ansible-patterns

Use serial with a percentage (e.g., serial: "25%") and max_fail_percentage to batch updates, combined with pre_tasks to remove hosts from the load balancer and post_tasks to health-check and re-enable them. This pattern limits blast radius while maintaining availability.

Use ansible-vault encrypt_string to encrypt individual values inline, or ansible-vault encrypt for entire vars files. Reference encrypted variables like vault_db_password in plain vars files, and pass credentials at runtime with --vault-password-file or --vault-id per environment.

Register the command output and set changed_when: false for read-only checks, use the creates argument for one-time initialization, and define failed_when conditions for custom error detection. Avoid raw command or shell for package and service management where dedicated modules exist.

Yes, the amazon.aws.aws_ec2 inventory plugin generates hosts from EC2 instances across regions, groups them by tags like Environment and Role via keyed_groups, and filters by instance state. Configure it in an aws_ec2.yml inventory file with hostnames and connection variables.

Define a molecule.yml with the docker driver and platform images such as Ubuntu 22.04 or Rocky Linux 9, then write a verify.yml playbook asserting service state, HTTP responses, and config validity. Run ansible-lint in the lint step for style enforcement.

Avoid using command or shell where modules exist (e.g., apt instead of apt-get), restarting services in tasks instead of handlers, hardcoded IPs instead of inventory variables, broad ignore_errors: true, and plaintext secrets files instead of vault encryption.