Please enable JavaScript.
Coggle requires JavaScript to display documents.
Enterprise Linux Centralized Patch Management with Ansible - Coggle Diagram
Enterprise Linux Centralized Patch Management with Ansible
Learning Roadmap
Linux Administration
Linux File System
Users and Groups
Permissions and ACL
Sudo and Visudo
SSH
Services (systemd)
Package Management
APT
DNF
YUM
Zypper
Logs
Networking
Process Management
Cron
Bash Scripting
Version Control
Git
GitHub
Branches
Commits
Tags
Infrastructure
VMware
Hyper-V
KVM
AWS
Azure
Virtual Machines
Snapshots
Cloning
Networking
DNS
DHCP
Routing
Firewall
SSH
NTP
HTTP
HTTPS
Enterprise Patch Management
Objectives
Security Compliance
Vulnerability Remediation
OS Stability
Standardization
Audit Compliance
Zero Downtime
Automation
Reporting
Enterprise Architecture
Ansible Controller
Inventory
Playbooks
Roles
Templates
Files
Variables
Vault
Logs
Reports
Collections
Managed Linux Servers
Development
Testing
UAT
Staging
Production
DMZ
Cloud
On-Premise
Repository Servers
Ubuntu Repository
RHEL Repository
Rocky Repository
AlmaLinux Repository
SUSE Repository
Local Mirror
Monitoring
Zabbix
Prometheus
Grafana
ELK
Wazuh
Notification
Email
Slack
Microsoft Teams
ServiceNow
Enterprise Patch Lifecycle
Asset Inventory
Server Discovery
OS Version
Kernel Version
Installed Packages
Business Owner
Environment
Criticality
Tags
Patch Assessment
Vendor Advisories
CVE Analysis
Security Bulletins
Bug Fixes
Kernel Updates
Application Updates
Risk Assessment
Critical
High
Medium
Low
Patch Approval
CAB
Change Manager
Security Team
Application Owner
Infrastructure Team
Maintenance Window
Schedule
Downtime Approval
Communication
Backup
Rollback Plan
Pilot Deployment
Test Servers
Development
QA
Validation
Production Deployment
Batch 1
Batch 2
Batch 3
Mission Critical
Load Balanced Servers
Cluster Nodes
Validation
Service Status
Kernel Version
Package Version
Port Availability
Health Check
Application Testing
Reporting
Success
Failed
Reboot Required
Skipped
Duration
Compliance Percentage
Ansible Fundamentals
Installation
Inventory
Static Inventory
Dynamic Inventory
Groups
Child Groups
Host Variables
Group Variables
Configuration
ansible.cfg
SSH Keys
Become
Privilege Escalation
Logging
Fact Gathering
Ad Hoc Commands
Ping
Copy
Shell
Command
Yum
Apt
Service
Reboot
Playbooks
YAML
Tasks
Plays
Variables
Loops
Handlers
Conditionals
Tags
Blocks
Roles
Tasks
Handlers
Defaults
Vars
Templates
Files
Meta
Templates
Jinja2
Vault
Encrypt Passwords
Secrets
API Keys
Inventory
Enterprise Inventory Structure
ansible/
inventory/
production/
hosts.ini
group_vars/
host_vars/
staging/
hosts.ini
group_vars/
host_vars/
lab/
hosts.ini
Project Directory Structure
/home/ansible/patch-management/
ansible.cfg
inventory/
3 more items...
playbooks/
7 more items...
roles/
6 more items...
templates/
2 more items...
files/
2 more items...
logs/
reports/
backups/
scripts/
ansible.cfg
inventory=inventory/lab/hosts.ini
remote_user=ansible
host_key_checking=False
forks=20
timeout=30
log_path=logs/ansible.log
retry_files_enabled=False
roles_path=roles
Inventory
production
hosts.ini
group_vars
host_vars
staging
hosts.ini
group_vars
host_vars
lab
hosts.ini
group_vars
host_vars
Production hosts.ini
[webservers]
web01
web02
[dbservers]
db01
db02
[appservers]
app01
app02
[linux:children]
webservers
dbservers
appservers
group_vars
all.yml
ansible_user
ansible_become
ansible_python_interpreter
maintenance_window
reboot_timeout
report_path
webservers.yml
package_manager
reboot_required
service_name
dbservers.yml
database_service
maintenance_window
appservers.yml
application_service
host_vars
web01.yml
hostname
environment
owner
reboot_required
db01.yml
database_name
backup_required
SSH Configuration
Generate SSH Key
ssh-keygen
Copy Key
ssh-copy-id
ansible@server
Test
ansible all -m ping
Verify Connectivity
ansible all -m ping
ansible all -m command -a hostname
ansible all -m setup
Enterprise Workflow
Change Request
Management Approval
Backup
Patch Testing
Maintenance Window
Patch Deployment
Reboot
Health Check
Validation
Reporting
Close Change Ticket
Precheck Playbook
Disk Space
df -h
Memory
free -h
CPU
uptime
Running Services
systemctl
Failed Services
systemctl --failed
Package Manager Lock
apt
dnf
yum
Snapshot Validation
Backup Validation
Backup
VMware Snapshot
Hyper-V Checkpoint
Database Backup
Configuration Backup
tar
rsync
cp
Patch Role
Gather Facts
Update Cache
apt update
yum makecache
dnf makecache
Security Updates
Full Updates
Register Results
Save Output
Package Managers
Ubuntu
apt
Debian
apt
RHEL
dnf
CentOS
yum
Rocky Linux
dnf
AlmaLinux
dnf
SUSE
zypper
Playbooks
precheck.yml
patch.yml
reboot.yml
postcheck.yml
verify.yml
report.yml
rollback.yml
Ansible Commands
ansible-playbook playbooks/precheck.yml
ansible-playbook playbooks/patch.yml
ansible-playbook playbooks/reboot.yml
ansible-playbook playbooks/postcheck.yml
ansible-playbook playbooks/report.yml
ansible-playbook playbooks/rollback.yml
Host Targeting
all
webservers
dbservers
appservers
production
staging
lab
--limit webservers
--limit db01
YAML Learning
hosts
become
gather_facts
vars
tasks
handlers
notify
register
when
loop
block
rescue
always
tags
Important Modules
apt
yum
dnf
package
service
systemd
reboot
copy
template
file
stat
shell
command
wait_for_connection
setup
debug
assert
fetch
archive
Reboot Process
Check reboot required
Reboot
Wait for SSH
Verify uptime
Verify hostname
Verify services
Post Validation
SSH Available
Application Running
Database Running
Web Service Running
Ports Listening
Disk Healthy
Memory Healthy
CPU Healthy
Package Version Verified
Service Validation
nginx
apache2
httpd
mysql
mariadb
postgresql
docker
sshd
chronyd
rsyslog
Health Checks
systemctl status
ss -tulnp
curl
ping
journalctl
uptime
Failure Handling
Ignore Errors
Block
Rescue
Always
Retry
Failed_when
Changed_when
Rollback
VMware Snapshot Restore
Remove Installed Package
Downgrade Package
Restore Configuration
Restart Services
Reporting
HTML Report
Jinja2 Template
CSV Report
JSON Report
Execution Time
Host Status
Success
Failed
Skipped
Changed
Unreachable
Report Storage
/reports
daily
weekly
monthly
yearly
Logging
/logs
ansible.log
patch.log
reboot.log
error.log
Scheduling
Cron
AWX Schedule
Maintenance Window
Notifications
Email
Slack
Microsoft Teams
ServiceNow
AWX Integration
Organization
Credential
Project
Inventory
Job Template
Workflow Template
Survey
Schedule
Notification
Execution Environment
Security
SSH Keys
Vault
Become
Least Privilege
RBAC
Secrets Encryption
Testing Strategy
Lab
Staging
Production
Deployment Flow
Lab
Test
Validate
Fix
Staging
Test
Validate
Approval
Production
Backup
Patch
Reboot
Validate
Report
Enterprise Best Practices
Patch Small Batch First
Canary Server
Database Last
Parallel Updates
Serial Updates
Maintenance Window
Automatic Reports
Automatic Rollback Plan
Health Checks Before Patch
Health Checks After Patch
Use Roles
Separate Inventory
Separate Variables
Store Logs
Store Reports
Version Control with Git
CI/CD Integration
AWX Automation
Document Every Change
playbooks/
roles/
templates/
files/
Static Inventory
Purpose
Small to medium environments
Fixed server list
Easy to manage
Enterprise Example
[webservers]
web01 ansible_host=192.168.10.11
web02 ansible_host=192.168.10.12
[dbservers]
db01 ansible_host=192.168.20.11
db02 ansible_host=192.168.20.12
[appservers]
app01 ansible_host=192.168.30.11
app02 ansible_host=192.168.30.12
[monitoring]
zabbix01 ansible_host=192.168.40.10
Practical Tasks
Ping all servers
ansible all -m ping
Check uptime
ansible all -m command -a "uptime"
Check kernel version
ansible all -m shell -a "uname -r"
Check pending updates
ansible all -m shell -a "apt list --upgradable"
Dynamic Inventory
Purpose
Cloud environments
VMware
AWS
Azure
GCP
OpenStack
Enterprise Example
VMware Virtual Machines
Automatically discover new VMs
AWS EC2
Automatically detect new instances
Azure Virtual Machines
Automatically update inventory
Practical Workflow
New VM created
Automatically appears in inventory
Patch playbook
No manual inventory update
Remove VM
Automatically removed
Benefits
No manual editing
Always updated
Scalable
Enterprise automation
Groups
Purpose
Organize servers by role
Enterprise Groups
Web Servers
web01
web02
web03
Database Servers
db01
db02
Application Servers
app01
app02
Monitoring Servers
zabbix01
prometheus01
Kubernetes
master01
worker01
worker02
Load Balancers
haproxy01
haproxy02
Practical Commands
Patch only web servers
ansible-playbook patch.yml --limit webservers
Patch only databases
ansible-playbook patch.yml --limit dbservers
Restart nginx
ansible webservers -m service -a "name=nginx state=restarted"
Restart mysql
ansible dbservers -m service -a "name=mysql state=restarted"
Child Groups
Purpose
Combine multiple groups
Enterprise Example
production
webservers
dbservers
appservers
staging
stage-web
stage-db
linux
production
staging
monitoring
Inventory Example
[production:children]
webservers
dbservers
appservers
[linux:children]
production
monitoring
Practical Tasks
Patch production
ansible-playbook patch.yml --limit production
Patch all Linux servers
ansible-playbook patch.yml --limit linux
Check disk space
ansible production -m shell -a "df -h"
Host Variables
Purpose
Configure individual servers
Directory
host_vars/
web01.yml
db01.yml
app01.yml
Example
web01.yml
patch_window=Sunday
reboot_required=true
application=nginx
db01.yml
patch_window=Saturday
reboot_required=false
application=mysql
Practical Use
Different reboot policy
Different maintenance window
Different application service
Different notification email
Group Variables
Purpose
Configure all servers in one group
Directory
group_vars/
webservers.yml
dbservers.yml
production.yml
Example
webservers.yml
package_manager=apt
service_name=nginx
reboot_after_patch=true
dbservers.yml
package_manager=apt
service_name=mysql
reboot_after_patch=false
Practical Use
Restart nginx only
Restart mysql only
Different patch policy
Different maintenance window
Enterprise Patch Workflow
Step 1
Dynamic or Static Inventory
Step 2
Organize Groups
Web
Database
Application
Monitoring
Step 3
Create Child Groups
Production
Staging
Linux
Step 4
Configure Group Variables
Package manager
Service name
Reboot policy
Maintenance window
Step 5
Configure Host Variables
Critical server
Database exceptions
Custom reboot
Patch schedule
Step 6
Dry Run
ansible-playbook patch.yml --check
Step 7
Patch Staging
stage-web
stage-db
Step 8
Validate Services
nginx
mysql
apache
docker
kubernetes
Step 9
Patch Production
Web Servers
Application Servers
Database Servers
Step 10
Health Checks
Service Status
Disk Space
CPU
Memory
Network
Application Response
Step 11
Generate Reports
Success
Failed Hosts
Reboot Required
Packages Updated
Patch Duration
Step 12
Send Report
Email
AWX Dashboard
Teams
Slack
Best Enterprise Practices
Separate Production
Separate Staging
Never Patch All Servers Together
Patch in Batches
Batch 1
Health Check
Batch 2
Health Check
Batch 3
Always Run Pre-checks
Disk Space
CPU
Memory
Active Users
Running Services
Always Run Post-checks
Service Status
Application Health
Kernel Version
Pending Updates
Store Variables Outside Playbooks
group_vars
host_vars
Use Child Groups
Production
Staging
DR Site
DMZ
Generate Patch Reports
Test Before Production
Rollback Plan Ready
Change Management Approval
Maintenance Window
Monitoring After Patch
Compliance Reporting
Audit Logging
Enterprise Inventory Design
Production
Web Servers
Database Servers
Application Servers
DNS Servers
Mail Servers
Development
QA
DR
DMZ
Cloud
AWS
Azure
GCP
Patch Playbook Workflow
Pre-Checks
Ping
Disk Space
Memory
CPU Load
Active Users
Running Services
Package Manager Lock
Internet Connectivity
Repository Availability
Backup
Configuration Files
Database
VM Snapshot
LVM Snapshot
Update Cache
apt update
dnf makecache
yum makecache
Security Updates
Package Updates
Kernel Updates
Firmware Updates
Reboot Decision
Required
Not Required
Reboot
Wait for SSH
Validate Boot
Post Checks
SSH
Services
Kernel
Package Version
Ports
Disk
CPU
Memory
Validation
Nginx
Apache
MySQL
PostgreSQL
Docker
Kubernetes
Custom Application
Report Generation
HTML
CSV
JSON
Email
Enterprise Patch Strategy
Rolling Updates
Batch Deployment
Canary Deployment
Blue Green
Maintenance Window
Zero Downtime
Load Balancer Drain
Cluster Patching
High Availability
Error Handling
Ignore Errors
Block
Rescue
Always
Retry
Until
Rollback
Snapshot Restore
Compliance
CIS Benchmark
NIST
ISO 27001
PCI DSS
HIPAA
SOC 2
Internal Security Policy
Security
SSH Keys
Ansible Vault
Least Privilege
Sudo
RBAC
MFA
Secrets Management
Audit Logs
Reporting
HTML Report
CSV Report
JSON Report
Email Report
Patch Summary
Failed Hosts
Reboot Required
Execution Time
Compliance Dashboard
Monitoring
Zabbix
Prometheus
Grafana
ELK
Wazuh
Nagios
Logging
Ansible Logs
Syslog
Journalctl
Auditd
ELK Stack
Automation
AWX
Ansible Automation Platform
Jenkins
GitLab CI
GitHub Actions
ServiceNow
Webhooks
Scheduled Jobs
Troubleshooting
SSH Failure
Permission Denied
Become Failure
Repository Failure
Package Lock
Disk Full
Dependency Error
Network Timeout
Reboot Failure
Service Failure
Playbook Syntax Error
YAML Error
Variable Error
Handler Failure
Disaster Recovery
Rollback
Snapshot Restore
Configuration Restore
Backup Verification
Emergency Recovery
Best Practices
Test Before Production
Use Roles
Use Inventory Groups
Use Tags
Use Variables
Encrypt Secrets
Version Control
Change Management
Maintenance Window
Health Checks
Logging
Reporting
Compliance Validation
Rollback Plan
Documentation
Automation First
Enterprise Project
Build Ansible Controller
Configure SSH Authentication
Create Enterprise Inventory
Create Group Variables
Create Host Variables
Build Patch Role
Develop Pre-Check Tasks
Develop Backup Tasks
Develop Patch Tasks
Develop Reboot Logic
Develop Health Check Tasks
Generate HTML Report
Send Email Notification
Integrate with AWX
Schedule Monthly Patching
Integrate Monitoring
Validate Compliance
Perform Rollback Testing
Production Deployment