glossary

terms (59)

AAP Ansible Automation Platform
Red Hat’s supported, subscription-based enterprise Ansible platform — what Tower evolved into. 39 · AWX, AAP & the retired Tower name
ad-hoc command
A one-line ansible CLI run — one module against some hosts, immediately, with no playbook. 7 · Your first ad-hoc command
agentless
No resident Ansible agent or daemon on targets; the control node pushes everything per run. 2 · Agentless, push-based
ansible-core
The minimal package: the Ansible engine, CLI tools and the ansible.builtin collection — nothing else. 3 · ansible-core vs the community package
ansible-navigator
The modern CLI/TUI that runs playbooks inside an execution environment by default; also has doc, collections, lint and exec subcommands. 40 · Execution environments & navigator
AWX
The free, open-source upstream of AAP — community-supported, deployed on Kubernetes via the AWX Operator. 39 · AWX, AAP & the retired Tower name
block
A playbook keyword that groups tasks so they share keywords and error handling, via attached rescue: and always: sections. 21 · Blocks & error handling
check mode
A dry run (--check): modules report what they would change without changing anything on the host. 29 · Run control: check, diff, tags, limit
collection
A versioned, installable package of modules, roles and plugins under one namespace. 4 · Collections & FQCN
community package
The pip package literally named "ansible": ansible-core plus a large curated bundle of collections. 3 · ansible-core vs the community package
control node
The one machine where Ansible is installed and every ansible-* command runs. 2 · Agentless, push-based
CredSSP Credential Security Support Provider
An authentication protocol that hands your actual credentials to the remote host so it can act as you elsewhere — maximum capability, and the official docs call it a security risk. 31 · The WinRM auth matrix
declarative
You describe the end state you want; the tool works out the steps to get there. 1 · What Ansible is & isn't
delegation
Running a task on a different host than the one the play is processing — delegate_to: lb01 executes it there, while variables still belong to the original host. 28 · Strategies, serial & delegation
double hop
A remote session on one machine cannot reach a second machine as you: a network logon carries proof of identity, not reusable credentials. 35 · The double-hop problem
dynamic inventory
An inventory generated from a plugin or API at run time, rather than read from a static file. 11 · Dynamic inventory & plugins
EOL End of life
The date a release stops receiving fixes; running past it is a risk conversation.
execution environment EE
A container image bundling ansible-core, collections and their Python/system dependencies — the standard runtime in AWX/AAP, built with ansible-builder. 40 · Execution environments & navigator
extra vars
Variables passed on the command line with -e. The highest precedence level — they override every other definition. 16 · Variables & the precedence that matters
fact
Per-host system data (OS, IP addresses, memory…) that Ansible gathers automatically and exposes under ansible_facts. 17 · Facts, set_fact & caching
filter
A transform applied to a value inside {{ }} with a pipe, like {{ port | default(8080) }} — Jinja2's pipeline stage. 23 · Jinja2 templating & filters
forks
The ansible.cfg setting for parallelism — how many managed nodes Ansible works on at once. 6 · ansible.cfg & config precedence
FQCN Fully Qualified Collection Name
The full namespace.collection.module path for a module, like ansible.builtin.copy. 4 · Collections & FQCN
Galaxy
Ansible’s public hub (galaxy.ansible.com) for published collections and roles, plus the ansible-galaxy CLI that installs from it. 26 · Galaxy, requirements.yml & pinning
group
A named set of hosts in the inventory, targeted as one unit; groups can contain other groups via children. 8 · Inventory: INI and YAML
group_vars
A directory next to your inventory; each YAML file in it applies its variables to the group matching the filename. 9 · group_vars & host_vars
handler
A task defined under handlers: that runs only when notified by a task reporting changed — batched to run once at the end of the play. 20 · Handlers, notify & listen
host_vars
The same mechanism for a single machine — host_vars/web01.yml applies only to the host named web01. 9 · group_vars & host_vars
idempotent
Safe to run repeatedly — changes happen only when the real state differs from the described one. 1 · What Ansible is & isn't
inventory
The file (INI or YAML) naming the hosts Ansible manages and the groups they belong to. 8 · Inventory: INI and YAML
inventory plugin
A control-node plugin that builds the inventory by querying an external source, such as a cloud API or a CMDB. 11 · Dynamic inventory & plugins
job template
An AWX/AAP saved run definition — playbook, inventory, credentials and options stored as one runnable object. 39 · AWX, AAP & the retired Tower name
Kerberos delegation
The AD mechanism letting a server forward your Kerberos ticket onward to a second service. In Ansible: ansible_winrm_kerberos_delegation: true. 35 · The double-hop problem
magic variable
A variable Ansible defines about the run itself — like inventory_hostname or groups. Always available, never set by you. 16 · Variables & the precedence that matters
managed node
A remote host Ansible controls over SSH/WinRM — it needs no Ansible software at all. 2 · Agentless, push-based
module
The unit of work behind a task — it checks current state before changing anything. 1 · What Ansible is & isn't
Molecule
The standard test harness for roles: boots a disposable container/VM, runs the role, checks idempotence, verifies state, tears down. 38 · Molecule, conceptually
namespace
The first segment of an FQCN — who publishes the collection (ansible, community, chocolatey…). 4 · Collections & FQCN
notify
A task keyword naming the handler (or listen topic) to queue when — and only when — the task reports changed. 20 · Handlers, notify & listen
NTLM NT LAN Manager
Windows’ legacy challenge–response authentication protocol. Works for local and domain accounts, and the control node never needs to reach a domain controller for tickets — but it cannot delegate credentials onward. 31 · The WinRM auth matrix
pattern
The host-targeting expression at the start of a run — all, web*, web:&staging, web:!db. 10 · Patterns, --limit & per-env inventories
play
One entry in a playbook: the hosts to target plus the tasks to run on them, with play-level settings like become. 12 · Playbook anatomy
playbook
A YAML file containing an ordered list of plays — the written-down, repeatable form of your automation. 12 · Playbook anatomy
plugin
Code that extends the Ansible engine on the control node — lookup, filter, connection, callback, inventory and become are the main types. 14 · Modules, plugins & collections
precedence
The fixed order Ansible uses to decide which definition wins when the same variable is set in more than one place. 16 · Variables & the precedence that matters
PSRP PowerShell Remoting Protocol
The protocol behind PowerShell remoting; as an Ansible connection plugin it runs over WinRM but is slightly faster and more resilient under load than the winrm plugin. 30 · Windows connections: WinRM, PSRP, SSH
pywinrm
The control-node Python library that lets Ansible speak WinRM to Windows targets. 5 · Installing a control node
register
A task keyword that saves the task's full result (stdout, rc, changed…) into a named variable for later tasks. 15 · Registering output & debug
role
A reusable, parameterized unit of automation — tasks plus their handlers, templates, files and variables — in a fixed directory layout Ansible loads by convention. 24 · Roles: structure, defaults vs vars
runas
The Windows become method — Ansible starts the task under a brand-new logon as become_user, like “Run as different user”. 34 · become, runas & Windows paths
serial
A play keyword that batches hosts: the whole play finishes on one batch (a count, a percentage, or a list of sizes) before the next batch starts. 28 · Strategies, serial & delegation
set_fact
A module that sets your own facts at runtime — values computed mid-play that survive for the rest of the run on that host. 17 · Facts, set_fact & caching
task
One step inside a play — a name plus a single module call with its arguments. 12 · Playbook anatomy
template
A .j2 source file that ansible.builtin.template renders with a host's variables and facts, shipping the per-host result. 23 · Jinja2 templating & filters
Vault
Ansible's built-in encryption for files and values at rest, driven by the ansible-vault command and a password. 27 · Ansible Vault & vault IDs
vault ID
A label attached to a vault password (label@source), letting one run decrypt secrets encrypted with different keys. 27 · Ansible Vault & vault IDs
venv virtual environment
A self-contained Python environment for one project — keeps Ansible and its dependencies out of the system Python. 5 · Installing a control node
WinRM Windows Remote Management
Windows’ built-in remote management service, and the Ansible connection plugin that speaks to it — HTTP on 5985, HTTPS on 5986. 30 · Windows connections: WinRM, PSRP, SSH
WSL Windows Subsystem for Linux
A Linux environment running inside Windows — the route to a control node on a Windows machine, with caveats the docs themselves dispute. 5 · Installing a control node

what people actually say (42)

“Add it to the skip list — with a comment.”
Suppress the rule in .ansible-lint, but write down why: an undocumented skip is one of the most common PR review flags. 37 · ansible-lint & yamllint
“Add the collection to the EE and rebuild.”
Collections aren’t installed on a control node here — ansible-builder bakes them into a new image version, and the tag gets bumped. 40 · Execution environments & navigator
“Are we on bare core or the full package?”
Which pip package the control node has — ansible-core (install collections yourself) or ansible (bundle pre-installed). 3 · ansible-core vs the community package
“Blue-green it — same job, different --limit.”
Deploy to the idle pool by restricting the run to its host group, verify, then rerun against the rest. 41 · Jenkins + Ansible
“Bump the forks if it feels slow.”
Raise the parallelism setting in ansible.cfg so Ansible works on more hosts simultaneously. 6 · ansible.cfg & config precedence
“Crank it up to -vvv and rerun.”
Raise verbosity to see connection detail and the actual values Ansible used for each task. 29 · Run control: check, diff, tags, limit
“CredSSP is off the table — unconstrained delegation.”
Security has vetoed the auth option that hands full credentials to the target; you’ll need Kerberos delegation or become instead. 31 · The WinRM auth matrix
“Does the service account have SeDebugPrivilege?”
The account Ansible connects as needs that privilege for runas — members of Administrators carry it by default. 34 · become, runas & Windows paths
“Grab the vault password from the credential store.”
It's a Jenkins credential, not a file in the repo — the pipeline injects it at run time. 41 · Jenkins + Ansible
“Is that listener on 5985 or 5986?”
Is the host reachable over plain-HTTP WinRM or the recommended HTTPS one — it decides the port and the certificate work. 30 · Windows connections: WinRM, PSRP, SSH
“Is that module in ansible.windows or community.windows?”
Which collection ships it — you may need to install a different one to use it. 4 · Collections & FQCN
“It fails idempotence.”
The second converge run still reported changed tasks — the role flunks the run-twice test from lesson 22. 38 · Molecule, conceptually
“It's not idempotent.”
Re-running the playbook keeps making changes (or reporting them) when nothing should change — usually a raw shell task. 1 · What Ansible is & isn't
“It’s not idempotent.”
Re-running the playbook keeps reporting changed= when nothing should change — a clean second run ends with changed=0. 12 · Playbook anatomy
“Just do it ad-hoc.”
Run it as a one-liner from the CLI — it is a one-off, not worth writing a playbook for. 7 · Your first ad-hoc command
“Just run it from the repo root — the ansible.cfg handles it.”
The project ships its own config file; running from that directory picks it up, so the inventory and other defaults are preset. 6 · ansible.cfg & config precedence
“Kick it off from Tower.”
Run it from whatever web platform the org has — the Tower name is retired, so this almost certainly means AAP. 39 · AWX, AAP & the retired Tower name
“Lint is flagging the with_items in that role.”
ansible-lint warns on legacy with_* loops — the role still runs fine, but convert to loop: when you touch those tasks. 19 · Loops, and the legacy with_*
“Lint is red.”
The CI ansible-lint job failed — fix the violations or add a documented skip before anyone bothers reviewing the PR. 37 · ansible-lint & yamllint
“Local admins bounce off WinRM until you set the token filter policy.”
LocalAccountTokenFilterPolicy=1 is the registry switch that lets remote local-account logons keep their admin token. 32 · Setting up a Windows target
“Molecule is red on your PR.”
The role's CI test failed at some phase — converge, idempotence or verify. Read the log to see which. 38 · Molecule, conceptually
“One role, one job — split it.”
Roles stay focused on a single concern; a role that installs nginx AND manages users AND opens firewall ports gets broken up in review. 36 · Repo structure & conventions
“Run it against prod.”
Execute the playbook with the inventory that names the prod hosts — different inventory, same playbook. 8 · Inventory: INI and YAML
“Run it in check mode first.”
Do a --check dry run and read what would change before anything actually does. 29 · Run control: check, diff, tags, limit
“Run the playbook against prod.”
Execute it with the production inventory — ansible-playbook site.yml -i inventories/prod/. 10 · Patterns, --limit & per-env inventories
“That’s in the role’s defaults, just override it.”
The value lives in defaults/main.yml — the lowest precedence level, designed for your inventory to beat. 16 · Variables & the precedence that matters
“The 2019 boxes can’t do SSH — their OpenSSH build is too old.”
Server 2019 ships OpenSSH 7.7.2.1, below the 7.9 floor Ansible needs, so those hosts stay on WinRM/PSRP. 30 · Windows connections: WinRM, PSRP, SSH
“The Chocolatey tasks aren’t resolving — did anyone install chocolatey.chocolatey?”
win_chocolatey ships in Chocolatey’s own vendor collection, not ansible.windows — if that collection isn’t installed, the module name never resolves. 33 · Windows collections & modules
“The controller syncs inventory from the source.”
AWX/AAP refreshing its inventory from an external source — the same idea, run as a platform feature. 11 · Dynamic inventory & plugins
“The EE already has that collection baked in.”
In AWX/AAP, collections ship inside an execution-environment container image, not on the control node. 3 · ansible-core vs the community package
“The old ConfigureRemoting script is still in that onboarding runbook.”
The Windows prep uses the discouraged bootstrap script — replace it with the explicit Enable-PSRemoting sequence before the script disappears. 32 · Setting up a Windows target
“There’s a job template for that.”
A saved run definition already exists in AWX/AAP — pick it, click launch, no CLI needed. 39 · AWX, AAP & the retired Tower name
“Use the FQCN or lint will fail the PR.”
Write ansible.builtin.copy, not copy — the CI linter enforces full module paths. 4 · Collections & FQCN
“We run Kerberos over HTTP inside the domain.”
Not as reckless as it sounds — Kerberos encrypts the WinRM payload itself, so port 5985 without TLS is acceptable for domain traffic. 31 · The WinRM auth matrix
“We use dynamic inventory for that environment.”
The host list is generated from a plugin/API at run time, not maintained in a static file. 11 · Dynamic inventory & plugins
“We use serial 1.”
The deploy play is a rolling update — it runs to completion on one host at a time, so the rest of the fleet stays up. 28 · Strategies, serial & delegation
“We vault that.”
That value is stored encrypted in Ansible Vault, not in plaintext. 27 · Ansible Vault & vault IDs
“Which EE does that run in?”
Which container image and tag supplies the runtime — it fixes the ansible-core, collection and Python versions the playbook gets. 40 · Execution environments & navigator
“Why is that in group_vars/all?”
The file every environment reads should stay minimal — an environment-specific value there is a review flag; it belongs in that env’s inventory directory. 36 · Repo structure & conventions
“Why isn’t my group_vars value winning?”
Something higher on the ladder — role vars, set_fact, or -e — defines the same name. Trace it with -vvv. 16 · Variables & the precedence that matters
“Works when I RDP in, dies in the playbook.”
The double-hop signature: RDP is an interactive logon that caches credentials; WinRM is a network logon that cannot pass them onward. 35 · The double-hop problem
“Wrap it in become — that gets around the WinRM restrictions.”
Run the task under a runas logon so WUA, DPAPI and other non-interactive blocks stop failing it. 34 · become, runas & Windows paths