RHCE cheat sheet

Architecture: the control node runs the Ansible CLI and stores inventory, playbooks, and configuration; managed nodes need only SSH and a Python interpreter-no Ansible agent.

The inventory lists managed hosts and groups; it can be a static INI/YAML file or produced by a dynamic inventory plugin at runtime.

ansible.cfg search order: ANSIBLE_CONFIG environment variable, then ./ansible.cfg, then ~/.ansible.cfg, then /etc/ansible/ansible.cfg; the first file found is used.

Modules are the units of work; ansible-doc -l lists installed modules and ansible-doc displays parameters and examples.

Collections bundle modules, roles, and plugins under a namespace; the fully qualified collection name form is namespace.collection.module (for example ansible.builtin.copy).

Idempotence means repeated execution reaches the same end state; a module reports changed only when it actually modifies the target.

Facts are gathered by the setup module into the ansible_facts dictionary and are available as variables during a play; gather_facts: false disables collection.

Privilege escalation uses become: true with optional become_user (default root) and become_method (default sudo) at play, block, or task level.

ansible-core is the minimal engine with builtin modules; on RHEL install with dnf install ansible-core, then confirm with ansible --version.

The control node requires Python 3; Ansible cannot run as a control node on Windows.

Main ansible.cfg sections: [defaults] for inventory and forks, [privilege_escalation] for become settings, [ssh_connection] for SSH behavior.

Default inventory path is /etc/ansible/hosts; override per run with -i or permanently with the inventory setting in [defaults].

SSH key authentication is set up with ssh-keygen and ssh-copy-id; host_key_checking = False suppresses the first-connection key prompt.

ansible-config init --disabled generates a fully commented sample ansible.cfg; ansible-config view shows the active file and ansible-config dump shows effective settings.

ansible-galaxy install -r requirements.yml installs listed roles or collections with pinned versions for reproducible control-node setup.

ansible-navigator runs playbooks inside execution environments-container images bundling ansible-core, collections, and Python dependencies.

Managed node prerequisites: an SSH server, a Python interpreter, and a login user able to escalate privileges for system-level tasks.

Ad hoc syntax: ansible -m -a "" [-i inventory] [-u user] [-b]; -b enables become for that command.

ansible all -m ping verifies SSH connectivity and Python availability; the ping module uses the Ansible connection, not ICMP.

ansible -m setup gathers facts; add -a "filter=ansible_distribution*" to limit returned fact names.

copy transfers files from control node to target using src and dest; content= writes inline text instead of a source file.

file manages existence and attributes: state=directory, state=touch, state=absent, with mode, owner, and group parameters.

user and group modules manage accounts; user supports name, state, groups, append, shell, and password.

package/dnf handles software with name and state=present|absent; systemd/service controls units with name, state, and enabled.

Patterns include all, a group name, a hostname, wildcards, and set operations using : (union), & (intersection), and ! (exclusion); --limit restricts a run further.

A playbook is a YAML list of plays; play keywords include name, hosts, become, vars, vars_files, tasks, handlers, and roles.

Handlers are triggered by notify from changed tasks and run once at the end of the play; meta: flush_handlers forces them to run immediately.

Variable precedence, low to high: role defaults, inventory group_vars, host_vars, play vars, task vars, then extra vars (-e), which override everything.

Custom facts placed in /etc/ansible/facts.d/*.fact are returned under ansible_facts.ansible_local and referenced as ansible_local...

set_fact creates or updates a host variable during the play; register stores a task result whose fields (stdout, rc, changed, failed) can be tested later.

when evaluates a Jinja2 expression without braces and runs the task only if true; it can reference facts, variables, and registered results.

loop repeats a task for each list element, exposing item; loop_control label shortens output for complex items.

Role layout: tasks/main.yml, handlers/main.yml, defaults/main.yml (lowest precedence), vars/main.yml, files/, templates/, and meta/main.yml; ansible-galaxy init scaffolds it.

Tags assigned to tasks or plays are selected with --tags and excluded with --skip-tags; --list-tags previews available tags.

authorized_key manages SSH public keys for a user with user, key, and state parameters, making key distribution repeatable.

Storage automation uses parted for partitions, lvg for volume groups, lvol for logical volumes, filesystem to create filesystems, and mount to write /etc/fstab.

mount parameters: path, src, fstype, opts, and state=present (fstab only), mounted (fstab plus active mount), or absent.

firewalld module manages rules by service or port with zone, permanent, immediate, and state=enabled|disabled.

SELinux is managed with the selinux module for policy state/mode and seboolean (ansible.posix) for booleans; changes may require a reboot or reload.

cron schedules recurring jobs using name, minute, hour, day, month, weekday, user, and job; state=absent removes the named entry.

template renders a Jinja2 file from templates/ to the managed node with owner, group, and mode; a changed result can notify a service restart handler.

yum_repository defines package repositories and dnf/yum installs packages; package is a generic module that selects the OS-appropriate package manager.