Capstone: A Complete Ansible-Based Configuration Deployment

switches:
hosts:
  SW1:
    ansible_host: 10.10.10.1
  SW2:
    ansible_host: 10.10.10.2
  SW3:
    ansible_host: 10.10.10.3
  SW4:
    ansible_host: 10.10.10.4
  SW5:
    ansible_host: 10.10.10.5
vars:
  ansible_network_os: ios
  ansible_connection: network_cli

Unchanged from Lesson 3 — the same 5-device fleet, translated from devices.csv.

vlans_by_host:
SW1:
  - { id: 10, name: USERS }
  - { id: 20, name: VOICE }
SW2:
  - { id: 10, name: USERS }
SW3:
  - { id: 10, name: USERS }
  - { id: 30, name: MGMT }
SW4:
  - { id: 10, name: USERS }
SW5:
  - { id: 10, name: USERS }

The exact REQUIRED_VLANS data from Configuration & Template Automation's capstone, unchanged — SW3 needs two VLANs, the rest need one each. Only the file format changed, from a Python dict to a YAML variables file.

- name: Deploy required VLAN configuration
hosts: switches
gather_facts: false

vars:
  required_vlans: "{{ vlans_by_host[inventory_hostname] }}"

tasks:
  - name: Render this device's VLAN configuration
    ansible.builtin.template:
      src: templates/vlan_config.j2
      dest: "/tmp/{{ inventory_hostname }}_vlans.cfg"
    delegate_to: localhost

  - name: Apply required VLANs
    cisco.ios.ios_config:
      lines:
        - "vlan {{ item.id }}"
        - "name {{ item.name }}"
      parents: "vlan {{ item.id }}"
    loop: "{{ required_vlans }}"

inventory_hostname is Ansible's built-in variable for 'whichever host this task is currently running for' — it's what makes vlans_by_host[inventory_hostname] pick out each device's own VLANs automatically, once per host in the switches group. delegate_to: localhost means the template renders on your machine, not on the switch itself — switches don't have a filesystem for Jinja2 to write to the way a Linux control node does.

$ ansible-playbook -i inventory.yml deploy_vlans.yml --check --diff

TASK [Apply required VLANs] **********************************************
--- before
+++ after
@@ -1,3 +1,5 @@
!
+vlan 20
+ name VOICE
changed: [SW2] => (item={'id': 20, 'name': 'VOICE'})
ok: [SW1] => (item={'id': 10, 'name': 'USERS'})
ok: [SW1] => (item={'id': 20, 'name': 'VOICE'})
...

PLAY RECAP ******************************************************************
SW1 : ok=2 changed=0 unreachable=0 failed=0 skipped=0
SW2 : ok=1 changed=1 unreachable=0 failed=0 skipped=0
SW3 : ok=1 changed=1 unreachable=0 failed=0 skipped=0
SW4 : ok=1 changed=0 unreachable=0 failed=0 skipped=0
SW5 : ok=1 changed=0 unreachable=0 failed=0 skipped=0

This describes Ansible's own documented check-mode/diff output for this exact data — SW1 already has both required VLANs (changed=0), SW2 and SW3 each need one new VLAN (changed=1), matching Configuration & Template Automation's own already-compliant / needs-change split for the same devices under DRY_RUN=True.