Ansible Ring-Based Patch Rollout

1---2# ─────────────────────────────────────────────────────────────────────────3# AIInfraEngine — Ring-based patch rollout4#5#   ansible-playbook patch-rollout.yml -i inventories/prod -e ring=canary6#   ansible-playbook patch-rollout.yml -i inventories/prod -e ring=broad --check7#8# Version: 3.6.09# ─────────────────────────────────────────────────────────────────────────10 11- name: "Patch rollout — ring {{ ring | default('canary') }}"12  hosts: "{{ ring | default('canary') }}"13  become: true14  serial: "{{ batch_size | default('20%') }}"15  any_errors_fatal: true          # one failed batch halts the whole wave16  max_fail_percentage: 017 18  vars:19    reboot_timeout: 90020    min_free_disk_mb: 204821    critical_services:22      - sshd23      - chronyd24    lb_drain_wait: 3025 26  pre_tasks:27    # ── Guard rails ────────────────────────────────────────────────────28    - name: Refuse to run inside a change freeze