Automating Linux Server Patching with Ansible

Manual patching doesn’t scale past a handful of servers, and it’s easy to skip when you’re busy. A short Ansible playbook makes it consistent and repeatable.

The playbook

- name: Patch Linux servers
  hosts: linux
  become: true
  serial: 2          # patch two servers at a time
  tasks:
    - name: Apply all updates
      ansible.builtin.dnf:
        name: '*'
        state: latest
      register: updates

    - name: Check whether a reboot is required
      ansible.builtin.command: needs-restarting -r
      register: reboot_check
      failed_when: false
      changed_when: false

    - name: Reboot if required
      ansible.builtin.reboot:
      when: reboot_check.rc == 1

Why this works

• serial: 2 keeps most of your fleet online while a batch is patched.
• The reboot only happens when the kernel or core libraries changed.
• Running it with --check first shows exactly what would change.

Next steps

Schedule it, send the output to your chat channel, and keep a simple record of patch dates per server. That record is often the first thing an auditor asks for.