Why is Ansible called agentless and how does it connect to hosts?
Learn why Ansible is agentless, how it connects to hosts over SSH and WinRM, runs modules with remote Python, and the benefits of having no resident agent.
Expected Interview Answer
Ansible is called agentless because it requires no permanent Ansible software or daemon running on the managed hosts — it connects to them over standard SSH (or WinRM for Windows) and uses Python already present on the target to execute tasks.
From a control node, Ansible reads your inventory, opens an SSH connection to each host, copies small temporary modules to the target, runs them using the remote Python interpreter, collects the results, and then deletes the temporary files. Because it reuses existing SSH and Python rather than a resident agent, there is nothing to install, patch, or keep running on the fleet, which simplifies security and maintenance.
- No agent to install, upgrade, or monitor on hosts
- Smaller attack surface — reuses hardened SSH
- Faster onboarding of new machines
- Lower resource use on managed nodes
- Uses existing OS credentials and Python
AI Mentor Explanation
Ansible is like a coach who carries all the drills in his own bag and visits each player only when needed, showing them the routine over the boundary rope and leaving nothing behind. There is no permanent assistant living with each player. When the session ends, the coach packs up, so no resident staff sit idle on the field between matches — the ground stays clean and lightweight.
Step-by-Step Explanation
Step 1
Read the inventory
The control node loads the inventory to learn which hosts and groups to target and their connection details.
Step 2
Open an SSH connection
Ansible connects to each managed host using SSH (or WinRM on Windows), authenticating with keys, passwords, or a vault.
Step 3
Transfer temporary modules
It copies small module files to a temporary directory on the target host.
Step 4
Execute with remote Python
The modules run using the Python interpreter already installed on the host, applying the desired changes idempotently.
Step 5
Collect results and clean up
Ansible gathers JSON output, reports success or change status, and deletes the temporary files — leaving no agent behind.
What Interviewer Expects
- Correct definition of agentless architecture
- Knowledge that SSH (and WinRM) is the transport
- Awareness that Python is used on the target
- Understanding of the copy-run-cleanup module lifecycle
- Security and maintenance benefits of no persistent agent
Common Mistakes
- Thinking Ansible installs a daemon on every host
- Believing a message broker or agent runs on targets
- Forgetting that Windows hosts use WinRM, not SSH
- Ignoring that the target needs a Python interpreter
- Confusing the control node with a permanent server on each host
Best Answer (HR Friendly)
“Ansible is called agentless because you don't have to install any special program on the machines you manage. It simply logs into each machine the normal way over SSH, does the work using tools already on that machine, and logs out — so there is nothing extra left running that you'd have to maintain.”
Code Example
# No agent needed on hosts - just SSH reachability
ansible all -i inventory.ini -m ping
# Example success output per host:
# web1 | SUCCESS => {
# "changed": false,
# "ping": "pong"
# }[webservers]
web1 ansible_host=10.0.0.11
web2 ansible_host=10.0.0.12
[webservers:vars]
ansible_user=deploy
ansible_connection=ssh
ansible_ssh_private_key_file=~/.ssh/id_rsaFollow-up Questions
- How does Ansible connect to Windows hosts if not over SSH?
- What must be present on a target host for Ansible to run modules?
- How does the control node authenticate to managed hosts?
- What are the security advantages of an agentless model?
- What is ansible-pull and how does it differ from the default push model?
MCQ Practice
1. Which protocol does Ansible use to connect to Linux hosts by default?
Ansible connects to Linux/Unix hosts over SSH, which is why no dedicated agent is required.
2. What does Ansible use on the target host to execute most modules?
Ansible copies temporary modules and runs them using the Python interpreter already on the managed host.
3. How does Ansible connect to Windows hosts?
For Windows targets, Ansible uses WinRM as the transport instead of SSH.
Flash Cards
Why is Ansible agentless? — It needs no persistent software on hosts; it reuses SSH/WinRM and the host's Python.
Default transport for Linux hosts? — SSH.
Transport for Windows hosts? — WinRM.
What runs the modules on the target? — The Python interpreter already installed on the managed host.
What happens to modules after a run? — Ansible collects results and deletes the temporary module files — nothing stays resident.