Job Templates and Workflows

The 12-Step Deployment That Took 4 Hours

Our application deployment process had 12 steps: database backup, pre-deployment checks, blue-green deployment, health checks, rollback capability, post-deployment validation, notification to teams, and documentation updates.

Running these steps manually took 4 hours. Each step had dependencies. Mistakes happened. Rollbacks were messy. And we deployed 3 times per week.

That's when I learned about AAP workflows. I built a visual workflow with all 12 steps, conditional logic (skip rollback if successful), approval gates (require manager approval for production), and automated notifications.

Deployment time: 4 hours → 15 minutes. Error rate: 15% → 0.5%. Team happiness: Significantly improved.

What You'll Learn

• Building parameterized job templates with surveys

• Workflow visual designer for multi-step automation

• Conditional workflows and approval nodes

• Notification integrations (Slack, email, webhooks)

• Scheduling recurring jobs

• Limit patterns and tag usage

• Workflow best practices at scale

Advanced Job Template Features

Survey - User Input Interface

Survey Configuration:
  Question 1:
    Prompt: "Application Version"
    Variable: app_version
    Type: Text
    Default: "latest"
    Required: Yes
    
  Question 2:
    Prompt: "Target Environment"
    Variable: target_env
    Type: Multiple Choice
    Options: [dev, staging, production]
    Required: Yes
    
  Question 3:
    Prompt: "Enable Feature Flags"
    Variable: feature_flags
    Type: Multiselect
    Options: [new_ui, experimental_api, beta_search]
    Required: No
    
  Question 4:
    Prompt: "Deployment Mode"
    Variable: deployment_mode
    Type: Multiple Choice
    Options: [blue_green, rolling, canary]
    Default: rolling

Real-world use: Developers select version and environment via simple web form, no Ansible knowledge required.

Limit Patterns

# Run on specific hosts
Limit: web01,web02

# Run on all webservers
Limit: webservers

# Run on production webservers
Limit: webservers:&production

# Run on webservers except web01
Limit: webservers:!web01

# Complex patterns
Limit: (webservers:&production):!maintenance_mode

Tag Management

Playbook with Tags:
  - name: Deploy application
    hosts: all
    tasks:
      - name: Backup database
        tags: [backup, pre-deploy]
      
      - name: Deploy code
        tags: [deploy, code]
      
      - name: Run migrations
        tags: [deploy, database]
      
      - name: Restart services
        tags: [deploy, services]
      
      - name: Run tests
        tags: [post-deploy, validate]

Job Template:
  Job Tags: deploy,services  # Only run deploy+services tasks
  Skip Tags: backup          # Skip backup tasks

Workflow Templates

Creating Workflows

Scenario: Application Deployment Workflow

Workflow Steps:
  1. Pre-Deployment Checks (Job Template)
     ├─ Success → Continue
     └─ Failure → Notify & Stop
  
  2. Approval Node (Requires Manager Approval)
     └─ Approved → Continue
  
  3. Database Backup (Job Template)
     └─ Always → Continue
  
  4. Deploy Application (Job Template)
     ├─ Success → Health Check
     └─ Failure → Rollback
  
  5. Health Check (Job Template)
     ├─ Success → Post-Deploy Tasks
     └─ Failure → Rollback
  
  6. Rollback (Job Template, conditional)
     └─ Always → Notify Failure
  
  7. Post-Deploy Validation (Job Template)
     └─ Success → Notify Success

Workflow Visual Designer

# In AAP Web UI: Resources → Templates → Add → Workflow Template

Nodes:
  - Type: Job Template
    Name: "Pre-Flight Checks"
    Convergence: Any (run if any path leads here)
    
  - Type: Approval
    Name: "Manager Approval Required"
    Timeout: 3600  # 1 hour
    
  - Type: Job Template
    Name: "Deploy Application"
    Limit: "{{ target_env }}"  # From workflow extra vars
    
  - Type: Inventory Sync
    Name: "Refresh Cloud Inventory"
    
  - Type: Project Sync
    Name: "Update Playbooks from Git"

Links Between Nodes:
  Run: Always (green)
  Run on Success: (blue)
  Run on Failure: (red)

Conditional Logic Example

Real-world deployment workflow:

1. START
   └─ Always → Sync Inventory

2. Sync Inventory
   └─ Success → Pre-Deployment Checks

3. Pre-Deployment Checks
   ├─ Success → Approval Gate
   └─ Failure → Notify Ops Team (STOP)

4. Approval Gate (production only)
   ├─ Approved → Database Backup
   └─ Denied → Notify Denied (STOP)

5. Database Backup
   └─ Always → Deploy Application

6. Deploy Application
   ├─ Success → Health Checks
   └─ Failure → Rollback Deployment

7. Health Checks
   ├─ Success → Post-Deploy Tasks
   └─ Failure → Rollback Deployment

8. Rollback Deployment
   ├─ Success → Notify Rollback Complete
   └─ Failure → Escalate to On-Call

9. Post-Deploy Tasks
   ├─ Success → Integration Tests
   └─ Failure → Log Warning (continue)

10. Integration Tests
    ├─ Success → Notify Success
    └─ Failure → Notify Partial Success

11. Notify Success → END

Approval Nodes

Configuration

Approval Node:
  Name: "Production Deployment Approval"
  Timeout: 7200  # 2 hours
  
Notifications:
  - Type: Slack
    On Approval Pending: Yes
    Message: "@managers Deployment {{ workflow_job_id }} needs approval"
  
RBAC:
  Approvers: [managers-team, ops-lead]
  Can Deny: Yes

Approval Process:

1. Workflow reaches approval node

2. Notification sent to approvers

3. Approver visits AAP UI or API

4. Click Approve or Deny with optional comment

5. Workflow continues or stops

Real-world use: All production deployments require approval, automatically notifies managers via Slack.

Notification Integrations

Slack Notifications

Notification:
  Name: "Deploy Status to Slack"
  Type: Slack
  Webhook URL: https://hooks.slack.com/services/XXX/YYY/ZZZ
  
  Trigger Events:
    - Workflow Started
    - Workflow Success
    - Workflow Failure
  
  Message Template:
    Workflow: {{ workflow_job_template_name }}
    Status: {{ status }}
    Duration: {{ elapsed }} seconds
    User: {{ created_by }}
    URL: {{ workflow_url }}

Email Notifications

Notification:
  Name: "Email Ops Team"
  Type: Email
  To: [email protected]
  
  Trigger Events:
    - Job Failure
    - Workflow Approval Pending
  
  Subject: "[AAP] {{ job_template_name }} - {{ status }}"
  
  Body:
    Job: {{ job_template_name }}
    Inventory: {{ inventory_name }}
    Failed Tasks: {{ failed_tasks }}
    Error: {{ result_traceback }}

Webhook Notifications

Notification:
  Name: "Trigger CI/CD Pipeline"
  Type: Webhook
  URL: https://gitlab.example.com/api/v4/projects/123/trigger/pipeline
  HTTP Method: POST
  HTTP Headers:
    Content-Type: application/json
    PRIVATE-TOKEN: gitlab_token_here
  
  Trigger: Job Success
  
  Body:
    {
      "ref": "main",
      "variables": {
        "DEPLOY_ENV": "{{ extra_vars.target_env }}",
        "APP_VERSION": "{{ extra_vars.app_version }}"
      }
    }

Real-world integrations:

Our Setup:
  - Slack: All workflow status updates
  - Email: Failures and approvals
  - ServiceNow: Create change tickets
  - Webhook: Trigger downstream pipelines
  - PagerDuty: Critical failures

Scheduling Jobs

Simple Schedule

Schedule:
  Name: "Nightly Patching"
  Job Template: "System Updates"
  RRULE: DTSTART:20260106T020000Z RRULE:FREQ=DAILY;INTERVAL=1
  # Runs daily at 2:00 AM UTC

Complex Schedules

# Every weekday at 6 AM
RRULE: DTSTART:20260106T060000Z RRULE:FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR

# First Monday of every month
RRULE: DTSTART:20260106T060000Z RRULE:FREQ=MONTHLY;BYDAY=1MO

# Every 4 hours
RRULE: DTSTART:20260106T000000Z RRULE:FREQ=HOURLY;INTERVAL=4

# Last day of every month
RRULE: DTSTART:20260131T230000Z RRULE:FREQ=MONTHLY;BYMONTHDAY=-1

Real-world schedules:

Daily:
  - Backup jobs: 2 AM
  - Inventory sync: Every 4 hours
  - Health checks: Every hour
  
Weekly:
  - Security patching: Sunday 3 AM
  - Certificate renewal check: Monday 1 AM
  - Cleanup old logs: Saturday midnight
  
Monthly:
  - Compliance reporting: 1st of month
  - Credential rotation: 15th of month

Key Takeaways

✅ Surveys provide user-friendly input interfaces ✅ Workflows orchestrate complex multi-step automation ✅ Approval nodes enforce change management ✅ Notifications integrate with collaboration tools ✅ Scheduling enables hands-off recurring automation ✅ Conditional logic handles success and failure paths

What's Next

The next article covers RBAC and Multi-Tenancy - designing organization structures, team permissions, resource-level access control, and compliance auditing for enterprise environments.

---

Next Article: RBAC and Multi-Tenancy in AAP →

---

Part of the Ansible Automation Platform 101 Series