This is an Ansible playbook that can upgrade all your Linux machines! Or at least most of them. No openSUSE support yet.<\/p>\n\n\n\n
Copy the playbook below, and put all your servers into an inventory file and run with<\/p>\n\n\n\n
ansible-playbook -i hosts.ini master_update.yaml --ask-vault-pass<\/pre>\n\n\n\nCouple of notes.<\/p>\n\n\n\n
\n
- This will do a full update automatically reboot your servers if needed.<\/li>\n\n\n\n
- There is a special section for RHEL, CentOS 7 servers. If a server is running say CentOS 7, it will default to using YUM instead of DNF.<\/li>\n\n\n\n
- You need sudo or become: yes to reboot and install upgrades.<\/li>\n<\/ol>\n\n\n\n
<\/p>\n\n\n\n
Linux OS Upgrade Playbook<\/p>\n\n\n\n
---\n- name: Linux OS Upgrade\n hosts: all\n gather_facts: yes\n become: yes\n\n tasks:\n - name: Upgrade Debian and Ubuntu systems with apt\n block: \n - name: dist-upgrade\n ansible.builtin.apt:\n upgrade: dist\n update_cache: yes \n register: upgrade_result\n\n - name: Debain check if reboot is required\n shell: \"[ -f \/var\/run\/reboot-required ]\"\n failed_when: False\n register: debian_reboot_required\n changed_when: debian_reboot_required.rc == 0\n notify:\n - Reboot server \n\n - name: Debian remove unneeded dependencies\n ansible.builtin.apt:\n autoremove: yes\n register: autoremove_result \n\n - name: Debian print errors if upgrade failed\n ansible.builtin.debug:\n msg: | \n Upgrade Result: {{ upgrade_result }}\n Autoremove Result: {{ autoremove_result }}\n when: ansible_os_family == \"Debian\"\n \n - name: Upgrade RHEL systems with DNF\n block:\n - name: Get packages that can be upgraded with DNF\n ansible.builtin.dnf:\n list: upgrades\n state: latest\n update_cache: yes \n register: reg_dnf_output_all\n\n - name: List packages that can be upgraded with DNF\n ansible.builtin.debug: \n msg: \"{{ reg_dnf_output_all.results | map(attribute='name') | list }}\"\n\n - name: Upgrade packages with DNF\n become: yes\n ansible.builtin.dnf:\n name: '*'\n state: latest\n update_cache: yes\n update_only: no\n register: reg_upgrade_ok\n\n - name: Print DNF errors if upgrade failed\n ansible.builtin.debug:\n msg: \"Packages upgrade failed\"\n when: reg_upgrade_ok is not defined\n\n - name: Install dnf-utils\n become: yes\n ansible.builtin.dnf:\n name: 'dnf-utils'\n state: latest\n update_cache: yes\n when: reg_dnf_output_all is defined\n\n when: ansible_os_family == \"RedHat\" and not (ansible_distribution_major_version == \"7\")\n\n - name: Upgrade legacy RHEL systems with YUM\n block:\n - name: Get packages that can be upgraded with YUM\n ansible.builtin.yum:\n list: upgrades\n state: latest\n update_cache: yes \n register: reg_yum_output_all\n \n\n - name: List packages that can be upgraded with YUM\n ansible.builtin.debug: \n msg: \"{{ reg_yum_output_all.results | map(attribute='name') | list }}\"\n\n - name: Upgrade packages with YUM\n become: yes\n ansible.builtin.yum:\n name: '*'\n state: latest\n update_cache: yes\n update_only: no\n register: reg_yum_upgrade_ok\n\n - name: Print YUM errors if upgrade failed\n ansible.builtin.debug:\n msg: \"Packages upgrade failed\"\n when: reg_yum_upgrade_ok is not defined\n \n - name: Check legacy RHEL system if a reboot is required\n become: yes\n command: needs-restarting -r\n register: reg_reboot_required\n ignore_errors: yes\n failed_when: false\n changed_when: reg_reboot_required.rc != 0\n notify:\n - Reboot server \n when: ansible_os_family == \"RedHat\" and ansible_distribution_major_version == \"7\"\n\n\n handlers:\n - name : Reboot server\n ansible.builtin.reboot:\n msg: \"Reboot initiated by Ansible after OS update\"\n reboot_timeout: 3600\n test_command: uptime\n<\/code><\/pre>\n\n\n\nHelpful links<\/p>\n\n\n\n
https:\/\/github.com\/simeononsecurity\/ansible_linux_update\/tree\/main<\/a>
https:\/\/simeononsecurity.com\/guides\/automate-linux-patching-and-updates-with-ansible\/<\/a>
https:\/\/thenathan.net\/2020\/07\/16\/yum-and-dnf-update-and-reboot-with-ansible\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"This is an Ansible playbook that can upgrade all your Linux machines! Or at least most of them. No openSUSE support yet. Copy the playbook below, and put all your servers into an inventory file and run with ansible-playbook -i … Continue reading