Advanced Ansible Trainer

What actually happens between ansible-playbook and a changed host, and where the time goes. The task execution loop, module transfer and the AnsiballZ wrapper, connection reuse, and the specific levers that turn a ninety-minute run into a fifteen-minute one — measured rather than guessed.

Topics: The task execution loop and AnsiballZ module packaging · Forks, serial and the difference between them · SSH ControlPersist, multiplexing and pipelining · Fact gathering cost, gather_subset and fact caching backends · Strategies: linear, free and host_pinned · Profiling with callback plugins and task timing · Interpreter discovery and Python version pinning

• Assignments: (1) Profile a slow playbook and produce a ranked list of time sinks; (2) Cut the wall-clock time of a real run by half without changing what it does
• Capstone: Deliver a tuned execution configuration with before-and-after timings and a written rationale

Ansible's data layer treated seriously. Complex variable structures, the full precedence chain and where it surprises people, native Jinja2 types, the filters and tests that remove most custom code, and writing your own filter and test plugins when the built-in set runs out.

Topics: Complex data structures and combining dictionaries · The 22-level variable precedence chain in practice · Jinja2 native types, undefined behaviour and strictness · Filters: map, selectattr, json_query, combine, product, zip · Loop control, nested loops and loop_control · Writing custom filter and test plugins · Templating traps: lazy evaluation, recursion and quoting

• Assignments: (1) Replace a set of shell and set_fact hacks with correct filter expressions; (2) Write a filter plugin and use it from a role
• Capstone: Build a data-driven configuration generator that produces correct output for three environments from one source of truth

Module development as software engineering. The AnsibleModule contract, argument specification with types, defaults, required_if and mutual exclusion, correct handling of check mode and diff, idempotency as a design property, and the documentation blocks that make a module usable by anyone else.

Topics: AnsibleModule: argument_spec, types, defaults and validation · required_if, required_together and mutually_exclusive · exit_json, fail_json and the return contract · check_mode and diff mode support · Designing for idempotency: read state, compare, converge · module_utils and shared code · DOCUMENTATION, EXAMPLES and RETURN blocks · Debugging modules locally and with ANSIBLE_KEEP_REMOTE_FILES

• Assignments: (1) Write a module that manages a resource through a REST API idempotently; (2) Add check_mode and diff support to an existing module
• Capstone: Ship a documented, check-mode-safe custom module with unit tests and a working example playbook

The extension points most teams never use. Where each plugin type runs, what it can see, and which problem it is the right answer to — including the distinction between a module that executes on the target and an action plugin that executes on the controller before it.

Topics: Action plugins versus modules and when each applies · Callback plugins for logging, notification and timing · Inventory plugins and constructed inventory · Cache plugins for facts and inventory · Vars plugins and dynamic variable sources · Lookup plugins for external data · Connection plugins and custom transports · Strategy plugins and execution ordering

• Assignments: (1) Write a callback plugin that emits structured run telemetry; (2) Write an inventory plugin against an internal source of truth
• Capstone: Deliver a plugin set that integrates Ansible with one internal system end to end

How advanced content is packaged and shipped. Collection structure and namespaces, fully qualified collection names, semantic versioning and dependency resolution, building and publishing to Galaxy or a private Automation Hub, then execution environments that pin the entire runtime.

Topics: Collection layout: plugins, roles, playbooks, docs, meta · Fully qualified collection names and the collections keyword · galaxy.yml, semantic versioning and dependencies · ansible-galaxy collection build, install and publish · requirements.yml and pinning in CI · Private Automation Hub and internal distribution · Execution environments with ansible-builder · Migrating an existing role library into collections

• Assignments: (1) Convert a role library into a versioned collection with dependencies; (2) Build an execution environment image and run a playbook inside it
• Capstone: Publish an internal collection and consume it from a pipeline using a pinned execution environment

Making automation defensible before it runs anywhere real. Molecule scenarios and drivers, the create-converge-idempotence-verify cycle, verifiers, matrix testing across distributions, ansible-lint and yamllint rulesets, and sanity, unit and integration tests for collection content.

Topics: Molecule scenarios, drivers and the test sequence · Converge and the idempotence check · Verifiers: Ansible-based and Testinfra · Testing a role across multiple distributions · ansible-lint rules, profiles and suppressions · Sanity, unit and integration tests for collections · Wiring Molecule into GitLab CI, GitHub Actions or Jenkins · Deciding what blocks a merge versus what only reports

• Assignments: (1) Add a Molecule scenario with an idempotence gate to an untested role; (2) Build a CI matrix that tests one role across two distributions
• Capstone: Deliver a pipeline where no automation change can merge without passing lint, idempotence and verification

Multi-tier changes where ordering, timing and partial failure all matter. Delegation and delegated facts, run_once, serial and batch sizing, throttle, async and polling for long tasks, retries with until, and explicit failure thresholds so a rolling change stops before it takes out a tier.

Topics: delegate_to, delegate_facts and local actions · run_once and single-host coordination · serial, batches and percentage-based rollout · max_fail_percentage, any_errors_fatal and failed_when · async, poll and long-running task patterns · throttle, wait_for and wait_for_connection · Blocks, rescue, always and handler flushing · Handler listen topics and cross-role notification · Rolling upgrades with load balancer and health-check integration

• Assignments: (1) Build a rolling upgrade that removes and returns nodes from a load balancer; (2) Make a multi-tier deployment stop safely at a defined failure threshold
• Capstone: Deliver a zero-downtime multi-tier release that survives a deliberately injected mid-run failure

Credential handling once one vault password and one repository are no longer enough. Multiple vault identities and rotation, external secret managers reached through lookups, controller credential types, no_log discipline, and using Ansible as an evidence-producing compliance tool rather than only a change tool.

Topics: Vault IDs, multiple vault identities and rotation at scale · External secrets: HashiCorp Vault, cloud secret managers, CyberArk lookups · Custom credential types in Automation Controller · no_log, output redaction and log hygiene · Privilege escalation methods and constrained sudo · Compliance scanning and remediation playbooks · Producing auditable run evidence and reporting

• Assignments: (1) Move a repository from a single vault password to multiple vault identities; (2) Fetch a secret at run time from an external manager without writing it to disk
• Capstone: Design a secrets and evidence model that survives key rotation, CI automation and an audit

Running Ansible as a shared platform. Controller architecture and topology, instance and container groups, projects wired to source control, job and workflow templates with surveys, RBAC across organisations and teams, notifications, and driving all of it through the API rather than the interface.

Topics: Controller architecture, nodes and job execution · Instance groups, container groups and capacity · Projects, SCM sync and branch strategy · Job templates, surveys and prompt-on-launch · Workflow templates: convergence, approval and conditional paths · Organisations, teams and RBAC design · Custom credential types and credential lookups · Notifications, callbacks and provisioning callbacks · The controller API, awx CLI and automation of the automation · Scaling, backup, restore and upgrade

• Assignments: (1) Design an RBAC model for three teams sharing one controller; (2) Build a workflow template with an approval node and conditional branches
• Capstone: Deliver a self-service automation platform with RBAC, workflows and API-driven onboarding

Ansible against targets that are not Linux servers. Persistent connections for network devices, the network_cli, netconf and httpapi connection plugins, resource modules and structured configuration state, Windows automation over WinRM, and dynamic inventory at cloud scale with constructed grouping.

Topics: network_cli, netconf and httpapi connection plugins · Persistent connection manager and connection lifetime · Network resource modules and structured facts · cli_command, cli_config and configuration diffing · Multi-vendor abstraction and where it breaks down · Windows targets: WinRM, PSRP and Windows modules · Dynamic inventory plugins with constructed groups and keyed_groups · Testing network automation without touching production hardware

• Assignments: (1) Automate a device configuration change using resource modules with a diff and rollback path; (2) Build a constructed dynamic inventory that groups hosts by tag and region
• Capstone: Deliver a validated network or heterogeneous-estate change with pre-checks, diff, apply and rollback