Skip to content

Commit ef31781

Browse files
it-pappait-pappa
committed
Linux OS Patch
0 parents  commit ef31781

File tree

5 files changed

+127
-0
lines changed

5 files changed

+127
-0
lines changed

‎README.md

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#Patch linux VM's
2+
3+
This playbook/role will first determind the OS of the VM (Distro), before it will start patching it. <br>
4+
5+
This playbook works on:
6+
- [X] Debian
7+
- [X] Centos
8+
- [X] Ubuntu
9+
- [X] RHEL8
10+
- [X] Rocky Linux 8.5
11+
12+
on processor architecture:
13+
- [X] x64
14+
- [X] ARM
15+
16+
✅ Playbook requirements:
17+
* Sudo access to the VM
18+
* The target machine needs Internet access
19+
* Ansible installed on the host running the playbook
20+
21+
Example playbook:
22+
```
23+
- hosts: ip-address
24+
gather_facts: true
25+
become: yes
26+
27+
roles:
28+
- linux_os_patch
29+
```
30+
31+
Example playbook run:
32+
```
33+
ansible-playbook setup.yml -i inventory --ask-become-pass
34+
```
35+
The playbook will then ask for the 'Sudo' password for the host target.

‎meta/main.yml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
galaxy_info:
3+
role_name: patch_linux_host
4+
author: Dan Eckholm
5+
description: Patch Linux hosts (Centos/Ubuntu)
6+
license: BSD-3-Clause
7+
min_ansible_version: 2.11
8+
platforms:
9+
- name: EL
10+
versions:
11+
- 8
12+
galaxy_tags:
13+
- linux
14+
- patch
15+
16+
17+
dependencies: []

‎tasks/01_patch_centos_redhat.yml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
- name: Patch Task 1 - upgrade kernel package on RHEL/CentOS server
3+
ansible.builtin.yum:
4+
name="kernel"
5+
state=latest
6+
when: app_process_check.stdout == "process_not_running" and ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux' or ansible_distribution == 'Rocky Linux'
7+
register: yum_update
8+
9+
- name: Patch Task 2 - check if reboot required after kernel update on CentOS/RedHat servers
10+
ansible.builtin.shell: KERNEL_NEW=$(rpm -q --last kernel |head -1 | awk '{print $1}' | sed 's/kernel-//'); KERNEL_NOW=$(uname -r); if [[ $KERNEL_NEW != $KERNEL_NOW ]]; then echo "reboot_needed"; else echo "reboot_not_needed"; fi
11+
when: ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux'
12+
ignore_errors: true
13+
register: reboot_required
14+
15+
- name: Patch Task 3 - Reboot CentOS/RedHat systems if kernel updated
16+
ansible.builtin.command: shutdown -r +1 "Rebooting CentOS/RedHat Servers After Kernel Patching"
17+
ansible.builtin.async: 0
18+
poll: 0
19+
when: reboot_required.stdout == "reboot_needed" and (ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux' or ansible_distribution == 'Rocky Linux')
20+
register: reboot_started
21+
ignore_errors: true

‎tasks/02_patch_ubuntu_debian.yml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
- name: Patch Task 1 - upgrade kernel package on Ubuntu server
3+
ansible.builtin.apt:
4+
update_cache: yes
5+
force_apt_get: yes
6+
cache_valid_time: 3600
7+
name: linux-image-generic
8+
state: latest
9+
when: app_process_check.stdout == "process_not_running" and ansible_distribution == 'Ubuntu' or ansible_distribution == 'Debian'
10+
register: apt_update
11+
12+
13+
- name: Patch Task 2 - Check if a reboot is required after kernel update on Ubuntu/Debian servers
14+
register: reboot_required_file
15+
ansible.builtin.stat: path=/var/run/reboot-required get_md5=no
16+
when: ansible_distribution == 'Ubuntu' or ansible_distribution == 'Debian'
17+
18+
19+
- name: Patch Task 3 - Reboot Ubuntu/Debian Servers if kernel updated
20+
ansible.builtin.reboot:
21+
msg: "Rebooting Ubuntu/Debian Servers After Kernel Patching"
22+
connect_timeout: 5
23+
reboot_timeout: 300
24+
pre_reboot_delay: 0
25+
post_reboot_delay: 30
26+
test_command: uptime
27+
when: reboot_required_file.stat.exists and (ansible_distribution == 'Ubuntu' or ansible_distribution == 'Debian')
28+
register: reboot_started_ubuntu
29+
ignore_errors: true

‎tasks/main.yml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
# Tasks to run
3+
4+
# Resolve Linux Distro
5+
- ansible.builtin.include: 01_centos_redhat.yml
6+
when: ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux' or ansible_distribution == 'Rocky Linux'
7+
- ansible.builtin.include: 02_ubuntu_debian.yml
8+
when: ansible_distribution == 'Ubuntu' or ansible_distribution == 'Debian'
9+
10+
11+
# If this role is ran locally, these tasks will fail if the server restarts.
12+
- name: Task // - pause for 180 secs
13+
ansible.builtin.pause:
14+
minutes: 3
15+
16+
17+
- name: Task // - check if all the systems responding to ssh
18+
local_action:
19+
module: ansible.builtin.wait_for
20+
host={{ (ansible_ssh_host|default(ansible_host))|default(inventory_hostname) }}
21+
port=22
22+
search_regex=OpenSSH
23+
delay=15
24+
timeout=300
25+
state=started

0 commit comments

Comments
 (0)