Integrating with CI/CD Pipelines

1. Using Ansible in Jenkins

Property	Description	Example
Ansible Plugin	Plugin for Jenkins to execute Ansible playbooks	`ansible-plugin`
Playbook Path	Path to the Ansible playbook file	`playbooks/deploy.yml`
Inventory File	Path to the inventory file (e.g., hosts.ini)	`inventory/production.ini`
Extra Vars	Variables passed to the playbook at runtime	`environment=prod`

Example: Jenkins Pipeline Script

pipeline {
    agent any
    stages {
        stage('Deploy with Ansible') {
            steps {
                ansiblePlaybook(
                    playbook: 'playbooks/deploy.yml',
                    inventory: 'inventory/production.ini',
                    extraVars: [environment: 'prod']
                )
            }
        }
    }
}

Note: Ensure the Jenkins server has Ansible installed and configured with appropriate permissions to execute playbooks.

2. Using Ansible in GitLab CI

Example: Basic GitLab CI Pipeline with Ansible

stages:
  - test
  - deploy

variables:
  ANSIBLE_GALAXY_COLLECTIONS_PATH: "./collections"

test:
  stage: test
  image: "ansible/ansible-runner:latest"
  script:
    - ansible-galaxy collection install -r requirements.yml
    - ansible-playbook test-playbook.yml --syntax-check

deploy:
  stage: deploy
  image: "ansible/ansible-runner:latest"
  script:
    - ansible-galaxy collection install -r requirements.yml
    - ansible-playbook deploy-playbook.yml
  environment:
    name: production
    url: https://example.com

Property	Description	Default
image	Docker image containing Ansible and required tools	`ansible/ansible-runner:latest`
stages	Defines the pipeline stages (e.g., test, deploy)	None
script	Commands to run in the CI environment	None

Note: Ensure that the Docker image used has necessary dependencies like ansible, git, and ssh to execute playbooks.

Warning: Avoid hardcoding sensitive data (e.g., passwords) in .gitlab-ci.yml. Use GitLab CI variables or Vault for secrets.

3. Using Ansible in GitHub Actions

Step	Description	Action
1	Set up the GitHub Actions workflow file	`.github/workflows/ansible.yml`
2	Install required dependencies (Ansible, collections)	`ansible-galaxy install -r requirements.yml`
3	Run Ansible playbook	`ansible-playbook site.yml`

Example: GitHub Actions Workflow

name: Ansible Playbook
on:
  push:
    branches: [ main ]
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.10'
      - name: Install Ansible
        run: pip install ansible
      - name: Install Collections
        run: ansible-galaxy collection install -r requirements.yml
      - name: Run Playbook
        run: ansible-playbook site.yml

Note: Ensure requirements.yml includes all necessary collections and roles for the playbook to execute successfully.

Warning: Avoid hardcoding sensitive data (e.g., passwords, tokens) in workflows. Use GitHub Secrets or encrypted variables.

4. Using Ansible in CircleCI

Example: Basic CircleCI Configuration

version: 2.1
jobs:
  ansible-deploy:
    docker:
      - image: circleci/python:3.9
    steps:
      - checkout
      - run:
          name: Install Ansible
          command: pip install ansible
      - run:
          name: Run Playbook
          command: ansible-playbook deploy.yml

Property	Description	Values
version	CircleCI configuration version	`2.1`
jobs	Defines jobs to run in the pipeline	Object with job definitions
docker.image	Base image for the job environment	`circleci/python:3.9`
steps	Sequence of actions to execute in the job	Array of step definitions
checkout	Checks out the project code	`- checkout`
run.command	Shell command to execute	String or array of strings

Note: Ensure that your CircleCI configuration file is named .circleci/config.yml.

Warning: Make sure to securely manage any sensitive data (e.g., SSH keys, passwords) using CircleCI's encrypted environment variables or secrets management.

Key Configuration Points

Use a Docker image with Python and Ansible installed.
Install additional dependencies using pip install.
Run playbooks with ansible-playbook command.
Securely manage sensitive data using CircleCI's secrets feature.

5. Managing Secrets in CI

Secret Type	Storage Method	Access Pattern	Notes
Vault Password	`ansible-vault`	Environment variable `ANSIBLE_VAULT_PASSWORD_FILE`	Used for decrypting vault-encrypted files
API Keys	CI/CD Secrets	Environment variables or `ansible-playbook --extra-vars`	Securely injected into pipeline steps
SSH Keys	CI/CD Secrets	Passed via `--private-key` or `ansible.cfg`	Must be base64-encoded for safe handling in YAML

Example: Using Vault in CI Pipeline

steps:
  - name: Decrypt Vault
    run: |
      echo "$VAULT_PASSWORD" > vault_pass.txt
      ansible-vault decrypt secrets.yml --vault-password-file vault_pass.txt

Note: Never store plain-text secrets in version control. Use CI/CD provider's secret management (e.g., GitHub Secrets, GitLab CI Variables).

Warning: Ensure ANSIBLE_VAULT_PASSWORD_FILE is not exposed in logs or console output.

6. Running Tests in CI

Test Type	Description	Command	Notes
Syntax Check	Validates playbook syntax without executing	`ansible-playbook --syntax-check site.yml`	Use in pre-commit hooks or CI setup
Linting	Checks for best practices and style issues	`ansible-lint site.yml`	Can be integrated into CI pipelines with custom rules
Idempotency Test	Ensures playbooks can be run multiple times without side effects	`ansible-playbook site.yml --check`	Simulates run without making changes (dry-run)

Example: Running Tests in GitHub Actions

name: Run Ansible Tests
on:
  push:
    branches: [ main ]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.10'

      - name: Install Ansible
        run: pip install ansible

      - name: Syntax Check
        run: ansible-playbook --syntax-check site.yml

      - name: Lint Playbook
        run: ansible-lint site.yml

Note: Ensure all required dependencies and inventory files are available in the CI environment.

7. Deploying from CI

Option	Values	Notes
ansible-playbook	`ansible-playbook deploy.yml -i inventory.ini`	Basic command to run a playbook in CI
inventory	`inventory.ini`	File containing target hosts
extra-vars	`--extra-vars "env=prod"`	Pass variables to playbook

Example: Deploying to Production

ansible-playbook deploy.yml -i production.ini --extra-vars "env=prod version=1.2.3"

Note: Ensure CI has proper SSH access and credentials to target hosts.

Warning: Never store sensitive credentials in plain text in CI config files.

CI Provider	Deployment Method	Notes
`GitHub Actions`	`ansible-galaxy install -r requirements.yml`	Use `github.com/ansible/ansible` image or self-hosted runner
`Jenkins`	`ansible-playbook` via shell script	Requires Jenkins agent with Ansible installed
`GitLab CI`	`ansible-playbook` in `.gitlab-ci.yml`	Use official Ansible Docker image or custom image

8. Using Ansible Pull

Ansible Pull is a method of running Ansible playbooks on managed nodes without requiring a central Ansible controller. It allows nodes to pull their configuration from a remote source (e.g., Git repository) and execute it locally.

Option	Values	Description
ansible-pull	`ansible-pull`	Command to execute Ansible Pull
--url	`https://github.com/example/playbooks.git`	URL to the Git repository containing playbooks
--inventory	`inventory.ini`	Path to the inventory file or host list
--playbook	`site.yml`	Name of the playbook to run
--directory	`/tmp/ansible`	Directory to clone the repository into

Example: Running Ansible Pull

ansible-pull -U https://github.com/example/playbooks.git site.yml -i inventory.ini

Note: Ansible Pull requires the target nodes to have access to the Git repository and sufficient permissions to clone and execute playbooks.

Warning: Ensure that the playbook content is trusted, as it is executed directly on the managed nodes.

9. Scheduling Playbooks

Option	Values	Description
ansible-playbook	`ansible-playbook site.yml`	Command to run an Ansible playbook
schedule	`cron`	Scheduling tool to automate playbook execution
job_name	`daily_deploy`	Name of the scheduled job

Example: Scheduling a playbook with cron

# Edit crontab to schedule playbook run
crontab -e

# Add line to run playbook every day at 2 AM
0 2 * * * /usr/bin/ansible-playbook /path/to/site.yml -i inventory.ini

Note: Ensure the user running the cron job has appropriate permissions to execute Ansible playbooks and access inventory files.

10. Using AWX Tower API

Property	Description	Example
tower_api_url	Base URL for the AWX Tower API	`https://awx.example.com/api/v2`
tower_token	Authentication token for API access	`eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...`
job_template_id	ID of the job template to execute	`123`

Example: Triggering a Job via AWX API

curl -X POST \
  https://awx.example.com/api/v2/job_templates/123/launch/ \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...' \
  -H 'Content-Type: application/json' \
  -d '{"extra_vars": {"environment": "production"}}'

Note: Ensure the token has appropriate permissions to launch job templates.

Warning: The tower_token should be stored securely and not hardcoded in playbooks.

Field	Type	Description
extra_vars	Object	Variables to pass to the job template
limit	String	Restrict the job to specific hosts
job_type	String	Job type: `run` or `check`

API Integration Summary

Use POST /job_templates/{id}/launch/ to trigger jobs
Include Authorization: Bearer <token> header
Pass variables via extra_vars parameter