Ansible inventory structure for homogenous structure seperated by customer - ansible

Question

I have got a huge problem with structuring my inventory and how ansible merges groups in inventories.
Imagine an environment where the same three roles of servers stand in separate customer environments (e.g. backend, frontend, database). Those are also roles, which have roles-folders where tasks that should be executed, with default variables are collected. As suggested here: https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_reuse_roles.html
My target is to have playbooks, which apply roles and their tasks, e.g. for upgrading the backend, frontend, and database separately PER CUSTOMER.
All in all, I would think about an inventory structure like that:
- inventories/
- customer1/
- inventory.yml
- customer2/
- inventory.yml
- customer3/
- inventory.yml
And one inventory.yml may contain e.g. the following structure:
all:
children:
customer1:
children:
frontend:
hosts:
fe01.customer1.com:
backend:
hosts:
be01.customer1.com:
database:
hosts:
db01.customer1.com:
The same would be in the other inventory files for customer2 and customer3 just exchanging the customer1.com domain respectively.
Question 1:
Why is it, and is this behavior anyhow changeable, that if I take the whole inventory as one when I use the following command:
shell> ansible customer1:&frontend --list-hosts
That I receive ALL hosts that are in any frontend group, although I have explicitly chosen customer1 AND frontend as selector groups:
fe1.customer1.com
fe1.customer2.com
fe1.customer3.com
Question 2:
How would you structure your inventory to share variables between all customers, but also be able to target each customer solely, by using the -i <inventory_file> parameter, for a really big amount of customers?
e.g.:
shell> ansible -i inventories/customer1 fe --list-hosts
Thanks in advance, everybody have a nice day, and stay healthy!
Tim

Answer 1

Given the inventory
shell> tree inventories
inventories
├── customer1
│   └── hosts.yml
├── customer2
│   └── hosts.yml
└── customer3
└── hosts.yml
3 directories, 3 files
shell> cat inventories/customer1/hosts.yml
all:
children:
customer1:
children:
frontend:
hosts:
fe01.customer1.com:
backend:
hosts:
be01.customer1.com:
database:
hosts:
db01.customer1.com:
shell> cat inventories/customer2/hosts.yml
all:
children:
customer2:
children:
frontend:
hosts:
fe01.customer2.com:
backend:
hosts:
be01.customer2.com:
database:
hosts:
db01.customer2.com:
shell> cat inventories/customer3/hosts.yml
all:
children:
customer3:
children:
frontend:
hosts:
fe01.customer3.com:
backend:
hosts:
be01.customer3.com:
database:
hosts:
db01.customer3.com:
Q: "If I take the whole inventory I receive all hosts in any frontend group. Why is it? Is this behavior anyhow changeable?"
(Note: In the context of this question any references to the group customer* are irrelevant. See the outputs of ansible-inventory and the note below.)
A: It is because Ansible can combine inventory from multiple sources. See Manage Ansible Inventory with dynamic and static hosts and vars. In particular:
Ansible has several inventory plugins. You can combine them as multiple -i options or specify a directory containing multiple inventories.
This behavior is not changeable. Instead, you can configure DEFAULT_HOST_LIST. If you set it to the directory inventories ('the whole inventory as one' in your terminology) you get
shell> ANSIBLE_INVENTORY=inventories ansible-inventory --list --yaml
all:
children:
customer1:
children:
backend:
hosts:
be01.customer1.com: {}
be01.customer2.com: {}
be01.customer3.com: {}
database:
hosts:
db01.customer1.com: {}
db01.customer2.com: {}
db01.customer3.com: {}
frontend:
hosts:
fe01.customer1.com: {}
fe01.customer2.com: {}
fe01.customer3.com: {}
customer2:
children:
backend:
hosts:
be01.customer1.com: {}
be01.customer2.com: {}
be01.customer3.com: {}
database:
hosts:
db01.customer1.com: {}
db01.customer2.com: {}
db01.customer3.com: {}
frontend:
hosts:
fe01.customer1.com: {}
fe01.customer2.com: {}
fe01.customer3.com: {}
customer3:
children:
backend:
hosts:
be01.customer1.com: {}
be01.customer2.com: {}
be01.customer3.com: {}
database:
hosts:
db01.customer1.com: {}
db01.customer2.com: {}
db01.customer3.com: {}
frontend:
hosts:
fe01.customer1.com: {}
fe01.customer2.com: {}
fe01.customer3.com: {}
ungrouped: {}
If you set it to the directory inventories/customer* you get
shell> ANSIBLE_INVENTORY=inventories/customer1 ansible-inventory --list --yaml
all:
children:
customer1:
children:
backend:
hosts:
be01.customer1.com: {}
database:
hosts:
db01.customer1.com: {}
frontend:
hosts:
fe01.customer1.com: {}
ungrouped: {}
This explains the output of the below commands
shell> ANSIBLE_INVENTORY=inventories ansible --list-hosts customer1:\&frontend
hosts (3):
fe01.customer1.com
fe01.customer2.com
fe01.customer3.com
shell> ANSIBLE_INVENTORY=inventories/customer1 ansible --list-hosts customer1:\&frontend
hosts (1):
fe01.customer1.com
Note: The inventory pattern customer1:&frontend is redundant. This pattern means: 'The hosts in the group customer1 that are also members of the group frontend'. You can omit the customer1 group because the group frontend is a subset of customer1. The commands below give the same results
shell> ANSIBLE_INVENTORY=inventories ansible --list-hosts frontend
shell> ANSIBLE_INVENTORY=inventories/customer1 ansible --list-hosts frontend