It is too easy to run playbooks on the wrong hosts in Ansible
I know the best practice would be to use --limit to make sure you can not select the wrong host. I do not trust --limit to ensure Ansible runs playbooks only on the intended hosts.
Is it a crazy idea to use firewalld to disable communication to all the systems you do not want to update? Is there a more logical way to accomplish the same thing?
Q: "Disable communication to all the systems you do not want to update."
A: The only safe way is to physically isolate such environment. A firewall might be an option. But, it's not feasible if you want to keep ssh or other connections that Ansible might use.
On the configuration level, there are many options.
1) Special user
Create a special user for this purpose on the systems you want to update. For example user ansible_update. Depending on your environment configure the DEFAULT_REMOTE_USER to ansible_update. This way you make sure no other systems can be connected by mistake.
In addition to this, you control who can connect to these systems by putting their public keys into the authorized_keys of the user ansible_update at the remote hosts.
To enforce this you have to:
2) Bastion host
A better option is creating a bastion host and making it the only source of the configuration for the environment.
3) ansible-pull
The most flexible option is configuring the remote hosts to pull their updates on their own.
Conclusion: Create special users, create a bastion host, and make the remote hosts pull the updates from it.
If you enable firewalld rule for ansible, how you want to disable it? Yeah, there are ways, but hey! we talk here about having some sense in the work.
Where is your environment? I assume it is not dynamic, as for dynamic environment you use dynamic inventory.
First idea - split hosts per environments and corresponding directories. This way you have to provide the correct env and file. It gives the time to think.
Not-very-good-solution - run ansible through script. Makefile, bash, whatever, with confirm action.
The best - use CI/CD. Of course, you can do the mistake there, but... only once ;)
If you are really paranoid, generate a custom inventory containing only the hosts you want to update, and pass that.
I think you might be approaching the problem backwards and are using "hosts: all" instead of specific groups, then limiting with --limit. But if not, here's a solution I've used to target specific hosts (such as those in their maintenance window) within an existing group.
I start running against hosts: all
Then I find some sort of limiting criteria like, use the url module to query my ticketing system to tell me which devices have open changes for patching or something.
Then I use "add_host" to create a temporary subgroup*
- name: Add a host alias that we reach through a tunnel (Ansible 2.0 and newer)
ansible.builtin.add_host:
ansible_host: '{{ inventory_hostname }}'
groups: subgroup
and I run against hosts: subgroup
*warning if you refresh your inventory, this will get hosed
