The document describes using Ansible to safely and easily update system packages across servers. It provides an example setup using CentOS Linux servers with yum, Slack for notifications, and an internal yum repository. The playbook checks for available updates, installs them using yum with notifications for reboots, and handles confirmation for critical servers.

1. System Updates
With Ansible
Ansible Brno #1

2. Goal
Updating system packages should be
safe and easy

3. Requirements
• Announce updates via team chat.
• When reboot is needed, wait for system
to come back.
• Manual confirmation for critical servers.
• Rolling updates, with defined order.

4. Example set-up
• CentOS Linux (yum)
• Slack for team chat
• Our own yum repository
• We don’t mind reboots
• We assume auto-detect load balancer

6. Inventory
---
[updates:children]
dbservers
appservers
[critical:children]
dbservers
[dbservers]
db1
db2
[appservers]
app1
app2
app3

7. Playbook
---
- name: Update system packages
hosts: updates
sudo: True
gather_facts: yes
serial: 1
max_fail_percentage: 0
tasks:
- name: Check if packages updates are available
shell: /bin/yum check-updates
register: updates_available
failed_when: ( updates_available.rc != 0 ) and
( updates_available.rc != 100 )
changed_when: updates_available.rc == 100

8. gather_facts: yes
serial: 1
max_fail_percentage: 0
tasks:
- name: Check if packages updates are available
shell: /bin/yum check-updates
register: updates_available
failed_when: ( updates_available.rc != 0 ) and
( updates_available.rc != 100 )
changed_when: updates_available.rc == 100
notify:
- announce system update
- meta: flush_handlers
- name: Update packages
yum: name=* state=latest
when: updates_available.changed
notify:
- reboot host
- wait for reboot

9. - name: Prompt user for manual verification
pause: prompt="WARNING! Ensure that system is
fully operational before continuing!
Hit Ctrl+c to abort, Enter to continue."
when: "updates_available.changed and 'critical'
in group_names"
handlers:
- name: announce system update
local_action:
module: slack username="{{ slack_username }}"
token="{{ slack_token }}"
msg="*ALERT:* {{ ansible_hostname }}
is going offline for system updates."
sudo: false
- name: reboot host
shell: /usr/bin/sleep 3 && /usr/sbin/shutdown
-r +1 "Reboot triggered by packages
updates through Ansible"
async: 1
poll: 0

10. register: updates_available
failed_when: ( updates_available.rc != 0 ) and
( updates_available.rc != 100 )
changed_when: updates_available.rc == 100
notify:
- announce system update
- meta: flush_handlers
- name: Update packages
yum: name=* state=latest
when: updates_available.changed
notify:
- reboot host
- wait for reboot
- meta: flush_handlers
- name: announce system update completed
local_action:
module: slack username="{{ slack_username }}”
token="{{ slack_token }}" msg="*OK:*

11. msg="*ALERT:* {{ ansible_hostname }}
is going offline for system updates."
sudo: false
- name: reboot host
shell: /usr/bin/sleep 3 && /usr/sbin/shutdown
-r +1 "Reboot triggered by packages
updates through Ansible"
async: 1
poll: 0
ignore_errors: true
- name: wait for reboot
local_action: wait_for
host={{ ansible_ssh_host }}
port=22 delay=90 timeout=300
connect_timeout=15
sudo: false

12. - meta: flush_handlers
- name: announce system update completed
local_action:
module: slack username="{{ slack_username }}”
token="{{ slack_token }}" msg="*OK:*
{{ ansible_hostname }} is back
online after system updates."
sudo: false
when: updates_available.changed
- name: Prompt user for manual verification
pause: prompt="WARNING! Ensure that system is
fully operational before continuing!
Hit Ctrl+c to abort, Enter to continue."
when: "updates_available.changed and 'critical'
in group_names"
handlers:
- name: announce system update
local_action:

13. Pro Tips
• Nicely stop services first
• Use your own yum repository
• Enforce the same repository
configuration everywhere
• Store confidential variables in vault

14. Thanks!
Vincent van Scherpenseel
vincent.io
vanscherpenseel
www.becontentking.com