r/ansible • u/ban_rakash • 15d ago

playbooks, roles and collections I built a self-contained Linux patch governance platform with Ansible + AWX

I've been working on a project called PatchOps : a small, reproducible environment for managing Linux patching through Ansible and AWX.

What Ansible/AWX does

  • Ansible roles for Aptly, clients, governance DB and notifications
  • Ansible playbooks for scanning, patching, promotion and rollback
  • AWX handles scheduling, job history, credentials and orchestration
  • Docker-based Execution Environment for consistent Ansible execution

There are also Grafana dashboards backed by PostgreSQL for fleet status, package upgrades, snapshots and patch history.

Everything runs on a single machine with Docker Compose, so it's reasonably easy to spin up a lab and experiment with the whole pipeline.

Blog: https://2ssk.medium.com/controlled-linux-patch-management

GitHub: https://github.com/2SSK/patchops

I'd particularly like feedback from people who use Ansible/AWX in production:

  • Does this architecture make sense to you?
  • What would you change about the AWX/Ansible side?
  • Are there better patterns for handling patch promotion and rollback?
  • What would you consider essential before calling something like this production-ready?
19 Upvotes

78% Upvoted

2 comments sorted by

7

u/abix- 15d ago edited 15d ago

This is a nice start. How big is your environment? Do you have Windows?

I use AWX to orchestrate monthly Windows/Linux patching for 1500 VMs. No one IP has connectivity to all systems. With AWX Execution Environments and Inventories I can manage all my VMs regardless of hypervisor, cloud, or physical datacenter.

Essential Needs:

  • Support for multiple Business Units, Inventories, Schedules, Execution Environments
  • Application aware reboots for clustered VMs(databases, etc)
  • Updates for non-OS packages distributed with chocolatey
  • Diagnostics when patching inevitably fails
  • Pre-Patching: validation, maintenance splashing
  • Post-Patching: validation, application availability, maintenance unsplashing

I find that installing the patches is one of the easier parts of patching.

2

u/ban_rakash 15d ago

I have around 42 servers all ubuntu across Azure and Oracle