Ansible Rolling Update Best Practices with HAProxy
A company uses Ansible to perform a rolling update of 10 web servers behind an HAProxy load balancer. The playbook uses the `serial` keyword and includes tasks to disable a host from the load balancer, update the web server package, and re-enable the host. Which TWO best practices should the administrator apply to minimize downtime and ensure a successful rolling update?
Quick Answer
Ensuring the load balancer's draining timeout is longer than the maximum expected update time per host is correct because a rolling update behind a load balancer only actually protects users if the load balancer's own timing lines up with the playbook's timing. Draining a host means letting existing connections finish and stopping new ones from being routed to it, and if that draining window is too short, the load balancer may consider the host safely removed and let the playbook proceed, or worse, allow the host back into rotation before its package update has actually finished, serving traffic from a host that is mid-update or not yet ready. Matching the draining timeout to the real-world time an update takes is what keeps the load balancer's view of host state honest relative to what the playbook is actually doing. This works alongside a small serial value, such as serial: 1, which limits how many hosts go through the disable-update-re-enable cycle at once and is the other best practice this scenario points to. Whenever a rolling update playbook interacts with an external system like a load balancer, health check, or service registry, the playbook's per-host timing and that external system's timing need to agree, or the automation can end up out of sync with what the infrastructure believes is actually happening.
⚠ Common exam trap
It's easy for candidates to confuse `serial` with `throttle` or `async`; candidates often think `throttle` or `async` can achieve the same serialization, but only `serial` ensures one host completes the entire update cycle before the next begins, which is essential for minimizing downtime in a rolling update scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set `serial: 1` to update one host at a time.
Setting `serial: 1` ensures that only one host is updated at a time, which is the safest way to perform a rolling update without overwhelming the load balancer or causing a service outage. This allows the playbook to complete the full update cycle (disable, update, re-enable) for each host before moving to the next, minimizing the number of hosts out of service simultaneously.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use `any_errors_fatal: true` to stop the playbook if any host fails.
Why it's wrong here
This would halt the entire update on the first failure, which is not desirable for a rolling update where individual host failures are acceptable.
- ✓
Set `serial: 1` to update one host at a time.
Why this is correct
Updating one host at a time minimizes the impact on the load balancer pool and ensures continuous service availability.
- ✗
Use `throttle: 1` to limit the number of concurrent tasks across all hosts.
Why it's wrong here
Throttle limits task concurrency but does not control the batch size within a rolling update; it is not a substitute for serial.
- ✓
Ensure the load balancer draining timeout is longer than the maximum expected update time per host.
Why this is correct
This prevents the host from being re-enabled while the update is still in progress, avoiding serving traffic with an incomplete update.
- ✗
Use `async` and `poll` to run the update tasks in the background while proceeding to the next host immediately.
Why it's wrong here
Async is not appropriate because the update must complete before the host is re-enabled; background execution could lead to premature re-enablement.
Go deeper
Related to this question
About these practice questions
One of 520 original EX294 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on EX294
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An Ansible Engineer is planning a rolling update for a web application deployed across 10 nodes. The playbook uses the 'delegate_to' directive to manage load balancer health checks. Which of the following best describes the recommended approach to minimize downtime?
medium- ✓ A.Use 'serial: 1' and delegate load balancer disable/enable tasks to localhost, ensuring each node is taken out of rotation before updating.
- B.Run the update playbook with 'serial: 10' to update all nodes at once, then run a separate playbook to update the load balancer.
- C.Run the update on each node manually using 'ansible-playbook --limit' and skip load balancer management to save time.
- D.Use 'strategy: free' to allow nodes to update independently without controlling the load balancer.
Why A: Using 'serial: 1' ensures that only one node is updated at a time, and delegating load balancer disable/enable tasks to localhost (or the Ansible control node) allows the playbook to interact with the load balancer API to remove the node from the pool before the update and re-add it after. This minimizes downtime by ensuring traffic is not sent to a node being updated, while other nodes continue serving requests.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX294 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX294 exam.