<img decoding="async" style="height: 461px; width: 461px;" src="https://lh7-us.googleusercontent.com/gVrom8XtbHgk0FD7cDdTuJUAfxeHZXXe-9aZz8NadHzZ15eXc7ktDUfo9pkWupuPYuMkFAX6cACQGau8C-upUafeY-lIpcLPCobpS1N3siEwizbaxCr0vutBftPJwztlYKr8Jv8ikjmFwa-vG2pQ1Z0" alt="ansible" />
<h2>Introduction:</h2>
In the evolving realm of DevOps and automation Ansible has emerged as a tool, for efficiently managing infrastructure and orchestrating tasks. To ensure execution of your Ansible code simplify troubleshooting and make an impact on your automation journey it is essential to follow best practices. This comprehensive guide delves into the practices for Ansible encompassing everything from code formatting to security considerations.
<h2>1. Effective Use of Whitespaces</h2>
Maintaining an easily understandable codebase is crucial for Ansible playbooks. It is advisable to use spaces of tabs, in your YAML code. Additionally enhancing readability can be achieved by adding a line before each block or task. Lets consider an example;
Wrong:
<pre><code>---
- hosts: all
 tasks:
 - ansible.builtin.yum:
 name: httpd
 state: latest
- ansible.builtin.debug:
 msg: "httpd successfully installed"
</code></pre>
Correct:
<pre><code>---
- hosts: all
 tasks:
 - ansible.builtin.yum:
 name: httpd
 state: latest

 - ansible.builtin.debug:
 msg: "httpd successfully installed"
</code></pre>
<h2>2. Assign a &#8220;Name&#8221; to Every Step</h2>
Ensure that every Ansible statement, whether it&#8217;s a play, task, or block, has a descriptive name. Adding a name parameter provides clarity and makes your code more understandable. For instance:
Wrong:
<pre><code>---
- hosts: all
 tasks:
 - ansible.builtin.yum:
 state: latest
 name: httpd</code></pre>
Correct:
<pre><code>---
- name: install apache
 hosts: all
 tasks:
 - name: install apache packages
 ansible.builtin.yum:
 name: httpd
 state: latest</code></pre>
<h2>3. Use Human-Readable and Meaningful Names for Variables</h2>
Variables play a crucial role in Ansible for storing parameters or saving task results. Opt for human-readable and meaningful variable names to enhance code reuse and readability within your team. For example:
Wrong:
<pre><code>httpkeepalive: 25
webpo: 80
aaaa: 8080</code></pre>
Correct:
<pre><code>apache_max_keepalive: 25
apache_port: 80
tomcat_port: 8080</code></pre>
<h2>4. Use Native YAML</h2>
Utilize native YAML syntax for improved code readability. This approach facilitates error detection and allows the use of YAML linters and parsers for validation. Compare the following examples:
Wrong:
<pre><code>- name: install apache
 ansible.builtin.yum: apache-{{ apache_version }}
 state: present
 update_cache: yes
 disable_gpg_check: yes
 enablerepo: apache
 notify: restart apache</code></pre>
Correct:
<pre><code>- name: install apache
 ansible.builtin.yum: apache-{{ apache_version }}
 state: present
 update_cache: yes
 disable_gpg_check: yes
 enablerepo: apache
 notify: restart apache
</code></pre>
<h2>5. Use Native Modules Against Run Commands</h2>
Prioritize native modules over command modules for increased idempotency and built-in parameter validation. While command modules (e.g., ‘shell&#8217;, ‘command’, ‘raw’, and ‘script’) are useful, they should be employed as a last resort. Consider the following transformation:
Wrong:
<pre><code>- name: Add repository into repo.d list
 become: true
 ansible.builtin.shell: 'echo -e "[google-chrome]\nname=google-chrome\nbaseurl=http://dl.google.com/linux/chrome/\rpm/stable/x86_64\nenabled=1\ngpgcheck=1\ngpgkey=https://dl.google.com/linux/linux_signing_key.pub" &gt; /etc/yum.repos.d/google-chrome.repo'
 args:
 creates: /etc/yum.repos.d/google-chrome.repo
 when: ansible_os_family == 'RedHat'</code></pre>
Correct:
<pre><code>- name: Add repository into repo.d list
 ansible.builtin.yum_repository:
 name: google-chrome
 description: google-chrome repository
 baseurl: http://dl.google.com/linux/chrome/rpm/stable/x86_64
 enabled: true
 gpgcheck: true
 gpgkey: https://dl.google.com/linux/linux_signing_key.pub</code></pre>
<h2>6. Configure Debug Messages</h2>
When developing Ansible code, leverage ‘debug’ tasks for outputting variable content. However, to avoid excessive information at the production level, set the ‘verbosity’ parameter to ‘2’. This ensures that debug messages are visible only when explicitly needed. Consider the following example:
Wrong:
<pre><code>- name: message output
 ansible.builtin.debug:
 msg: "This text always displays"</code></pre>
Correct:
<pre><code>- name: message output
 ansible.builtin.debug:
 msg: "This text displays with ansible-playbook -vv"
 verbosity: 2</code></pre>
<h2>7. Execute Your Task with the Least Possible Privilege</h2>
Adhere to security best practices by executing tasks with the least possible privilege. Implement this by specifying ‘become: true’ at the task level rather than for the entire playbook, especially if not all tasks require root/administrator privileges. For instance:
Wrong:
<pre><code>---
- name: install apache
 hosts: all
 become: true
 tasks:
 - name: message output
 ansible.builtin.debug:
 msg: "This text always displays"

 - name: install apache packages
 ansible.builtin.yum:
 name: httpd
 state: latest</code></pre>
Correct:
<pre><code>---
- name: install apache
 hosts: all
 tasks:
 - name: message output
 ansible.builtin.debug:
 msg: "This text always displays"
- name: install apache packages
 ansible.builtin.yum:
 name: httpd
 state: latest
 become: true</code></pre>
<h2>8. Use Version Control</h2>
Implement version control using Source Code Management (SCM) platforms like GitHub, GitLab, or Bitbucket. This practice allows you to track modifications, collaborate with team members, and ensure that your execution nodes are always up-to-date.
<h2>9. Always Mention the &#8220;State&#8221; Parameter</h2>
Many Ansible modules have optional &#8220;state&#8221; parameters with implicit values. To enhance clarity in your playbooks and roles, explicitly set ‘state: present’ or ‘state: absent’ where applicable. This ensures that the intended state is explicitly defined.
<h2>10. Use Comments</h2>
Include comments (lines starting with ‘#’) to provide context and explanations for your Ansible code. Comments help others (and even your future self) understand the purpose, methodology, and significance of each statement, play, task, or variable setting.
<h2>Conclusion:</h2>
Following these Ansible command best practices sets the foundation for successful automation, ensuring code maintainability, readability, and security. By incorporating these practices into your Ansible workflows, you streamline your automation journey, making it more efficient and resilient. As you embrace the power of Ansible and <a href="https://cloudastra.co/blogs/securing-sensitive-data-in-ansible-a-deep-dive-into-ansible-vault"><span data-sheets-root="1" data-sheets-value="{&quot;1&quot;:2,&quot;2&quot;:&quot;Ansible Vault&quot;}" data-sheets-userformat="{&quot;2&quot;:6657,&quot;3&quot;:{&quot;1&quot;:0},&quot;12&quot;:0,&quot;14&quot;:{&quot;1&quot;:2,&quot;2&quot;:0},&quot;15&quot;:&quot;ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \&quot;Segoe UI\&quot;, Roboto, \&quot;Helvetica Neue\&quot;, Arial, \&quot;Noto Sans\&quot;, sans-serif, \&quot;Apple Color Emoji\&quot;, \&quot;Segoe UI Emoji\&quot;, \&quot;Segoe UI Symbol\&quot;, \&quot;Noto Color Emoji\&quot;&quot;}">Ansible Vault</a>, a commitment to best practices empowers you to build robust and scalable automation solutions.
&nbsp;
Do you like to read more educational content? Read our blogs at<a style="text-decoration: none;" href="https://www.cloudastra.co/blogs"> Cloudastra Technologies</a> or contact us for business enquiry at <a style="text-decoration: none;" href="https://www.cloudastra.co/contact">Cloudastra Contact Us</a>.
&nbsp;

Blog Details

Ansible Best Practices: Streamlining Automation for Success