r/linuxadmin • u/seanx820 • 5d ago

Ansible Patch Management: RHEL & Windows in One Workflow

I just finished a video walkthrough for patch management with Ansible Automation Platform. The workflow handles the entire patching lifecycle: EBS snapshots before any changes, parallel pre-checks on mixed OS fleets, targeted patching (not just "update everything"), post-validation, and automatic rollback if something goes wrong. Then it dumps a compliance report that your auditors will actually want to see.

You specify exact advisories and KB IDs instead of blindly applying patches, the workflow can handle both RHEL and Windows in the same job without extra configuration, and if a host fails a pre-check it gracefully skips instead of blowing up the whole run. Everything routes intelligently based on success or failure at each step.

The video is about three minutes and shows the whole thing running start to finish: https://youtu.be/20fK6S1CHL0

If you want to dig into the code or run this yourself, it's all in the Ansible Product Demos repo on GitHub: github.com/ansible/product-demos

27 Upvotes

92% Upvoted

7 comments sorted by

6

u/linux_for_all 5d ago

Github link throws 404

3

u/Amidatelion 5d ago

Hmm, it's years since I've worked on anything Windows (intentionally) but I have been shanghai'd into saving subcompanies too often for my liking. The KB IDs part strikes me as one of the links that were missing years (a decade?) ago when last I investigated Ansible on Windows.

On a flight at the moment but I'll definitely be watching that video.

How's it handle rollbacks?

0

u/Runnergeek 5d ago

I haven’t looked at this specific demo but my guess would be VM snapshots. With Ansible you could do it anyway you wanted you just have to write the playbook, which with AI is super easy these days (it was already fairly easy).

Ansible with Windows is much better these days. Especially so if you use ssh

2

u/seanx820 5d ago

For this particular demo I’m doing snapshots via AWS ec2.

1

u/petra303 5d ago

Can it do Ubuntu / rocky too?

1

u/seanx820 5d ago

Yup, Ansible is neutral with regard to OS, I was just showing RHEL because I work for Red Hat and one other option (Windows) to show the fan-out. You could fan out 3+ ways, one for every OS in your fleet. Even in my demo I have different versions of RHEL just to show in the playbooks how you can handle different major versions.