VM Patching over SSH with Approval and Automatic Rollback

id: ssh-patch-vm-approval-rollback
namespace: company.team
description: |
  Apply a package patch to a VM over SSH, pause for human validation, and roll
  back to the previous version automatically if the patch fails or is rejected.
  Returns a structured result so a parent flow can stage patches UAT then prod.

inputs:
  - id: vmType
    type: SELECT
    values:
      - uat
      - prod
    defaults: uat
  - id: vmName
    type: STRING
    description: Hostname or IP of the VM to patch.
    defaults: uat-server-01
  - id: patchId
    type: STRING
    description: "Patch identifier as reported by apt list --upgradable."
    defaults: "apt/focal-updates 2.0.11 amd64 [upgradable from: 2.0.10]"

tasks:
  - id: takeSnapshot
    type: io.kestra.plugin.core.log.Log
    description: "Stub: replace with your hypervisor or cloud snapshot API call."
    message: Taking snapshot before patching.

  - id: patchVM
    type: io.kestra.plugin.fs.ssh.Command
    description: Install the target package version.
    host: "{{ inputs.vmName }}"
    port: "22"
    authMethod: PASSWORD
    username: "{{ secret('SSH_VM_USER') }}"
    password: "{{ secret('SSH_VM_PASSWORD') }}"
    commands:
      - apt update
      - apt install -y {{ (inputs.patchId | split('/'))[0] }}

  - id: checkSuccess
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.patchVM.exitCode == 0 }}"
    then:
      - id: notifyChannel
        type: io.kestra.plugin.notifications.slack.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {
            "text": "Patch {{ inputs.patchId }} has been successfully applied on {{ inputs.vmType | upper }} VM {{ inputs.vmName }}. Please validate, then approve {% if inputs.vmType == 'uat' %}promotion to the production VM {% endif %}or reject to roll back (execution {{ execution.id }})."
          }

      - id: waitForApproval
        type: io.kestra.plugin.core.flow.Pause
        onResume:
          - id: approvePatch
            description: Whether to approve the patch
            type: BOOL
            defaults: false
          - id: reason
            description: Reason for approval or rejection
            type: STRING

  - id: rollBackIfRequired
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.patchVM.exitCode != 0 or
      outputs.waitForApproval.onResume.approvePatch == false }}"
    then:
      - id: rollBackVM
        type: io.kestra.plugin.fs.ssh.Command
        description: Reinstall the previous package version parsed from the patch id.
        host: "{{ inputs.vmName }}"
        port: "22"
        authMethod: PASSWORD
        username: "{{ secret('SSH_VM_USER') }}"
        password: "{{ secret('SSH_VM_PASSWORD') }}"
        commands:
          - apt update
          - "apt install -y {{ (inputs.patchId | split('/'))[0] }}={{
            ((inputs.patchId | split('from: '))[1] | split(']'))[0] }}"

  - id: patchState
    type: io.kestra.plugin.core.output.OutputValues
    values:
      state: "{{ (outputs.patchVM.exitCode == 0 and
        outputs.waitForApproval.onResume.approvePatch == true) ? 'SUCCESS' :
        'FAILED' }}"
      reason: "{{ outputs.patchVM.exitCode != 0 ? 'Patch failed' :
        outputs.waitForApproval.onResume.reason }}"

  - id: rollBackState
    type: io.kestra.plugin.core.output.OutputValues
    runIf: "{{ outputs.rollBackIfRequired.evaluationResult == true }}"
    values:
      state: "{{ outputs.rollBackVM.values.exitCode == 0 ? 'SUCCESS' : 'FAILED' }}"
      reason: "{{ outputs.rollBackVM.values.exitCode != 0 ? 'Rollback failed' :
        'Rollback success' }}"

outputs:
  - id: actionPerformed
    type: STRING
    value: "{{ outputs.rollBackIfRequired.evaluationResult == true ? 'ROLLBACK' :
      'PATCH' }}"
  - id: actionState
    type: STRING
    value: "{{ outputs.rollBackIfRequired.evaluationResult == true ?
      outputs.rollBackState.values.state : outputs.patchState.values.state }}"
  - id: stateReason
    type: STRING
    value: "{{ outputs.rollBackIfRequired.evaluationResult == true ?
      outputs.rollBackState.values.reason : outputs.patchState.values.reason }}"
  - id: actionCause
    type: STRING
    value: "{{ outputs.waitForApproval.onResume.reason ?? 'Patching failed. Not sent
      for approval.' }}"
  - id: vmName
    type: STRING
    value: "{{ inputs.vmName }}"