What are the common pitfalls to avoid when using Ansible?

Quick answer: the main Ansible pitfall is using its shell/command modules to run arbitrary scripts instead of Ansible's own idempotent modules — a raw shell command re-run adds a duplicate line or repeats an action every time the playbook runs, whereas a proper Ansible module checks current state first and only changes what actually needs changing, which is what makes a playbook safe to re-run.

But there are some pitfalls. Ansible does allow you to write custom code — you can run a bash script or something — however, if done badly, or without awareness, it means you lose the ability to run the playbook over and over again idempotently. If you're just running a bit of bash code that appends an extra line to the bottom of a file, then every time you run the code it's going to stick that line on the bottom again, and before long you've got six, seven, eight identical lines at the bottom of the file, which is probably not what you want. With mindfulness you can make sure it handles being run multiple times — the inbuilt Ansible modules have already got this in mind, so they'll do that sort of thing for you.

Dynamic inventories — I've mentioned this already. Let's say our servers are in AWS — we don't necessarily know what the hostname's going to be, we don't even know what the IP address is going to be, so we can run a utility script that goes off into our AWS account and gathers what the servers are. We can put tags on those servers, and those tags will form group names inside the Ansible inventory, so then we can target the groups in the same way we always do, and we know which server that's going to affect based on the server tags.

Secrets — what's a secret? Well, we've got our variables, haven't we, and we don't want variables that contain sensitive information inside our repository. Ansible Vault enables us to encrypt those secrets so we can store them in the repository and they're still relatively safe. This way we can use continuous deployment, running the same code over and over again with our secrets, so we're reasserting what our server should look like, and we've got our secrets safe, with all that important information — database usernames, passwords, and so on — away from prying eyes.