Use Ansible for Patch Management

[siliii]

Hello Ansible community,

I am new to the world of configuration management software (infrastructure as code). I currently manage a small Linux environment with 25 Linux servers and wanted to ask if there are any useful use cases to regularly deploy patches to the 25 Linux systems?

In my opinion, due to the Infrastructure as Code approach, almost every small requirement should be covered or are there any limitations?

In general, I would like to cover the following points with Ansible:
1. preselect patches to be installed -> I as administrator decide which patches go to which systems.

2. divide the 25 systems into different groups to patch not all systems at once but staggered.

3. release patches automatically for certain clients with a scheduled interval (e.g. weekly).

4. check the patch status of each client. Which client is missing which patches and which are up to date.

Would these points be covered or is a configuration more suitable for other use cases?

Thanks for the support

Best regard,

Silvan

[Wei-Yen Tan]

Yes all this can be done using ansible. 

Playbooks can be written to automate patch selection in your patch management system. 

Then your servers can be organised into groups. And then issued patch task. 

In between you can post in pre and post tasks  

Get Outlook for iOS

---

From: ansible...@googlegroups.com <ansible...@googlegroups.com> on behalf of siliii <silvan.f...@gmail.com>
Sent: Tuesday, May 18, 2021 9:33:02 AM
To: Ansible Project <ansible...@googlegroups.com>
Subject: [ansible-project] Use Ansible for Patch Management

 

--
You received this message because you are subscribed to the Google Groups "Ansible Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ansible-proje...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/694e4c07-2706-4031-b422-e34ce200fd91n%40googlegroups.com.

[siliii]

Okay sounds great. Are there any preconfigured templates or do I have to start from scratch?

And with ansible I can manage to patch many different linux distributions like Ubuntu and SLES for SAP enterprise. Is that also correct?

And how does it look like with support questions when I use ansible in production. Is there a commercial support channel which can be accessed after buying a subscription what can I do if I would ran into a configuration problem?

[Wei-Yen Tan]

In response to your first question you can use facts to query the os type then pass it to the correct task. Ansible has patch tasks for many  linux distributions. 

In regards to templates there are many examples in github repository. I can't recall on the top of my head. 

In response to your last question if you want support with Ansible I know that they support their commercial products. Ansible tower/automation hub. . You could explore that 

Get Outlook for iOS

---

From: ansible...@googlegroups.com <ansible...@googlegroups.com> on behalf of siliii <silvan.f...@gmail.com>

Sent: Tuesday, May 18, 2021 9:54:21 AM
To: Ansible Project <ansible...@googlegroups.com>
Subject: Re: [ansible-project] Use Ansible for Patch Management

 

To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/0cee8314-878a-402a-9442-a85ae8b7b534n%40googlegroups.com.

[The Vandyy Vines]

Hello,

Could you help...

I ve installed ansible-base 2.10.9 and ansible 3.0.0 

 But checking ansible version it says 2.10.9

So which pkg decides the version finally.

BR//

Vandana