Ansible cisco.intersight Module Example: Firmware and Port Configuration

At Red Hat Tech Day Netherlands 2026 (Bunnik, 3 June 2026), the Ansible team announced 12 new content collections landing in AAP 2.7. Among them, cisco.intersight ships 100+ modules aimed squarely at Day-2 network operations: firmware lifecycle and port configuration on Cisco UCS infrastructure managed through Intersight.

Example playbook

---
- name: Firmware and port configuration via cisco.intersight
  hosts: localhost
  gather_facts: false
  vars:
    intersight_api_key_id: "{{ lookup('env', 'INTERSIGHT_API_KEY_ID') }}"
    intersight_api_private_key: "{{ lookup('env', 'INTERSIGHT_API_PRIVATE_KEY') }}"
    organization: "default"

  tasks:
    - name: Gather current firmware version for target server profile
      cisco.intersight.intersight_firmware_info:
        api_key_id: "{{ intersight_api_key_id }}"
        api_private_key: "{{ intersight_api_private_key }}"
        organization: "{{ organization }}"
        server_profile: "ucs-server-profile-01"
      register: firmware_facts

    - name: Upgrade firmware to target bundle version
      cisco.intersight.intersight_firmware_upgrade:
        api_key_id: "{{ intersight_api_key_id }}"
        api_private_key: "{{ intersight_api_private_key }}"
        organization: "{{ organization }}"
        server_profile: "ucs-server-profile-01"
        firmware_version: "5.2(1a)"
        state: present
      when: firmware_facts.firmware_version != "5.2(1a)"
      register: firmware_upgrade

    - name: Configure uplink port role on fabric interconnect
      cisco.intersight.intersight_port_policy:
        api_key_id: "{{ intersight_api_key_id }}"
        api_private_key: "{{ intersight_api_private_key }}"
        organization: "{{ organization }}"
        policy_name: "port-policy-rack01"
        port_id: 17
        role: "uplink"
        admin_speed: "Auto"
        state: present

    - name: Wait for fabric interconnect reboot after firmware change
      cisco.intersight.intersight_firmware_info:
        api_key_id: "{{ intersight_api_key_id }}"
        api_private_key: "{{ intersight_api_private_key }}"
        organization: "{{ organization }}"
        server_profile: "ucs-server-profile-01"
      register: post_upgrade_facts
      until: post_upgrade_facts.firmware_version == "5.2(1a)"
      retries: 30
      delay: 60
      when: firmware_upgrade is changed

What this does and why

The playbook targets localhost because cisco.intersight modules talk to the Intersight cloud/on-prem API rather than SSHing into devices directly — the API key ID and private key are the credential pair Intersight issues for API-driven automation, kept out of the playbook via environment lookups.

The first task checks the current firmware version on a server profile. The upgrade task is conditional: it only fires when the installed version doesn't already match the target, which keeps the playbook idempotent and safe to run on every AAP job template execution. The port policy task assigns an uplink role and speed to a specific port on a fabric interconnect, the kind of Day-2 change that used to require a manual click-through in the Intersight GUI. The final task polls until the new firmware version is confirmed, since firmware upgrades trigger a reboot and the API won't reflect the new state instantly.

Notes and gotchas

• Credentials: Intersight API keys are organization-scoped. In AAP 2.7, store them as a custom credential type rather than raw environment variables in production.
• Idempotency matters more here than usual: firmware upgrades are disruptive, so guard every upgrade task with a version check — never let a scheduled job blindly re-push firmware.
• Module names are illustrative: exact module names and parameters ship with the collection's documentation; check ansible-doc cisco.intersight.<module> once installed before relying on parameter names in production.
• Retries on state changes: firmware and port changes are asynchronous on the Intersight side — always poll with until/retries rather than assuming the task return value reflects final state.
• Governance angle: this collection was announced under the "Efficiency, Resilience, Governance, and Scale" theme at Red Hat Tech Day Netherlands 2026 — pair it with RBAC controls in ansible.platform so only authorized job templates can push firmware.

Firmware and port operations on Cisco UCS no longer require manual Intersight GUI sessions — cisco.intersight turns them into version-controlled, idempotent AAP job templates.

Related Articles

• Ansible Playbook Example: Automated Branch Network Health Check
• Ansible Playbook Example: Backup Cisco and Arista Switch Configs to Git
• Ansible Playbook Example: Reset WiFi on Branch Access Points

References

• Red Hat Ansible Automation Platform documentation
• Ansible network automation documentation