fix: harden Windows update reboot recovery and parameterize warpgate AMI regions - #395
Merged
mwendigg merged 1 commit intoAug 3, 2026
Conversation
**Added:**
- Connection recovery steps after reboot and after updates using `wait_for_connection`, which re-attempts downed connections to ride out a wedged SSM channel that `until`/`rescue` cannot handle - `settings_updates/tasks/main.yml`
- Explicit assertion that fails with update attempt count and error message if Windows updates did not complete - `settings_updates/tasks/main.yml`
- Documentation of the new recovery, wait, and assert steps - `settings_updates/README.md`
**Changed:**
- Increased reboot resilience by raising `reboot_timeout` to 1800 and `post_reboot_delay` to 60, and tolerating errors on reboot and update tasks so failures fall through to the recovery and assert logic - `settings_updates/tasks/main.yml`
- Parameterized the base AMI SSM image ARN with `${aws_region}` instead of a hardcoded `us-west-1` across all warpgate templates
- Reduced AMI `volume_size` from 100 to 50 across all warpgate templates
l50
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Key Changes:
Added:
wait_for_connectiontasks after both the pending-operations reboot and the update install step insettings_updates/tasks/main.yml, sincewait_for_connectionre-attempts a downed connection whereasuntil/rescuecannot ride out a wedged SSM channel on 'unreachable'asserttask that fails with a descriptive message (including attempt count and error) if Windows updates did not complete, ensuring a genuinely dead box is caught rather than silently passingChanged:
reboot_timeoutto 1800 andpost_reboot_delayto 60, and setignore_errors: trueon the reboot and update tasks so a wedged SSM poll falls through to the new recovery and assert logic instead of failing outright (settings_updates/tasks/main.yml)us-west-1in the SSM parameter ARN with the${aws_region}variable across all GOAD warpgate templates (goad-dc-base,goad-dc-base-2016,goad-mssql-base,goad-mssql-base-2016)volume_sizefrom 100 to 50 for all GOAD warpgate build targets to reduce cost and build footprintsettings_updates/README.mdto reflect the new connection recovery and update assertion tasks in the task list