Integration · Infrastructure as code
Ansible + OrchestrAI
Catalog exported 2026-09-02 · Ansible website
Run Ansible playbooks and ad-hoc commands from chat, with inventory lookups and Vault encryption.
OrchestrAI exposes 4 Ansible operations: 2 are low-risk (read-only or low-impact), and 2 create or modify resources and run only after you confirm the plan. 2 of them also carry a step-level approval gate.
What teams use it for
Platform teams point OrchestrAI at an Ansible inventory to answer questions like which hosts sit in the web group before running a playbook against them. Both playbook runs and ad-hoc commands are rated high because they change existing hosts, so OrchestrAI shows the target hosts and command and waits for your go-ahead. Encrypting a string with Ansible Vault touches no infrastructure and runs immediately. There is no operation for decrypting Vault content or editing inventory files, so manage those directly.
Every Ansible operation, with its risk level
| Operation | What it does | Risk | Step-level approval |
|---|---|---|---|
Encrypt with Ansible Vault |
Encrypt string with Ansible Vault | Low risk | No |
List Ansible Inventory |
List Ansible inventory hosts and groups | Low risk | No |
Run Ansible Ad-Hoc Command |
Run Ansible ad-hoc command | Modifies existing | Yes |
Run Ansible Playbook |
Run Ansible playbook | Modifies existing | Yes |
Risk tiers come from the catalog: low is read-only or low-impact, medium creates resources and is reversible, high modifies existing resources, destructive may lose data. Every plan that creates or changes resources is shown with its cost estimate and waits for your confirmation. Operations marked with a step-level approval pause again on their own step. Destructive operations require a typed risk phrase.
What you connect
A Ansible credential (stored as ansible).
Connected-service tokens are envelope-encrypted with a per-record key wrapped by a cloud KMS.
Prompts that work
- Which hosts are in the db_primary group of my Ansible inventory?
- Run the site.yml playbook against the staging group with the tag nginx
- Encrypt this database password with Ansible Vault so I can paste it into group_vars
Before anything runs
Every mutation shows its plan, cost estimate, and blast radius, then waits for your confirmation. Destructive operations require a typed risk phrase. Credentials are minted per run through OIDC federation and discarded afterward; nothing you create here is invisible later, because every resource lands in the desired-state ledger where drift is detected and can be converged. Details on the security page.
Frequently asked questions
- Does OrchestrAI run Ansible playbooks without asking?
- No. Running a playbook is a high-risk operation because it modifies existing hosts, so OrchestrAI displays the playbook, inventory group, and any extra variables and waits for confirmation.
- Can OrchestrAI decrypt Ansible Vault secrets?
- No. The only Vault operation is encrypting a string. Decryption and vault password management stay with your team.
- How does OrchestrAI authenticate to Ansible?
- You add a Ansible credential once in the connections screen. It is envelope-encrypted with a per-record key wrapped by a cloud KMS and is only decrypted inside the run that needs it.
Related integrations
Try it on your own account
Connect your cloud read-only and see your resources, drift, and costs before anything runs. $5 minimum to start. Unused credits refunded in your first 14 days.
Unused credits refunded in your first 14 days.