Connection Plugins

A connection plugin is how Ansible actually reaches a managed node before any module runs — the transport underneath every task. The default is ssh, which shells out to your system's OpenSSH binary and gets ControlPersist multiplexing for free. The alternatives exist for the cases OpenSSH can't cover: a Python-native SSH client, no network hop at all, Windows, and network gear that has no concept of running a Python module.

You pick one per host with ansible_connection, and the right choice is ssh far more often than not. The point of knowing the others is recognizing the narrow situations that force them — a controller-side play, a Windows box, a switch with no Python — so you reach for the right transport instead of bending ssh onto a host it can't serve.

ssh — the Default Transport

For the Larkspur Linux fleet, Ansible invokes the local OpenSSH client. That means it inherits everything your interactive SSH already knows: ~/.ssh/config, agent forwarding, jump hosts, and crucially ControlPersist connection multiplexing, which keeps one SSH master open and reuses it across tasks. This is why ssh is both the default and the fast path — a 40-task play against a host opens the connection once, not forty times, because OpenSSH holds the master socket open between tasks.

paramiko — the Python SSH Fallback

paramiko is a pure-Python SSH implementation Ansible bundles for environments without a usable OpenSSH binary, or where its older SSH behavior is specifically needed. It speaks SSH like the default does, but it does not do OpenSSH-style ControlPersist, so every task pays a fresh handshake and the whole run is slower. You reach for it only when ssh genuinely can't run — a stripped-down control node with no OpenSSH client, for instance — and you accept the loss of multiplexing as the cost.

local — No Network at All

ansible_connection: local runs tasks directly on the control node with no SSH hop. This is how you target localhost for work that belongs on the controller: rendering a template, calling a cloud API, or any task behind delegate_to: localhost in the middle of a play. It is a real connection type, not a no-op — Ansible still runs the module, it just runs it in a local process instead of copying it over a wire. Skipping the SSH round-trip is both faster and free of any dependency on an SSH daemon being reachable on the controller.

winrm — Windows Targets

Windows nodes are reached over WinRM, not SSH, with ansible_connection: winrm and a Windows-specific module set. This is a brief mention for the Larkspur book, which is Linux-first — the fleet is Ubuntu, and Windows is a different transport, different authentication, and entirely different modules. The takeaway is that "agentless over SSH" is the Linux story; Windows is reached over its own management protocol, and the apt and systemd modules you have been writing don't apply there.

network_cli and the Network Family

Network devices — routers, switches — run no Python and can't host a copied module the way a server does. So ansible.netcommon.network_cli drives them over an interactive CLI session instead, sending commands and reading responses as if a person were typing at the device's prompt. This is the reason "agentless over SSH" stretches to gear that isn't a server at all: the connection plugin adapts to a device that can run a CLI but not a Python module, and a whole family of network connection plugins covers the variations.

Selecting the Connection

You set ansible_connection in inventory, in group_vars, or on a play, and it picks the plugin per host. The defaults are sensible: a normal host defaults to ssh, and localhost defaults to local, so controller-side work usually needs no override at all. You override only for the specific cases above — paramiko when OpenSSH is absent, winrm for Windows, network_cli for devices — leaving the bulk of the fleet on the ssh default it should be on.

all:
  children:
    web:            # the Larkspur Linux fleet — ssh is the default, no override needed
      hosts:
        web0[1:6].prod.larkspur.io:
    controller:
      hosts:
        localhost:
          ansible_connection: local
    edge_switches:
      hosts:
        sw0[1:2].prod.larkspur.io:
      vars:
        ansible_connection: ansible.netcommon.network_cli

The web group carries no ansible_connection because ssh is already what it should be. localhost is pinned to local so controller-side tasks skip SSH, and the switches are pinned to network_cli because they can't run a copied module. The override appears exactly where the default is wrong, and nowhere else.