Ansible避坑指南

YAML Syntax Traps

• - Jinja2 in value needs quotes — "{{ variable }}" not INLINECODE1
• INLINECODE2 in string needs quotes — msg: "Note: this works" not INLINECODE4
• Boolean strings: yes, no, true, false parsed as bool — quote if literal string
• Indentation must be consistent — 2 spaces standard, tabs forbidden

Variable Precedence

• - Extra vars (-e) override everything — highest precedence
• Host vars beat group vars — more specific wins
• INLINECODE10 in playbook beats inventory vars — order: inventory < playbook < extra vars
• Undefined variable fails — use INLINECODE11

Idempotence

• - command/shell modules aren't idempotent — always "changed", use creates: or specific module
• Use apt, yum, copy etc. — designed for idempotence
• INLINECODE18 for commands that don't change state — like queries
• INLINECODE19/removes: for command idempotence — skips if file exists/doesn't

Handlers

• - Handlers only run if task reports changed — not on "ok"
• Handlers run once at end of play — not immediately after notify
• Multiple notifies to same handler = one run — deduplicated
• INLINECODE21 to run even on failure — or INLINECODE22

Become (Privilege Escalation)

• - become: yes to run as root — become_user: for specific user
• INLINECODE25 is default — use su or doas if needed
• Password needed for sudo — --ask-become-pass or in ansible.cfg
• Some modules need become at task level — even if playbook has INLINECODE29

Conditionals

• - when: without Jinja2 braces — when: ansible_os_family == "Debian" not INLINECODE32
• Multiple conditions use and/or — or list for implicit INLINECODE35
• INLINECODE36, is not defined for optional vars — INLINECODE38
• Boolean variables: when: my_bool — don't compare INLINECODE40

Loops

• - loop: is modern, with_items: is legacy — both work, loop preferred
• INLINECODE43 for nested loops — avoids variable collision
• INLINECODE44 is the loop variable — use loop_control.label for cleaner output
• INLINECODE46 for retry loops — INLINECODE47

Facts

• - gather_facts: no speeds up play — but can't use ansible_* variables
• Facts cached with fact_caching — persists across runs
• Custom facts in /etc/ansible/facts.d/*.fact — JSON or INI, available as INLINECODE52

Common Mistakes

• - register: captures output even on failure — check result.rc or INLINECODE55
• INLINECODE56 continues but doesn't change result — task still "failed" in register
• INLINECODE57 for local commands — but local_action is cleaner
• Vault password for encrypted files — --ask-vault-pass or vault password file
• INLINECODE60 (dry run) not supported by all modules — command, shell always skip