ansible-playbooks

# Skill: Ansible Playbooks > **Expertise:** Idempotent roles, inventory patterns, Vault integration, molecule testing, bare-metal K8s node prep. ## When to load When configuring bare-metal servers, provisioning K8s nodes, managing OS-level config, or rotating OS credentials. ## Role Structure (Standard) ``` roles/base-server/ ├── tasks/ │ ├── main.yml ← imports sub-task files │ ├── packages.yml │ ├── sysctl.yml │ └── users.yml ├── defaults/ │ └── main.yml ← all variables with sensible defaults ├── vars/ │ └── main.yml ← internal constants (not overridable) ├── templates/ │ └── sysctl.conf.j2 ├── handlers/ │ └── main.yml ← restart services on change └── meta/ └── main.yml ← role dependencies ``` ## Idempotency Patterns ```yaml # ✅ Package install — idempotent - name: Install required packages ansible.builtin.apt: name: - containerd - curl - jq state: present update_cache: true when: ansible_os_family == "Debian" # ✅ File with checksum validation — only copies if changed - name: Configure containerd ansible.builtin.template: src: containerd-config.toml.j2 dest: /etc/containerd/config.toml owner: root group: root mode: "0644" notify: Restart containerd # handler only fires if file changed # ✅ Service management - name: Enable and start containerd ansible.builtin.systemd: name: containerd enabled: true state: started daemon_reload: t...