the host's name as written in the inventory, such as `web1`.

J

Jinja2: The template language Ansible uses for `{{ }}` expressions and `{% %}` statements.
JSON (JavaScript Object Notation): A text format for data that web pages and programs read. The shop's product list is written as JSON.

L

lineinfile: A module that makes sure one line is in a file, adding it only if missing. It is idempotent, unlike appending with shell.
Lint: Checking code for mistakes and bad practice without running it.
List: In YAML, items in order, each on a line starting with `- `. A list of maps is the shape you use most.
location block: An nginx setting that applies rules to URLs beginning with a given path, such as `/staff/`.
lookup: A function that reads data on the control node. `lookup('env', 'HOME')` returns your home folder path.
Loop: Repeating a task once for each item in a list, with the current item in `item`.

M

manage_system: A project variable that says whether tasks may change the system itself (packages, services, firewall). In the Kettle & Crane project it is false in the lab and true in production.
Managed node: A server that Ansible configures, such as web1 or web2.
Map: In YAML, a set of `key: value` pairs.
mode: A setting on file, copy and template tasks that sets a file's permissions, like `chmod`. Quote it, such as `"0644"`, or YAML reads a number.
Module: A small program that does one job, such as installing a package or writing a file. Ansible copies it to the server, runs it and deletes it.
Molecule: A tool that tests a role on throwaway containers it creates and deletes.
Multipass: A free tool for running Ubuntu virtual machines on your laptop, usable as a real server for the SSH sections.
Mutable server: A server that is kept for a long time and changed in place with updates, rather than being replaced by a new one.

N

nginx: The web server software that serves the Kettle & Crane shop. It must be reloaded to read changed config files.
no_log: A task setting that hides the task's result from the output and logs. Use it on every task that handles a secret.
noqa: A comment at the end of a line that tells ansible-lint to skip one named rule on purpose.
Notify: A task's request to run a named handler if the task reported `changed`. The name must match the handler's `name` exactly.

P

Pattern: The expression that says which hosts a command or play runs on, such as `web`, `web1:web2` or `web:!web2`.
ping: A module that logs in to each host and checks that Python works. It tests the whole login, unlike the network `ping` command.
pip: Python's package installer, used to install Ansible.
Play: A part of a playbook with a name, the hosts it runs on and a list of tasks.
PLAY RECAP: The summary at the end of a run, counting ok, changed, unreachable, failed, skipped, rescued and ignored per host.
Playbook: A YAML file listing plays, so the steps for a server are written down and can be rerun at any time.
Precedence: The order that decides which value wins when a variable is set in several places. Role defaults are weakest and `-e` is strongest.
Profile: A set of ansible-lint rules, from `min` to `production`, the strictest.
Provisioning: Creating the things a server needs: the machine, its network, disk and DNS records. Terraform does this job.

R

rc (return code): A command's exit status. 0 means success and anything else means a problem.
Register: A keyword that saves a task's result in a variable, such as `up.rc` for the exit status or `up.stdout` for the printed text.
requirements.yml: A file listing the collections a project needs. `ansible-galaxy collection install -r requirements.yml` downloads them.
Role: A folder with a fixed layout (tasks, handlers, templates, defaults and more) that Ansible knows, so a play only has to say "use the web role".
Role defaults: A role's `defaults/main.yml`, holding variables with the lowest precedence so anything else can override them.
root (variable): A project variable holding the folder each pretend lab server lives in. It is empty in production, so paths there are real system paths.

S

Salt: Extra text mixed into a password before hashing, so the same password does not always give the same hash. A random salt gives a different hash every run, so a fixed one keeps an Ansible task idempotent.
serial: A play setting that runs the play on that many hosts at a time, so `serial: 1` updates one server at a time and the shop stays up.
setup: The module that collects facts about a host. It runs automatically as Gathering Facts, and `filter` picks facts by name.
shell: A module that runs a command line through a shell, so pipes, `>` and `*` work. Prefer `command` when you can.
site.yml: The main playbook of a project, which applies its roles (here base and web) to the servers. It is the playbook you normally run.
SSH (Secure Shell): The protocol Ansible uses to log in to managed nodes, the same way you would by hand.
stat: A module that reports facts about a file, such as whether it exists. Save the report with `register`.
state: A module setting that names the condition you want, such as `present` or `absent` (apt), `directory`, `link` or `absent` (file), and `started`, `reloaded` or `enabled` (services).
State file: Terraform's record of everything it created, which is how it knows web2 already exists.
Statement: A Jinja2 instruction in `{% %}`, such as `for` or `if`, that controls the template rather than printing a value.
stdout: The part of a registered result that holds what a command printed. `stdout_lines` is the same output split into a list of lines.
sudo: A Linux command that runs another command as root. Ansible's become feature uses it.
Syntax check: A flag that reads a playbook for errors without connecting to any server or running it. It doesn't fill in variables, so misspelt variable names still pass.
systemd_service: A module that controls a systemd service: start, stop, restart, reload, and enable at boot.

T

Tags: Labels on tasks that let you run only some of them by passing `--tags` on the command line.
Task: One step in a play: a name and one module with its arguments, such as "make sure nginx is installed".
Template: A file with blanks that Ansible fills in for each host. Template files end in `.j2` by custom.
template (module): A module that fills in a template file with each host's variables and writes the result, only if it differs from what's there.
Terraform: A tool that creates servers, networks and DNS records through a cloud provider's API and records them in a state file. It provisions, while Ansible configures.
to_nice_json: A filter that turns a list or map into neatly indented JSON, used to build the shop's product list.

U

ufw: Ubuntu's firewall. The `community.general.ufw` module adds allow rules and switches the firewall on, and port 22 must be opened first so SSH isn't blocked.
ungrouped: The built-in group of hosts that belong to no other group.
UNREACHABLE: A result meaning Ansible could not log in to a host, often because of the wrong SSH user or key. The PLAY RECAP counts these per host.
uri: A module that requests a web address like a browser and fails unless the expected status code comes back. verify.yml uses it to check the site answers.
user: A module that manages user accounts, such as making a system user or the admin account `priya`.

V

Variable: A name for a value that can differ per host, group or run, and is used with `{{ }}`.
Variable prefixes (web_, vault_): A naming habit: a role's variables start with its name (`web_products`) and encrypted secrets start with `vault_`, so you can tell at a glance where a value comes from.
Vault password file: A file outside the project that holds the vault password, named in `ansible.cfg` so you needn't type it each run.
Verify playbook: A playbook that changes nothing and checks that the servers ended up right, using stat, assert and uri.
Virtual environment (venv): A private folder with its own Python and packages, so installing Ansible doesn't touch the system's Python. You activate it in each new terminal.

W

When: A condition on a task or role; it runs only if the condition is true. You write it without `{{ }}`.
WSL (Windows Subsystem for Linux): A Windows feature that provides a Linux terminal. Ansible doesn't run on Windows itself, so Windows users run it inside WSL.

Y

YAML: The plain-text data format Ansible's files are written in, using indentation, `key: value` maps and `- ` list items.