Chapter Thirteen

Extending Ansible & Automation at Scale

When no module fits, you write one; when no transform fits, you write a plugin. Then the same plays move off laptops into versioned execution environments, run through ansible-navigator and Ansible Automation Platform, and flow from a git merge through CI — and the book closes by placing Ansible beside Terraform across the state boundary.

7 topics

Everything before this chapter used Ansible as it ships. This one is about the seams: where you extend Ansible past its built-in modules and plugins, and where you stop running it from a terminal and run it as governed automation. The two halves meet at the Larkspur fleet, which now stops deploying from engineers' laptops and starts deploying from Ansible Automation Platform — job templates, surveys, and role-based access, every run inside a containerized execution environment that pins the exact toolchain.

Custom modules and plugins come first, because extension is what keeps "no module exists" from becoming "we gave up on idempotency." Then the scale story: execution environments freeze the toolchain into an image, ansible-navigator runs that image locally so the laptop matches production, AWX and AAP add the controller, and CI plus GitOps wire a merge to a converge. The final topic settles the question the whole book has circled — Terraform provisions with state, Ansible configures without it, and together they cover the stack.

Topics in This Chapter

Topic 75
Writing Custom Modules
A small program Ansible ships to the node, taking JSON in and returning JSON out. The module contract, AnsibleModule and argument_spec, why changed is yours to enforce, check_mode, and when a module moves from library/ into a collection.
ExtendingModules
Topic 76
Custom Plugins
Filter, lookup, and callback plugins run in the Ansible process on the control node, not on the target. Where the plugin-vs-module line falls, which type transforms data, which fetches it, which reacts to events, and how each is discovered.
ExtendingPlugins
Topic 77
Execution Environments
A container image bundling ansible-core, collections, and Python dependencies into one versioned toolchain. The drift problem it kills, what ansible-builder reads, why the image is pinned, and why AAP runs every job inside one.
ScalePackaging
Topic 78
ansible-navigator
The modern runner that executes plays inside an execution environment by default. EE-first execution, the interactive TUI for drilling into one task's result, and the bridge that makes "it passes for me" mean what the controller runs.
ToolingScale
Topic 79
AWX and Ansible Automation Platform
The controller — a web UI and API over ansible-core with job templates, surveys, RBAC, scheduling, and an audit log. What a job template binds, how credentials stay out of users' hands, and what separates open-source AWX from the AAP product.
ControllerGovernance
Topic 80
Ansible in CI/CD and GitOps
At scale, a run starts from a git merge, not a person at a terminal. Lint and check in CI, the privileged converge launched in the controller, git as the source of truth, webhook and schedule triggers, and the approval gate before prod.
PipelineGitOps
Topic 81
Where Ansible Fits
The closing map. Terraform owns the infrastructure lifecycle with state; Ansible owns configuration without it. The combined pipeline through dynamic inventory, when each tool stands alone, and where the state file draws the boundary.
Comparison