Nutanix safe patching with snapshot rollback

Patch Nutanix AHV virtual machines safely with an automated snapshot, update, verify, and rollback pipeline. This blueprint provisions a Nutanix AHV VM, takes a pre-patch snapshot, applies operating system updates over SSH, runs a health check, and notifies Slack on success. If anything goes wrong, it restores the snapshot automatically and alerts on-call, so a failed patch never leaves a VM in a broken state. It solves the classic problem of risky, manual OS patching by wrapping every step in declarative, auditable orchestration with built-in safety nets.

How it works

1. provision_vm (io.kestra.plugin.ee.nutanix.ahv.CreateVm) creates the AHV VM in the target cluster with wait: true and emits a VM asset for lineage.
2. safe_patching_block (io.kestra.plugin.core.flow.Sequential) runs the patch sequence in order:
   • pre_patch_snapshot (io.kestra.plugin.ee.nutanix.snapshot.CreateVmSnapshot) snapshots the VM and emits a snapshot asset linked to the VM.
   • apply_updates (io.kestra.plugin.scripts.shell.Commands) connects over SSH and runs apt update && apt upgrade -y && reboot.
   • wait_for_boot (io.kestra.plugin.core.flow.Pause) pauses for PT1M while the VM reboots.
   • health_check (io.kestra.plugin.core.http.Request) issues a GET to the VM /health endpoint.
   • notify_success (io.kestra.plugin.slack.notifications.SlackIncomingWebhook) posts a success message to Slack.
3. On any failure, the errors branch runs rollback (RestoreVmSnapshot) to restore the pre-patch snapshot, notify_oncall to alert Slack, and cleanup_snapshot (DeleteVmSnapshot) to remove the snapshot.

What you get

• Zero-downtime-minded patching with an automatic safety net.
• Automated rollback to a known-good snapshot when a patch breaks the VM.
• VM and snapshot assets emitted for end-to-end lineage and auditing.
• Slack notifications for both success and failure paths.

Who it's for

• Platform and infrastructure engineers running Nutanix AHV.
• SRE and on-call teams responsible for patch hygiene and uptime.
• IT operations teams that need auditable, repeatable change windows.

Why orchestrate this with Kestra

Nutanix tooling can create VMs and snapshots, but it has no native way to sequence snapshot, patch, health-check, and conditional rollback as one governed pipeline. Kestra adds event and schedule triggers, retries, automatic error handling, and asset lineage across the VM and its snapshots, all expressed as declarative YAML you can version and review. The errors block guarantees rollback runs on failure, something a standalone hypervisor scheduler cannot coordinate across SSH, HTTP, and Slack.

Prerequisites

• A reachable Nutanix Prism Central endpoint and a target AHV cluster.
• SSH access to the provisioned VM with sudo privileges.
• A Slack incoming webhook for notifications.

Secrets

• NUTANIX_HOST
• NUTANIX_TOKEN
• NUTANIX_CLUSTER_EXT_ID
• SLACK_WEBHOOK

Quick start

1. Add the secrets above to your Kestra instance.
2. Set NUTANIX_CLUSTER_EXT_ID to your target cluster external ID.
3. Adjust the vm_name input if needed.
4. Execute the flow and watch the snapshot, patch, and health-check run.
5. Trigger a failure to confirm rollback and on-call alerting work.

How to extend

• Replace the apt commands with your distribution package manager or a configuration tool.
• Add approval gates or a maintenance-window schedule trigger before patching.
• Loop over a fleet of VMs with io.kestra.plugin.core.flow.ForEach.
• Push patch results to a CMDB or ticketing system after health_check.

Links

• Plugin docs: https://kestra.io/plugins/plugin-ee-nutanix
• Orchestrate Nutanix with Kestra: https://kestra.io/orchestration/nutanix