20+ Commands

Ansible CLI & Playbook Commands Cheat Sheet

Production Ansible CLI reference matrix covering ping, ad-hoc execution, playbook check mode, tags, vault encryption, and inventory graphs with 1-click copy.

Ad-Hoc & Connectivity (4 commands)

Ad-Hoc & Connectivity

ansible all -m ping

Tests SSH connectivity and Python availability across all inventory managed nodes.

PRO TIP Pass -u or --private-key to specify SSH credentials for remote nodes.

Ad-Hoc & Connectivity

ansible webservers -m setup -a "filter=ansible_distribution*"

Gathers hardware, OS distribution, memory, and IP facts from the webservers group.

PRO TIP Essential for inspecting remote system architecture before writing targeted playbooks.

Ad-Hoc & Connectivity

ansible all -m command -a "uptime" -o

Runs the uptime command across all nodes and outputs responses in a concise single-line format (-o).

PRO TIP The command module does not pass commands through shell; use -m shell for pipes and redirection.

Ad-Hoc & Connectivity

ansible dbservers -m shell -a "free -m | grep Mem" -b

Executes shell command with administrative privileges (sudo) via the become flag (-b).

PRO TIP Ensure the SSH user has passwordless sudo configured in /etc/sudoers.d/.

Playbook Execution (5 commands)

Playbook Execution

ansible-playbook site.yml --check --diff

Executes dry-run audit mode without modifying remote state and displays unified diff of pending changes.

PRO TIP Golden standard for CI/CD pre-deployment verification to catch unintended configuration drifts.

Playbook Execution

ansible-playbook deploy.yml -i production.ini --limit webservers

Applies playbook against a specific custom inventory file and restricts tasks to the webservers group.

PRO TIP Combine --limit with comma-separated hosts or wildcard patterns like web*.example.com.

Playbook Execution

ansible-playbook site.yml --tags "nginx,ssl" --skip-tags "backup"

Selectively executes only tasks marked with specified tags while skipping lengthy backup routines.

PRO TIP Tag modular roles and individual tasks to enable rapid incremental deployments.

Playbook Execution

ansible-playbook site.yml --start-at-task="Restart Nginx Service"

Resumes a failed playbook directly at a specific named task without re-running earlier completed steps.

PRO TIP Saves time when debugging syntax errors in multi-stage orchestration scripts.

Playbook Execution

ansible-playbook site.yml --step

Prompts for interactive user confirmation before executing each individual playbook task.

PRO TIP Safest execution mode when performing initial canary testing on production nodes.

Inventory Management (2 commands)

Inventory Management

ansible-inventory -i hosts.yml --graph

Displays a visual ASCII hierarchical tree of all inventory groups and child nodes.

PRO TIP Verify group inheritance and parent-child variable hierarchies at a glance.

Inventory Management

ansible-inventory -i hosts.yml --list

Outputs inventory hosts, groups, and assigned hostvars in formatted machine-readable JSON.

PRO TIP Pipe into jq to query dynamic cloud inventories (AWS EC2, GCP, Azure, Hetzner).

Secrets & Vault (4 commands)

Secrets & Vault

ansible-vault create vars/vault.yml

Creates a new AES-256 encrypted YAML file for storing database passwords and API tokens.

PRO TIP Commit encrypted vault files safely to public Git repositories without risk of leaks.

Secrets & Vault

ansible-vault edit vars/vault.yml

Decrypts, opens vault file in $EDITOR (e.g. vim or nano), and re-encrypts upon file save.

PRO TIP Does not write unencrypted plaintext copies to disk during editing.

Secrets & Vault

ansible-vault encrypt_string "MySecretPassword123" --name "db_password"

Encrypts a single variable string inline for embedding directly into plaintext variable files.

PRO TIP Keeps non-sensitive configuration keys readable while protecting individual credentials.

Secrets & Vault

ansible-playbook site.yml --vault-password-file ~/.vault_pass

Supplies vault decryption key from a protected local file, avoiding interactive password prompts.

PRO TIP In CI/CD environments, read the password from an environment variable via a simple script.

Galaxy & Roles (2 commands)

Galaxy & Roles

ansible-galaxy install geerlingguy.nginx

Downloads and installs community-tested production roles from Ansible Galaxy.

PRO TIP Use a requirements.yml file to lock down dependency versions across team environments.

Galaxy & Roles

ansible-galaxy role init my_custom_role

Scaffolds standard Ansible role directory layout (tasks, handlers, defaults, vars, meta).

PRO TIP Maintains modular, reusable configuration architecture across multiple client projects.