Intro: A production-grade patching workflow for Ubuntu Linux servers uses Ansible and AWX with a safe, test-first approach that stops applications before patching and validates outcomes after.

The process is a four-phase workflow—Pre-Check, Patch, Post-Check, and Validate—organized as separate AWX job templates to ensure control and traceability.

Pre-Check details include gathering the current kernel version, identifying the latest kernel, checking disk space, detecting pending reboots, evaluating uptime and system load, scanning for available updates, and verifying application status before patching.

Patch phase actions involve stopping the application, applying package updates (including security updates), removing unused packages, rebooting if needed, then restarting the application and confirming it runs post-patch.

Application-specific stop/start: The workflow uses a stop command for the target app (IRIS in the example) before patching and a start command after reboot, with guidance to adapt these commands for other apps.

Playbook variables include log_dir for per-host logs, app_stop_cmd and app_start_cmd for controlling the application, and reboot_timeout to manage reboots.

Logging and auditing: Pre-check and post-check results are saved as timestamped logs on the Ansible controller for auditability and review prior to approval.

Post-check items capture the new kernel version, system uptime after reboot, recently installed packages, and disk space after patching, and save a post-check log.

Validate phase summarizes patch results, performs a final ping and application status check, and confirms whether the IRIS service is running.

AWX architecture includes an approval step between Pre-Check and Patch and uses serial execution (one server at a time) to minimize risk across the fleet.

The workflow offers production confidence through strict checks, application safety, full audit trails, intelligent skipping when up to date, clear AWX visibility, and a human approval checkpoint before patching.

Testing discipline: Patch plans are tested in a homelab before live deployment to avoid impacting production environments.