aim-web2.1.0rc9

2026-09-22 19:23:17 +02:00
parent d095887d2e
commit 3dfc80b782
438 changed files with 31613 additions and 1510 deletions
@@ -0,0 +1,48 @@
+# maintenance_patch_os
+
+Operator defaults are intentionally low-precedence; inventory and explicit run options
+may override them.
+
+```yaml
+---
+os_patching_reboot: true
+os_patching_windows_categories:
+  - SecurityUpdates
+  - CriticalUpdates
+  - UpdateRollups
+  - DefinitionUpdates
+  - Updates
+os_patching_reboot_timeout: 600
+os_patching_reboot_delay_minutes: 0
+os_patching_reboot_message: 'AIM maintenance: operating system patching requires a reboot.'
+os_patching_rescan_after_reboot: false
+```
+
+`os_patching_reboot_delay_minutes` is shared across Windows/Linux so the public setting
+has one meaning. Linux reboot scheduling is minute-granular. Windows converts the value
+to seconds; a zero-minute reboot still observes the Windows reboot module's minimum delay.
+The message is displayed by the native reboot module when AIM actually initiates a reboot.
+
+When automatic reboot is disabled, newly installed updates can legitimately leave
+`reboot_deferred: true` while the patch run itself succeeds. A later run that detects the
+already-pending reboot fails before starting new patch work and tells the operator to
+reboot manually or enable the reboot option.
+
+## Structured result integration
+
+Current reporting behavior and field semantics are specified in
+[scripts/docs/OPERATION_RESULTS.md](../../scripts/docs/OPERATION_RESULTS.md).
+Runbook-owned filters normalize only reviewed fields; arbitrary package-manager/module
+results are not exported.
+
+## Windows patch waves
+
+Windows uses the native `ansible.windows.win_updates` batch/orchestration path for the
+currently selected categories. AIM calls it with `reboot: false`, so Windows Update may
+process all updates in that current wave while AIM retains control over the reviewed reboot
+message, delay and continuation policy. AIM does not create a per-update install queue.
+
+The default `os_patching_rescan_after_reboot: false` stops the run after any AIM-performed
+reboot boundary; a new operator-approved run discovers the next wave. Set it to true only
+when the operator explicitly wants AIM to start another wave after reboot. A deferred reboot
+always stops the run.