Guarded Fleet Change: Policy-Gated Ansible Rollouts

Large Linux fleet changes often fail for avoidable reasons: a stale backup, both members of an HA pair taken down together, skipped staging, or a plan nobody reviewed. This tool moves those decisions into checks that run before Ansible executes.

Plan: selects hosts, excludes any that fail readiness checks, and groups the rest into a staging canary, staging waves, then production waves. The plan gets a SHA-256 digest.

Policy gate: re-validates the plan independently, so a hand-edited plan is still caught.

Approval: rejects plans with violations and self-approval, and binds the approval to the exact plan digest.

Run: check mode with diff by default; applying requires a matching approval and every earlier wave complete.

Health gate: halts a wave if the service isn't healthy afterwards.

Denies a first wave that isn't a single staging canary, waves above a set share of the fleet, both halves of an HA pair in one wave, hosts that fail readiness, returning to staging after production starts, and changes inside a freeze window. Readiness excludes hosts with an unsupported OS, no monitoring, or a production backup older than 24 hours.

An Ansible role migrates Linux identity to SSSD: it backs up identity files, configures SSSD, validates it, and restores the originals automatically if any step fails.

Unit tests cover the planner, policy, digest, approval and wave-order gates. ansible-lint checks the role against the production profile, and Molecule runs converge, idempotence and verify on Rocky Linux 9 and Ubuntu 24.04.

All hosts and data are synthetic. This is a personal portfolio project, not client work.