ansible
Configuration management: roles, handlers, idempotence, and the discipline that makes it worth having.
-
Testing Infrastructure Code by Executing Its Real Expressions
A test that reimplements an Ansible expression's logic in Python proves two independent implementations agree today, not that the shipped expression is correct, and the two can drift apart while both keep passing. This article renders the actual expression through Ansible's own Templar and filters, using a recursive dict merge as a concrete case where a hand-written paraphrase gets it wrong.
-
Infrastructure as Code with Ansible: Making a Host Reproducible from the Repository
Infrastructure as code only works if the repository is the single source of truth for a host's configuration, and that discipline is easy to state and easy to break under pressure. This walks through why partial coverage buys almost none of the benefit, why idempotence is the actual product rather than a nice property, and ends with a complete Ansible role, run against a throwaway container, that a reader can use to watch drift get corrected.
-
Docker Registry Credentials for Two Local Users on One Host
The Docker CLI reads credentials from the config file of whoever runs it, not from a single host-wide location, so a login task that only runs as root leaves any other user pulling private images unauthenticated and failing with a generic denied error. This shows how to provision registry credentials for every user who actually needs them, with a reproducible local registry to test against.
-
Deploying Docker Compose from Ansible Without Shelling Out
Wrapping docker compose up in an Ansible command task gets a stack deployed but throws away everything Ansible is for: real change detection, check mode, and a diff you can trust. Here is how to deploy the same stack through a module that actually understands compose state, with a full working example.
-
Ansible Role Idempotence: Why a changed=0 Run Is the Only Proof You Have
A role that reports changed on every run has stopped detecting drift, and nothing in Ansible's exit code tells you so. Here is how that happens module by module, and how to make the second run's changed=0 an automated check rather than something you eyeball.
-
Migrating the SSH Port Mid-Playbook Without Locking Ansible Out
Changing sshd's port during provisioning severs Ansible's own control connection unless the validation, restart, connection update and firewall change happen in the right order. Here is that order, and the two guards that make it safe to re-run.