Ansible version: 2.16.19, due to some RHEL8 servers in our inventory
Hello everyone,
I am experiencing difficulties with applying automatic updates with Ansible. We have several servers where we would like to automate the installation of updates. These servers are behind a restrictive firewall that is causing some issues, blocking access to necessary sources. However, the results are consistently inconsistent; when we run dnf upgrade, an upgrade is performed successfully. It takes a while, but it works very consistently. Meanwhile, with Ansible, I try to apply updates as follows:
- name: Update all packages except excluded (dnf based)
ansible.builtin.dnf:
name: "*"
state: latest
update_only: true
update_cache: "{{ update_linux_packages_update_cache }}"
cacheonly: "{{ update_linux_packages_cache_only }}"
exclude: "{{ update_linux_packages_exclude | join(',') }}"
disablerepo: "{{ update_linux_packages_disable_repo | join(',') }}"
when: ansible_facts.pkg_mgr == 'dnf'
This is part of a role, hence the configurable cache and exclusions. If we run with the module default parameters (cacheonly == false & update_cache == false) or force updating the cache, it fails because it cannot access repository metadata:
fatal: [server0102]: FAILED! => {
"attempts": 3,
"changed": false,
"msg": "Failed to download metadata for repo 'packages-microsoft-com-prod': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried",
"rc": 1,
"results": []
}
Meanwhile, when we ensure that the cache isn’t updated, it fails because the cache is invalid:
fatal: [server0102]: FAILED! => {
"attempts": 3,
"changed": false,
"failures": [],
"msg": "Unknown Error occurred: Some packages have invalid cache, but cannot be downloaded due to \"--cacheonly\" option",
"rc": 1,
"results": []
}
As stated earlier, our firewall is very restrictive. I can see it blocking the required sources, which explains the errors. What it doesn’t explain is why it goes right when we do the command manually. I see no difference in traffic; a lot of it is blocked when running the command as well. So, I would like some insight what the module does that makes it so that it fails. Is it checking other sources that need to be allowlisted? Or is it checking less mirrors than the system dnf? Any tips would be appreciated.
Final note: This can be solved by expanding our allowlist, but I would just like some insight as to why this occurs in the first place.