Ansible
The agentless configuration management tool. YAML playbooks over SSH. The default in this category today.
Mindmap
The plain-English version
Ansible (Red Hat) is a configuration management tool. You write a YAML playbook — "on these hosts, install nginx, copy this config, restart the service" — and Ansible connects via SSH and makes it so. No agent on the target. Used heavily for VM-based infrastructure, hybrid environments, and anything that pre-dates containers.
The problem it solves
Containers + Kubernetes have replaced a lot of what configuration management used to do. But not all of it. Anywhere you have VMs, network gear, or one-off bare-metal boxes, Ansible (or Chef, or Puppet) is still the way you make them identical. The agentless model gave Ansible an edge over Chef and Puppet for new adoption.
Alternatives
| Alternative | Type | When it wins |
|---|---|---|
| Terraform | IaC | The de facto IaC tool. Multi-cloud. HCL config language. Plan, apply, state — the discipline of declarative infrastructure. |
Deep links
The words you'll hear
- Playbook
- YAML file with plays and tasks.
- Play
- A set of tasks targeted at a group of hosts.
- Task
- One unit of work — install a package, copy a file, restart a service.
- Inventory
- List of hosts, often grouped (webservers, databases).
- Role
- Reusable bundle of tasks/handlers/files.
- Handler
- Task triggered by other tasks (e.g., 'reload nginx' when config changes).
- Idempotent
- Running the same playbook twice has the same effect as once. The point of CM.
Bad vs. good prompt for Ansible
Why it works: Specifies the OS, the host group, exact tasks, the handler pattern, and the (sensitive) secrets path. Realistic enough to actually use; small enough to review.
What bites real teams
Ansible variable precedence has many sources (inventory, group_vars, host_vars, task vars, extra vars). Read the precedence docs once.
Terraform creates the box; Ansible configures it. The handoff (when does Ansible run?) needs to be explicit.
A 10-minute playbook to change one config is overkill. Tag tasks; run only what changed.