Roles, Galaxy, and automation controller

Roles

A role standardizes directories for tasks, handlers, templates, files, defaults, variables, and metadata. A play invokes roles with roles:; roles split a large playbook into units with clear variable interfaces.

roles/web/
├── defaults/main.yml     # low-precedence settings users may override
├── vars/main.yml         # internal values, high precedence
├── handlers/main.yml
├── tasks/main.yml
├── templates/nginx.conf.j2
├── files/
└── meta/main.yml         # dependencies and supported platforms

Put anything a caller might want to change in defaults/, because those values are the easiest to override from inventory or the play. Name role variables with the role as prefix, such as web_port, to avoid collisions.

flowchart LR
  GAL["Ansible Galaxy<br/>collections"] --> ROLE["Role: nginx<br/>tasks, templates, defaults"]
  ROLE --> PB["site.yml<br/>roles: [nginx]"]
  VAULT["Ansible Vault<br/>encrypted vars"] --> PB
  PB --> AAP["Automation controller<br/>RBAC, schedules, logs"]
  AAP --> HOSTS["Managed hosts"]
  %% step GAL: Galaxy and collections share ready-made roles and modules; pin their versions.
  %% step ROLE: A role packages tasks, handlers, templates and defaults in a standard layout.
  %% step PB: Playbooks stay short by calling roles.
  %% step VAULT: Secrets are encrypted with ansible-vault instead of stored in plain text.
  %% step AAP: Automation controller (Tower/AWX) adds access control, schedules and an audit log.
  %% step HOSTS: The same reviewed code reaches every host the same way.

Galaxy and collections

Ansible Galaxy is a repository ecosystem and CLI for initializing, searching, installing, or publishing roles and collections. ansible-galaxy role init web creates a local skeleton; role install namespace.name downloads a role. ansible-galaxy collection install community.general installs a collection of modules.

List a project's dependencies in requirements.yml and install them with ansible-galaxy install -r requirements.yml, so every teammate and CI job uses the same versions.

Secrets with Ansible Vault

ansible-vault create secrets.yml or ansible-vault encrypt vars.yml stores variables encrypted in the repository. Run the playbook with --ask-vault-pass or a password file kept outside Git. Vault protects files at rest; anyone with the vault password can still read them.

Automation controller

Ansible Tower is the former product name; Red Hat Ansible Automation Platform now provides automation controller. AWX is the upstream project. A controller adds UI and API access, RBAC, credentials, schedules, workflows, inventory synchronization, and audit, while still running playbooks rather than replacing them.

Quality

Molecule can test a role by applying it to a throwaway container and checking the result, and ansible-lint catches style issues before review. Before using a community role, review its source, supported platforms, variables, dependencies, and release history.