Ansible in CI/CD Pipelines

Advanced15 minTrending

Integrate Ansible playbooks into GitHub Actions, GitLab CI, or Jenkins pipelines for automated infrastructure deployment on every push.

Prerequisites

-Ansible installed
-CI/CD platform access
-Vault password or secrets management
-SSH key for target hosts

Steps

Create a requirements file for CI

Pins all role and collection dependencies so CI installs are reproducible.

$ cat > requirements.yml << 'EOF' --- collections: - name: community.general - name: ansible.posix roles: - name: geerlingguy.docker EOF

Create a GitHub Actions workflow

Triggers deployment only when Ansible files change on the main branch.

$ mkdir -p .github/workflows && cat > .github/workflows/deploy.yml << 'EOF' name: Deploy Infrastructure on: push: branches: [main] paths: ["ansible/**"] jobs: deploy: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Install Ansible run: pip install ansible - name: Install dependencies run: ansible-galaxy install -r requirements.yml - name: Run playbook run: ansible-playbook site.yml -i inventory.ini env: ANSIBLE_VAULT_PASSWORD: ${{ secrets.VAULT_PASSWORD }} ANSIBLE_HOST_KEY_CHECKING: "false" EOF

Store the vault password and SSH private key as GitHub repository secrets.

Never commit vault passwords or SSH keys to version control.

Configure SSH key for CI

Writes the SSH private key from a CI secret to the runner filesystem.

$ mkdir -p ~/.ssh && echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa && chmod 600 ~/.ssh/id_rsa

Run a syntax check in CI

Validates playbook syntax without executing anything. Catches YAML errors early in the pipeline.

$ ansible-playbook site.yml --syntax-check

Run in check mode as a CI gate

Shows what changes would be made without applying them. Useful as a pull request validation step.

$ ansible-playbook site.yml --check --diff

Lint playbooks with ansible-lint

Runs ansible-lint to catch best practice violations and potential issues before deployment.

$ pip install ansible-lint && ansible-lint site.yml roles/

Full Script

full-script.sh

# Ansible CI/CD integration
pip install ansible ansible-lint
ansible-galaxy install -r requirements.yml
ansible-lint site.yml roles/
ansible-playbook site.yml --syntax-check
ansible-playbook site.yml --check --diff
# Full deploy (only in main branch CI)
ansible-playbook site.yml -i inventory.ini

FAQ

Discussion

Loading comments...

# Ansible CI/CD integration pip install ansible ansible-lint ansible-galaxy install -r requirements.yml ansible-lint site.yml roles/ ansible-playbook site.yml --syntax-check ansible-playbook site.yml --check --diff # Full deploy (only in main branch CI) ansible-playbook site.yml -i inventory.ini