Ansible Overview

Ansible handles day-2 configuration management and lifecycle operations — anything that's not a one-time provisioning step (that's Terraform/Packer's job) but also isn't GitOps-managed application state (that's ArgoCD's job).

Official download

Ansible releases — installed via pip3 install ansible in install_dev_tools.sh, which always pulls current.

Inventory (ansible/hosts)

Groups map to real infrastructure roles, not abstract environments:

Group	Members
master / workers	An older/parallel Kubernetes cluster (k8s-master, k8s-worker-1/2)
nas	truenas (main)
truenas_dr	truenas-dr
esxi	All ESXi hosts
vcsa	vCenter
pfsense	The router
unifi-os	UniFi controller
aks	Azure AKS nodes (via az.devhome.cloud DNS)
win	Windows hosts (WinRM connection, not SSH)
old-mac / new-mac / Surface / PWC-laptop	Personal dev machines

Most hosts connect via SSH with ansible_user set per-group; Windows hosts use ansible_connection=winrm. Inventory uses DNS names, never inline IPs — a rule learned the hard way when IPs went stale across the network redesign.

Key playbooks

See Playbook Reference for the full list. The two most operationally important:

• start-cluster.yml / stop-cluster.yml — the supported way to power the whole dke-mgmt ESXi host and its VMs up/down (Wake-on-LAN + graceful VM/host shutdown), used far more often than a cold reboot. A reboot done outside this pair (e.g. directly in vCenter) is more likely to hit the DHCP-lease-change failure mode — see Kubernetes Troubleshooting.
• backup-playbook.yml — nightly config backups across NAS, UniFi, pfSense, and TrueNAS-DR, driven by an Azure DevOps pipeline running on the self-hosted agent (see Self-Hosted Azure DevOps Agent).

ANSIBLE_HOST_KEY_CHECKING

CI runs (the ADO pipeline) set ANSIBLE_HOST_KEY_CHECKING: 'false' — hosts get rebuilt/reinstalled often enough in a homelab that host-key churn is expected, not a security event worth failing a pipeline over.