Ansible inventories, groups and variables

What an inventory does

The inventory is Ansible's list of managed devices. It answers three questions: which hosts exist, how to connect to each one, and which groups they belong to. Groups let you target "all access switches" or "everything at the HQ site" without listing devices by hand. Every host is automatically in the group all.

A YAML inventory

Inventories can be INI or YAML. YAML is clearer once you have nested groups, so most teams use it.

# inventory.yml
all:
  children:
    switches:
      children:
        core:
          hosts:
            core-sw1: { ansible_host: 192.168.10.2 }
            core-sw2: { ansible_host: 192.168.10.3 }
        access:
          hosts:
            acc-sw1:  { ansible_host: 192.168.10.11 }
            acc-sw2:  { ansible_host: 192.168.10.12 }
    site_hq:
      children:
        core:
        access:

Check how Ansible sees it with ansible-inventory -i inventory.yml --graph, and list the variables for one host with ansible-inventory -i inventory.yml --host acc-sw1.

group_vars and host_vars

Rather than cramming variables into the inventory, put them in folders next to it. Ansible loads them automatically by matching file names to group and host names.

inventory.yml
group_vars/
  switches.yml      # connection settings for all switches
  site_hq.yml       # NTP, syslog and DNS servers for HQ
host_vars/
  core-sw1.yml      # loopback, router ID, unique items

# group_vars/switches.yml
ansible_connection: ansible.netcommon.network_cli
ansible_network_os: cisco.ios.ios
ansible_user: netops
ansible_become: true
ansible_become_method: enable

# group_vars/site_hq.yml
ntp_servers: [192.168.10.5, 192.168.10.6]
syslog_server: 192.168.10.20

Passwords do not belong in these files in plain text. Store them encrypted with Ansible Vault, or use SSH keys, and reference them by variable name.

Variable precedence

Ansible has more than twenty levels of precedence, but the practical rule is simple: specific beats general. A value in host_vars/acc-sw1.yml overrides the same variable in group_vars/switches.yml, which overrides group_vars/all.yml. Values passed with -e on the command line override everything. When a host is in two groups at the same level that set the same variable, the result depends on group ordering, which is confusing; avoid this by giving each variable one clear home.

As a network grows, maintaining a static file by hand becomes error-prone. Generating the inventory from a source of truth such as NetBox means devices added there are automatically managed by your playbooks.

Tip: name groups by role (core, access, wan_edge) and by location (site_hq, site_branch1). Most tasks target one of these two dimensions.