Security & Compliance, Detect and Alert on Infrastructure Configuration Drift with Ansible

Detect and alert on infrastructure configuration drift with Ansible and Kestra. This blueprint runs an idempotent Ansible playbook across a fleet of hosts, inspects the per-host results, and notifies Slack only when a host actually changed, so your team hears about real drift instead of a green run every night. It turns Ansible's natural idempotency into a continuous compliance signal: if a managed setting was edited out of band, the playbook corrects it and you get told; if nothing changed, you stay quiet.

How it works

1. set_up_env is an io.kestra.plugin.ansible.cli.AnsibleCLI task that ships an inline inventory.ini (three example servers) and an inline myplaybook.yml as inputFiles. The playbook uses lineinfile to enforce MY_APP_MODE=production in each host's .bashrc and notifies a handler to refresh the environment.
2. The task runs on io.kestra.plugin.core.runner.Process with an inline ansibleConfig that sets the Python interpreter, writes a log to {{ workingDir }}/ansible.log, and uses the yaml stdout callback so results parse cleanly. The command is ansible-playbook -i inventory.ini myplaybook.yml.
3. loop_hosts is an io.kestra.plugin.core.flow.ForEach over {{ outputs.set_up_env.vars.outputs }}, iterating the per-host Ansible results.
4. check_drift is an io.kestra.plugin.slack.notifications.SlackIncomingWebhook guarded by runIf: "{{ (taskrun.value | jq('.changed') | first) == true }}", so a message is posted only for hosts where Ansible reported a change. The message includes the Ansible msg for context.
5. A check_nightly io.kestra.plugin.core.trigger.Schedule trigger (cron: 0 3 * * *, shipped disabled: true) runs the drift check every night once enabled.

What you get

• Continuous, per-host drift detection driven by Ansible idempotency.
• Slack alerts that fire only on real change, eliminating nightly noise.
• A reproducible, inline Infrastructure as Code definition with no external repo required.
• A ready-to-schedule nightly compliance check.

Who it's for

• Security and compliance teams enforcing configuration baselines.
• Platform and infrastructure engineers managing server fleets with Ansible.
• SREs who want signal-only alerting on configuration changes.

Why orchestrate this with Kestra

Ansible has no built-in scheduler, no durable run history, and no native conditional alerting per host. Kestra adds event and schedule triggers, automatic retries, full execution lineage and logs, and declarative YAML you keep in Git. The runIf expression and ForEach loop let you branch on Ansible's own output and notify selectively, which an ansible-playbook cron job on a box cannot do without bespoke scripting.

Prerequisites

• Ansible available to the Process task runner (or swap in a Docker runner with Ansible installed).
• SSH reachability and credentials for the target hosts in your inventory.

Secrets

• SLACK_WEBHOOK: the Slack Incoming Webhook URL used by check_drift.

Quick start

1. Add the SLACK_WEBHOOK secret in Kestra.
2. Replace the inline inventory.ini hosts and SSH details with your real targets.
3. Adjust myplaybook.yml to enforce the settings you care about.
4. Run the flow once manually and confirm Slack fires only for changed hosts.
5. Enable the check_nightly trigger to run the check on a schedule.

How to extend

• Load inventory and playbooks from Git instead of inline inputFiles.
• Swap the Process runner for a Docker or Kubernetes task runner.
• Route alerts to PagerDuty, email, or a ticketing system in addition to Slack.
• Add check_mode to report drift without correcting it, or aggregate results into a compliance report.

Links

• Ansible plugin docs
• Orchestrate Ansible with Kestra