Inventory, groups, and variables

Inventory formats

An inventory can be INI, YAML, or a dynamic plugin. -i inventory.ini selects a source explicitly; if omitted, Ansible uses configured inventory, which may not contain the lab hosts. Setting inventory = ./inventory.ini in the project's ansible.cfg removes the need to type -i every time.

[web]
web1 ansible_host=192.0.2.10 ansible_user=ubuntu
web[02:03].example.com

[db]
db1.example.com

[production:children]
web
db

[production:vars]
http_port=80

web[02:03].example.com is a range that expands to two hosts. Every host also belongs to the built-in group all, and hosts outside any group are in ungrouped.

flowchart LR
  I["inventory.ini<br/>or YAML"] --> G1["[web]<br/>web1 web2"]
  I --> G2["[db]<br/>db1"]
  GV["group_vars/web.yml<br/>http_port: 80"] --> G1
  HV["host_vars/db1.yml<br/>ansible_host"] --> G2
  G1 --> PAT["-l web<br/>host pattern"]
  %% step I: An inventory file lists hosts, in INI or YAML format.
  %% step G1: Hosts are grouped, for example all web servers.
  %% step G2: A host can belong to several groups.
  %% step GV: Group variables apply to every host in the group.
  %% step HV: Host variables override them for one host, such as its real address.
  %% step PAT: Patterns and --limit choose which hosts a run touches; check with ansible-inventory --graph.

Variables and where to keep them

One host may belong to several groups and receive variables from several sources. Precedence determines the final value; avoid defining the same setting in many places without a reason. For anything beyond a few variables, use directories next to the inventory: group_vars/web.yml applies to the group and host_vars/web1.yml to one host. These files are easier to review than long inventory lines.

Variable	Meaning
`ansible_host`	Actual connection address
`ansible_user`	Remote login user
`ansible_port`	SSH or transport port
`ansible_connection`	Connection plugin, usually `ssh`
`ansible_ssh_private_key_file`	Private-key path
`ansible_become`	Privilege escalation

Do not store plaintext passwords in inventory. Use SSH keys, Vault, or the credential mechanism of an automation controller.

Host patterns

A pattern chooses which hosts a command or play targets: web is one group, web:db is the union, production:&web is the intersection, and all:!db excludes a group. --limit web1 narrows any run to a subset, a safe habit when testing a change.

Dynamic inventory

In the cloud, servers appear and disappear, so a static file goes stale. Inventory plugins such as amazon.aws.aws_ec2 or azure.azcollection.azure_rm query the provider's API and build groups from tags or regions on every run.

Inspect before running

ansible-inventory -i inventory.ini --graph shows group hierarchy; --list emits parsed inventory for debugging variables and hosts. ansible-inventory --host web1 prints the final variables for one host after precedence is applied.