Active
TMM Created
Multi-OS Cloud Patching
Playbook orchestration — RHEL and Windows on AWS
One workflow. Two operating systems. Snapshot safety built in.
Description
Automation orchestrator version of Patch Cloud Stack in AWS from ansible/product-demos. Snapshot EC2 instances, run parallel RHEL and Windows pre-check and patch jobs, branch on patch success with conditional steps, restore from EBS snapshot on failure, converge both OS paths, and publish an HTML compliance report.
Why it matters
- Parallel RHEL and Windows paths show heterogeneous fleet patching without duplicating workflows per OS.
- EBS snapshot rollback gives change-management audiences a concrete safety net when patching fails.
- Conditional steps route on job status — post-check on success, restore on failure — without AI or switch artifacts.
- Playbooks and job templates come from product-demos; this repo holds the automation orchestrator workflow JSON.
AO building blocks
Automation orchestrator step types this workflow uses on the canvas. See all building blocks
-
Triggers
Manual trigger
Starts a workflow when a user clicks Run in the UI or calls the workflow execution API — the simplest entry point for on-demand runs like demos, break-glass remediation, or operator-initiated changes. No extra configuration is required, and runs appear in history with the triggering user as the source.
-
Logic
Conditional step
Evaluates one expression and routes to a true or false branch, sharing the same expression builder as switch steps. Use it for simple binary branching, and leave the false path unconnected to end the branch when the condition isn't met.
-
Logic
Converge step
Joins multiple parallel branches back into a single execution path, waiting until every connected upstream branch completes before continuing. Place it after switch or conditional branches that must rejoin so the workflow proceeds as a single thread.
-
AAP execution
AAP job template
Launches a single Ansible Automation Platform job template from the workflow, polling until the job completes and exposing results to downstream steps. The standard bridge between automation orchestrator reasoning and AAP execution — one playbook with resolved inventory, credentials, limits, and extra vars.
Interactive Experience
Workflow
flowchart LR
A@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/manual-trigger.png", label: "Manual trigger", pos: "b", h: 96, constraint: "on" } --> B@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Create EC2 Snapshot", pos: "b", h: 96, constraint: "on" }
B --> C@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Pre-check RHEL", pos: "b", h: 96, constraint: "on" }
B --> D@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Pre-check Windows", pos: "b", h: 96, constraint: "on" }
C --> E@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Patch RHEL", pos: "b", h: 96, constraint: "on" }
D --> F@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Patch Windows", pos: "b", h: 96, constraint: "on" }
E --> G@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/glossary/conditional-node.svg", label: "Patch succeeded?", pos: "b", h: 96, constraint: "on" }
F --> H@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/glossary/conditional-node.svg", label: "Patch succeeded?", pos: "b", h: 96, constraint: "on" }
G -->|yes| I@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Post-check RHEL", pos: "b", h: 96, constraint: "on" }
G -->|no| J@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Restore RHEL", pos: "b", h: 96, constraint: "on" }
H -->|yes| K@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Post-check Windows", pos: "b", h: 96, constraint: "on" }
H -->|no| L@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Restore Windows", pos: "b", h: 96, constraint: "on" }
I --> M@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/glossary/converge-node.svg", label: "Converge", pos: "b", h: 96, constraint: "on" }
J --> M
K --> M
L --> M
M --> N@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Compliance Report", pos: "b", h: 96, constraint: "on" }
classDef noBorder fill:transparent,stroke:transparent
class A,B,C,D,E,F,G,H,I,J,K,L,M,N noBorder
Playbooks
Playbooks are hosted in ansible/product-demos.
| Playbook | What it does | Runs on |
|---|---|---|
snapshot_ec2.yml
|
Takes EBS snapshots of target EC2 instances before patching begins. | AWS (localhost) |
patch_pre_check_rhel.yml
|
Queries dnf for targeted advisory applicability on RHEL hosts. | RHEL hosts |
patch_rhel.yml
|
Applies specific RHSA/CVE advisories via dnf. | RHEL hosts |
patch_post_check_rhel.yml
|
Verifies advisories are resolved after patching on RHEL. | RHEL hosts |
patch_pre_check_windows.yml
|
Queries Windows Update Agent for targeted KB applicability. | Windows hosts |
patch_windows.yml
|
Installs specific KB updates via win_updates. | Windows hosts |
patch_post_check_windows.yml
|
Verifies KBs are installed after patching on Windows. | Windows hosts |
restore_ec2.yml
|
Restores EC2 volumes from the latest EBS snapshot when patching fails. | AWS (localhost) |
patch_compliance_report.yml
|
Generates an HTML compliance dashboard on the report server. | Report server |
Demo ideas
- Deploy the product-demos cloud stack, import the AO workflow, and walk through snapshot → parallel patch → compliance report
- Fail a Windows patch deliberately to show the restore branch and converge still reaching the report step