· about 35 minutes · runs on ubuntu-26.04-devops · unrated
An unrated lab. It runs on your machine with no account and no network, and everything about it — the faults, the checks, the hints and the reference solution — is in the repository. An attempt on it is recorded on your profile and never moves a rating: only rated labs do. Rated and unrated labs.
/srv/ansible holds the playbook that configures this machine as an application host: an app
account, the application in /opt/app, its configuration in /etc/app/app.conf, the app systemd
service, and IP forwarding for the containers it will run.
cd /srv/ansible && sudo ansible-playbook site.yml
Every run reports most tasks as changed, restarts the application whether or not anything
changed, and grows a file a little. --check is useless: it skips half the tasks. And the
application listens on 8080 although the inventory for the app group says 8081.
What is expected, and graded:
ansible-playbook site.yml --check runs every task — none skipped — and finds
nothing to change.The grader runs the playbook in check mode only; it never applies it for you. You have root through
sudo. There is no internet access, and none is needed.
The machine is checked, rebooted, and checked again. A check passes only if it passes both times.
| Check | Objective |
|---|---|
| 01_app_on_the_inventory_port | Know where a variable's value comes from, and set it where it belongs |
| 02_forwarding_configured_once | Describe state with modules, so a playbook converges and a second run changes nothing |
| 03_check_mode_finds_nothing_to_do | Describe state with modules, so a playbook converges and a second run changes nothing |
Where the lab's hints send you, level by level, as you ask for them (h, then l opens a journal section in the TUI).
4 questions on the same topic, in the lab's Theory tab. They never affect the lab's grade. Three of them, to answer here:
A task is `ansible.builtin.shell: echo "x=1" >> /etc/app.conf`. What happens on the third run?
It appends a third line and reports changed
Ansible cannot know what a shell command does, so the command runs every time and the task reports changed. An append adds a line on each run. copy with content (or template) describes the file instead and converges.
https://docs.ansible.com/ansible/latest/collections/ansible/builtin/shell_module.html
A variable is set in inventory `group_vars/app.yml`, in the play's `vars:`, and with `-e` on the command line. Which value do tasks see, and which would they see without `-e`?
The -e value; without it, the play vars value
Extra vars always win. Below them, play vars outrank inventory group_vars and host_vars, so a play-level vars block silently overrides per-group inventory settings.
https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_variables.html#understanding-variable-precedence
What does `skipped=4` in the recap of `ansible-playbook site.yml --check` usually mean when no task has a `when:` condition?
Four tasks, typically command or shell, cannot be simulated, so the preview did not cover them
Modules without check-mode support are skipped in check mode. Tasks already in the desired state report ok, unreachable hosts are counted separately, and handlers that were not notified do not appear at all.
https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_checkmode.html