Ansible architecture and concepts: control node, inventory, modules and idempotency
In short: Ansible is an agentless automation tool. A control node reads an inventory of devices and playbooks of tasks, then uses modules over SSH or APIs to bring each device to the desired state. Well-written tasks are idempotent: running them again changes nothing.
What Ansible is
Ansible is an open-source automation tool for configuring servers, network devices and cloud services. You describe the state you want in YAML (a human-readable data format) and Ansible works out what to change. It is agentless: nothing needs to be installed on the devices you manage. It connects over SSH for Linux and network devices, WinRM or SSH for Windows, and HTTPS APIs for cloud platforms and some network operating systems.
The open-source engine is called ansible-core. The larger ansible package bundles ansible-core with a curated set of collections, which is usually what you install with pip install ansible on a lab machine.
The main building blocks
| Term | Meaning | Example |
|---|---|---|
| Control node | The Linux or macOS machine where Ansible runs | Your automation VM or a CI runner |
| Managed node | A device Ansible configures | A switch, a web server |
| Inventory | A list of managed nodes, grouped, with variables | inventory.yml |
| Module | A unit of work with parameters | ansible.builtin.copy, cisco.ios.ios_vlans |
| Task | One call to a module | "Ensure VLAN 20 exists" |
| Playbook | An ordered list of plays and tasks | site.yml |
| Collection | A package of modules, plugins and roles | cisco.ios, arista.eos |
Modules are named with a fully qualified collection name (FQCN) such as ansible.builtin.service. Using the full name avoids confusion when two collections contain modules with the same short name.
Idempotency: the key idea
An idempotent task can run many times and only makes a change when the device is not already in the desired state. A task that says "VLAN 20 named USERS must exist" checks first: if the VLAN is there with the right name, it reports ok; if not, it creates it and reports changed. This is why you can run the same playbook every night to correct drift without harming devices that are already right.
ansible all -i inventory.yml -m ansible.builtin.ping # test connectivity to servers
ansible switches -i inventory.yml -m cisco.ios.ios_facts # gather facts from IOS switches
ansible-playbook -i inventory.yml site.yml --check --diff # preview changesBe careful with modules that send raw commands, such as ansible.builtin.command, ansible.builtin.shell or cisco.ios.ios_command. They are not idempotent by themselves and will report changes every time unless you add conditions. Prefer purpose-built modules where they exist.
Servers versus network devices
For a Linux server, Ansible copies a small Python program to the host, runs it and removes it. Network devices usually cannot run Python, so network modules run on the control node and talk to the device using a connection plugin: ansible.netcommon.network_cli for CLI over SSH, ansible.netcommon.netconf for NETCONF and ansible.netcommon.httpapi for REST APIs. You tell Ansible which one to use with the ansible_connection and ansible_network_os variables.
Tip: build a small lab with two or three virtual switches before automating real devices. Ansible questions in network automation interviews often start with "what does idempotent mean?" and "why is Ansible called agentless?".
Practice
Why is Ansible described as agentless?
A task reports ok on the second run. What does that tell you?
Where do network modules usually execute?
Key takeaways
- Ansible is agentless and describes desired state in YAML.
- Control node, inventory, modules, playbooks and collections are the core parts.
- Idempotent tasks only change what is not already correct.
- Use fully qualified collection names for modules.
- Network modules run on the control node via network_cli, netconf or httpapi.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.