We are trying to upgrade our Ubuntu server fleet, and want to run a command like "apt-get upgrade" across each server. ** The caveat here is that we do not want upgrade any kernel and our application specific packages. When I manually do an "apt-get upgrade" on a server, I see a section that omits these packages that says "The following packages have been kept back", which is exactly what we want.
However in the apt module for ansible, I can't find a series of options that mimics "apt-get upgrade" exactly. The closest I got was the below, but this executed a "apt-get upgrade --with-new-packages", and thus this upgraded kernel and our application related packages, which was not desired. We don't want to upgrade these packages, as a part of this patching effort (will do separately and with proper downtime windows, etc)
Kindly looking for some help on the proper way to do this. Is using the shell/command module for this a bad idea?
Thank you!
---
- name: Test Upgrade of Server
hosts: all
serial: 1
gather_facts: no
tasks:
- name: Apply patches
apt:
only_upgrade: yes
force_apt_get: yes
upgrade: safe
update_cache: yes
register: apt_output
- name: Check Output
debug: var=apt_output.stdout_lines