Chapter 79: DevOps Projects Part 9: Ansible Nginx Roles Vault Patch Inventory Agents

79.6 Project 66: Configure Jenkins agents with Ansible

By Ravindra Bagale Last updated: 28 October 2026

Friends, snowflake agents break CI. Today we write a jenkins_agent role with JDK, Docker and git, add the master SSH key, apply to agent hosts, and run smoke tests.

What you will build in this project

Agent role defaults and tasks.
Docker group membership.
Master authorized_key.
Smoke tests and Jenkins node notes.

1. Start from a real company story

At Infosys in Pune, three Jenkins agents had different JDKs and a Maven job passed on one agent and failed on another.

Rough delay: about ₹8 lakh in release slip and retests that sprint.

Leena made an Ansible jenkins_agent role the only way to build agents.

Today we build that role.

Picture 1: site.yml → jenkins_agent role → agent01/agent02 → Jenkins SSH node

Ravindra Bagale's Tip

Students add the jenkins user to docker with a world-writable docker.sock workaround. Fix group membership instead. Keep that habit.

2. Start and prepare

Step 1: Why agent roles

Why: Jenkins agents must match. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo why. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 1: a1

Type this:

echo 'Agents need JDK, docker CLI, and the same tools as CI jobs'

You will see:

Agents need JDK, docker CLI, and the same tools as CI jobs

What it means: Why.

Example 2: a2

Type this:

mkdir -p /tmp/ans66/roles/jenkins_agent/{tasks,defaults,files} && echo 'Ansible keeps every agent identical'

You will see:

Ansible keeps every agent identical

What it means: Idea.

Example 3: a3

Type this:

echo 'Today: agent role, docker group, jenkins user, smoke tests'

You will see:

Today: agent role, docker group, jenkins user, smoke tests

What it means: Scope.

Step 2: Defaults

Why: Agent package list. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: defaults. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 4: b1

Type this:

printf '%s\n' '---' 'agent_packages:' '  - openjdk-17-jdk' '  - git' '  - curl' '  - unzip' '  - docker.io' 'jenkins_user: jenkins' > /tmp/ans66/roles/jenkins_agent/defaults/main.yml && cat /tmp/ans66/roles/jenkins_agent/defaults/main.yml

You will see:

- docker.io

What it means: Defaults.

Example 5: b2

Type this:

echo 'Pin versions in prod with apt package=version when required'

You will see:

Pin versions in prod with apt package=version when required

What it means: Pin tip.

Example 6: b3

Type this:

echo 'Separate agent_packages for linux/arm if you mix architectures'

You will see:

Separate agent_packages for linux/arm if you mix architectures

What it means: Arch tip.

Step 3: Install tasks

Why: Packages and docker. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: tasks. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 7: c1

Type this:

printf '%s\n' '---' '- name: Install agent packages' '  apt:' '    name: "{{ agent_packages }}"' '    state: present' '    update_cache: true' '- name: Ensure docker started' '  service: { name: docker, state: started, enabled: true }' > /tmp/ans66/roles/jenkins_agent/tasks/main.yml && cat /tmp/ans66/roles/jenkins_agent/tasks/main.yml

You will see:

- name: Install agent packages

What it means: Tasks.

Example 8: c2

Type this:

printf '%s\n' '- name: Create jenkins user' '  user:' '    name: "{{ jenkins_user }}"' '    groups: docker' '    append: true' '    shell: /bin/bash' '    create_home: true' >> /tmp/ans66/roles/jenkins_agent/tasks/main.yml && tail -7 /tmp/ans66/roles/jenkins_agent/tasks/main.yml

You will see:

groups: docker

What it means: Docker group.

Example 9: c3

Type this:

echo 'New group membership needs a fresh SSH session for docker'

You will see:

New group membership needs a fresh SSH session for docker

What it means: Session tip.

3. Build the main pieces

Step 4: SSH key for agent

Why: Jenkins master connects. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: authorized_key. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 10: d1

Type this:

printf '%s\n' '- name: Install master public key' '  authorized_key:' '    user: "{{ jenkins_user }}"' '    key: "{{ lookup(\'file\', \'files/jenkins_master.pub\') }}"' >> /tmp/ans66/roles/jenkins_agent/tasks/main.yml && tail -4 /tmp/ans66/roles/jenkins_agent/tasks/main.yml

You will see:

authorized_key:

What it means: Key task.

Example 11: d2

Type this:

printf '%s\n' 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILabOnlyFakeKeyDoNotUseInProd jenkins@master' > /tmp/ans66/roles/jenkins_agent/files/jenkins_master.pub && cat /tmp/ans66/roles/jenkins_agent/files/jenkins_master.pub

You will see:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILabOnlyFakeKeyDoNotUseInProd jenkins@master

What it means: Lab pubkey.

Example 12: d3

Type this:

echo 'Replace the lab pubkey with the real master key fingerprint-checked'

You will see:

Replace the lab pubkey with the real master key fingerprint-checked

What it means: Prod tip.

Step 5: site agents

Why: Apply role. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: site.yml. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 13: e1

Type this:

printf '%s\n' '---' '- name: Configure Jenkins agents' '  hosts: role_jenkins_agent' '  become: true' '  roles:' '    - jenkins_agent' > /tmp/ans66/site.yml && cat /tmp/ans66/site.yml

You will see:

- jenkins_agent

What it means: site.

Example 14: e2

Type this:

printf '%s\n' '[role_jenkins_agent]' 'agent01 ansible_host=10.0.3.11' 'agent02 ansible_host=10.0.3.12' > /tmp/ans66/hosts.ini && cat /tmp/ans66/hosts.ini

You will see:

agent02 ansible_host=10.0.3.12

What it means: Hosts.

Example 15: e3

Type this:

echo 'Or reuse aws_ec2 group role_jenkins_agent from project 65'

You will see:

Or reuse aws_ec2 group role_jenkins_agent from project 65

What it means: Dynamic tip.

Step 6: Smoke tests

Why: Prove the agent. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: commands. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 16: f1

Type this:

echo 'java -version'

You will see:

java -version

What it means: Java.

Example 17: f2

Type this:

echo 'docker run --rm hello-world'

You will see:

docker run --rm hello-world

What it means: Docker.

Example 18: f3

Type this:

echo 'git --version && which curl'

You will see:

git --version && which curl

What it means: Git curl.

4. Automate and verify

Step 7: Jenkins node form

Why: Connect from UI tip. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: notes. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 19: g1

Type this:

printf '%s\n' 'In Jenkins: Manage Nodes -> New node' 'Remote root: /home/jenkins/agent' 'Launch via SSH using the master key' > /tmp/ans66/JENKINS-NODE.txt && cat /tmp/ans66/JENKINS-NODE.txt

You will see:

Launch via SSH using the master key

What it means: UI tip.

Example 20: g2

Type this:

echo 'Label agents as docker && jdk17 for job targeting'

You will see:

Label agents as docker && jdk17 for job targeting

What it means: Labels.

Example 21: g3

Type this:

echo 'Keep one warm agent per availability zone for critical jobs'

You will see:

Keep one warm agent per availability zone for critical jobs

What it means: HA tip.

Step 8: Idempotent rerun

Why: Second apply clean. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: rerun. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 22: h1

Type this:

echo 'ansible-playbook -i hosts.ini site.yml'

You will see:

ansible-playbook -i hosts.ini site.yml

What it means: Apply.

Example 23: h2

Type this:

echo 'Second run should report changed=0 on packages already present'

You will see:

Second run should report changed=0 on packages already present

What it means: Idempotent.

Example 24: h3

Type this:

echo 'Use --check before touching prod agents'

You will see:

Use --check before touching prod agents

What it means: Check.

Step 9: Story Infosys

Why: Snowflakes. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: story. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 25: i1

Type this:

printf '%s\n' 'At Infosys in Pune, three Jenkins agents had different JDKs. A Maven job passed on one agent and failed on another.' 'Leena made an Ansible jenkins_agent role the only way to build agents.' > /tmp/ans66/STORY.txt && wc -l /tmp/ans66/STORY.txt

You will see:

2 /tmp/ans66/STORY.txt

What it means: Story.

Example 26: i2

Type this:

echo 'Rough delay: about ₹8 lakh in release slip and retests that sprint'

You will see:

Rough delay: about ₹8 lakh in release slip and retests that sprint

What it means: Cost.

Example 27: i3

Type this:

echo 'Leena: PASS'

You will see:

Leena: PASS

What it means: Sign-off.

5. Harden and accept

Step 10: Local proof

Why: Role files. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: ls. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 28: j1

Type this:

ls /tmp/ans66/roles/jenkins_agent/tasks /tmp/ans66/roles/jenkins_agent/defaults /tmp/ans66/roles/jenkins_agent/files

You will see:

/tmp/ans66/roles/jenkins_agent/tasks:\nmain.yml\n\n/tmp/ans66/roles/jenkins_agent/defaults:\nmain.yml\n\n/tmp/ans66/roles/jenkins_agent/files:\njenkins_master.pub

What it means: Tree.

Example 29: j2

Type this:

grep docker.io /tmp/ans66/roles/jenkins_agent/defaults/main.yml

You will see:

- docker.io

What it means: Package.

Example 30: j3

Type this:

test -f /tmp/ans66/site.yml && echo 'site ok'

You will see:

site ok

What it means: site.

Step 11: Acceptance

Why: Agents identical. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: final. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 31: k1

Type this:

echo 'JDK docker git present via role'

You will see:

JDK docker git present via role

What it means: Tools.

Example 32: k2

Type this:

echo 'jenkins user in docker group'

You will see:

jenkins user in docker group

What it means: User.

Example 33: k3

Type this:

echo 'Ansible projects 61-66 complete'

You will see:

Ansible projects 61-66 complete

What it means: Done block.

Step 12: Bridge

Why: Jenkins projects next. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: bridge. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 34: z1

Type this:

echo 'Next chapter: Jenkins CI projects 67-76'

You will see:

Next chapter: Jenkins CI projects 67-76

What it means: Bridge.

Example 35: z2

Type this:

echo 'Keep agent role next to the Jenkinsfile repo docs'

You will see:

Keep agent role next to the Jenkinsfile repo docs

What it means: Habit.

Example 36: z3

Type this:

echo 'Leena: PASS'

You will see:

Leena: PASS

What it means: Done.

Check yourself

Q1. Who fixed Infosys agent drift?

Leena

Q2. Role name?

jenkins_agent

Q3. Docker group user?

jenkins

Q4. Smoke image?

hello-world

Q5. Check before prod?

--check

Q6. Snowflake agents OK?

Friends, you configured Jenkins agents with Ansible. Did you understand? Let us try it once more. Add a second label file that documents docker and jdk17 labels for job authors.

Lab: try at home

Write role defaults and tasks.
Install master key.
Apply site.yml.
Run smoke checks.

Recap

Identical agents.
JDK and Docker required.
SSH from master only.
Labels target jobs.
Idempotent apply.

Lab

Finish all six projects; keep FLOW and TAGS notes.
Never commit .vault_pass or plain secret files.
Use --check before first prod apply.
After each project, write one paragraph: what broke and how you fixed it.
Next batch starts Jenkins projects 67-76.

Practice task

Pick the ten-host Nginx drill and the Vault encrypt habit. Prove both before you call the chapter done.

Ravindra Bagale's Tip

Ping before packages. Prefer roles over giant playbooks. Encrypt with Vault. Patch with serial one. Tag EC2 for inventory. Keep agents identical.

In short

Inventory first.
Roles split LAMP.
Vault at rest.
Drain then patch.
Tag-driven inventory.
Identical agents.