AnsibleByExample

Ansible Orchestrator Example: Reading a Workflow Execution Timeline

Beginner
2024-01-014By Luca Berton

Lesson 1 of 15 in Foundations

Ansible Foundations to Production — full curriculum
  1. 1. Introduction to Ansible and Automation
  2. 2. Installing and Configuring Ansible
  3. 3. Running Ad-Hoc Commands
  4. 4. Writing Your First Playbook
  5. 5. Understanding and Using Modules
  6. 6. Variables and Facts
  7. 7. Conditionals and Loops
  8. 8. Handlers and Idempotency
  9. 9. Structuring Projects with Roles
  10. 10. Inventory Management
  11. 11. Using Ansible Vault for Secrets
  12. 12. Debugging and Troubleshooting
  13. 13. Real-World Automation Examples
  14. 14. Final Project: Deploy a Web Server
  15. 15. Bonus - What's Next with Ansible?
View path overview →

Red Hat's upcoming Automation Orchestrator (announced for Q3 2026) runs task-based and event-based automation on a single governed canvas, built on the upstream Temporal durable-execution engine. Every workflow run produces an execution timeline — a stage-by-stage record of what happened, when, and how long it took — which is the primary artifact you use to prove that "AI acted through AAP" instead of improvising against production. Below is a worked example based on the CVE-2024-6387 ("regresshion" OpenSSH race condition) remediation workflow demoed at Red Hat Tech Day Netherlands 2026 in Bunnik.

Example: querying a workflow timeline

---
- name: Fetch and evaluate an orchestrator workflow execution timeline
  hosts: localhost
  gather_facts: false
  vars:
    orchestrator_host: "https://orchestrator.example.com"
    workflow_id: "wf-cve-2024-6387-regresshion"
    human_review_timeout_seconds: 86400   # 1 day default

  tasks:
    - name: Retrieve the execution timeline for this workflow run
      ansible.builtin.uri:
        url: "{{ orchestrator_host }}/api/v1/workflows/{{ workflow_id }}/timeline"
        method: GET
        headers:
          Authorization: "Bearer {{ orchestrator_api_token }}"
        return_content: true
      register: timeline_response

    - name: Show each stage with its recorded duration
      ansible.builtin.debug:
        msg: "{{ item.stage }}: {{ item.duration_seconds }}s ({{ item.status }})"
      loop: "{{ timeline_response.json.stages }}"

    - name: Compute automated time, excluding the human review wait
      ansible.builtin.set_fact:
        automated_seconds: >-
          {{ timeline_response.json.stages
             | rejectattr('stage', 'equalto', 'human_review')
             | map(attribute='duration_seconds')
             | map('float') | sum }}

    - name: Fail the play if human review exceeded its timeout
      ansible.builtin.fail:
        msg: "Human review gate timed out — workflow should have failed, not auto-approved."
      when:
        - timeline_response.json.stages | selectattr('stage', 'equalto', 'human_review') | map(attribute='duration_seconds') | first | float > human_review_timeout_seconds

What this does and why

The play hits the orchestrator's timeline API for a specific workflow run and prints each stage with its duration and status. In the Bunnik demo, the regresshion remediation workflow produced this exact sequence: alert ingestion (0s), ITSM ticket creation (1.2s), vulnerability analysis (4.8s), human review (38.4s, manual), remediation execution (0.9s), ticket close (2.1s). Adding those up gives under 10 seconds of automated compute time — the 38.4s human review is deliberately excluded from that figure because it's a human approval wait, not machine work.

That separation matters operationally. The automated_seconds fact in the example strips out the human_review stage before summing, mirroring how the orchestrator itself reports "automated time" versus wall-clock time. If you're setting SLAs or alerting on workflow performance, you almost always want the automated figure, not the end-to-end one, because the human gate's duration depends on when a person picks up their phone, not on anything Ansible controls.

The timeline is also your audit trail. In the demo, the workflow was triggered by an IBM Instana webhook, correlated hosts via MCP tools (Splunk Query, Splunk Alert Search, Splunk Saved Search, ServiceNow CMDB Lookup), and paused at a Human Review gate with a custom message ("Please approve this deployment to production"), a configurable list of usernames to notify, a 1-day default timeout, and an explicit on-timeout action of "Fail the workflow" — never a silent auto-approval. The timeline record is what proves that gate actually fired and was actually approved by a human before the 12 hosts (rolling update, 3 batches of 4, prod/staging/dev) were patched with zero downtime and ServiceNow ticket INC0038291 was closed.

Notes / Gotchas

  • Don't average away the human stage. A timeline with one 38.4s human review and nine sub-second automated stages will badly skew a naive average; always separate human gates from automated stages before computing SLA metrics.
  • Timeout action is explicit, not implied. The orchestrator's on-timeout behavior for a Human Review gate must be configured — "Fail the workflow" is the safe default shown at the event, but treat it as a setting to verify per workflow, not an assumption.
  • Stage names are workflow-specific. The stage values in the JSON (alert_ingestion, itsm_ticket_creation, vulnerability_analysis, human_review, remediation_execution, ticket_close) reflect this particular CVE remediation workflow; adapt the selectattr/rejectattr filters to whatever stage names your own workflow definition uses.
  • API token scope. The Authorization: Bearer token needs read access to workflow execution data — treat it like any other AAP credential and keep it out of plain-text vars.

Takeaway

A workflow execution timeline turns an AI-driven remediation into an auditable, timed record — read it stage by stage, keep human-approval time separate from automated time, and treat the on-timeout action as a governance control worth checking explicitly.

References

All Tutorials