Event-Driven Ansible 2026 — 12 New Collections and Platform

Introduction

Event-Driven Ansible (EDA) in 2026 expands from a niche reactive automation tool to a full enterprise event processing platform. With 12 new source collections, cloud event bus integration, and architectural improvements, EDA handles everything from infrastructure alerts to business process automation.

12 New Event Source Collections

Cloud Providers

# AWS EventBridge source
- name: AWS infrastructure events
  sources:
    - ansible.eda.aws_eventbridge:
        region: us-east-1
        event_bus: custom-infra-bus
        rule_prefix: ansible-eda

  rules:
    - name: EC2 instance terminated
      condition: event.detail.state == "terminated"
      action:
        run_playbook:
          name: investigate-termination.yml

# Azure Event Hub source
- name: Azure platform events
  sources:
    - ansible.eda.azure_event_hub:
        connection_string: "{{ azure_eh_connection }}"
        consumer_group: ansible-eda
        event_hub_name: infra-events

Monitoring & Observability

# Prometheus AlertManager
- ansible.eda.prometheus:
    host: 0.0.0.0
    port: 5001
    # Receives webhook alerts from AlertManager

# Datadog events
- ansible.eda.datadog:
    api_key: "{{ datadog_api_key }}"
    app_key: "{{ datadog_app_key }}"
    monitor_tags: ["env:production"]

# Dynatrace APM
- ansible.eda.dynatrace:
    environment_url: "{{ dt_environment_url }}"
    api_token: "{{ dt_api_token }}"
    problem_severity: ["CRITICAL", "ERROR"]

ITSM & Collaboration

# ServiceNow ticket events
- ansible.eda.servicenow:
    instance: company.service-now.com
    table: incident
    filter: "priority=1^state=new"
    poll_interval: 30

# PagerDuty incidents
- ansible.eda.pagerduty:
    routing_key: "{{ pd_routing_key }}"
    event_types: ["incident.triggered"]

DevOps & CI/CD

# GitHub webhooks
- ansible.eda.github:
    host: 0.0.0.0
    port: 5002
    token: "{{ github_webhook_secret }}"
    events: ["push", "pull_request", "deployment"]

# GitLab CI/CD
- ansible.eda.gitlab:
    host: 0.0.0.0
    port: 5003
    secret_token: "{{ gitlab_webhook_token }}"
    events: ["pipeline", "merge_request"]

Platform Architecture Changes

Gateway-Only Architecture (New)

┌─────────────────────────────────────────┐
│           AAP Gateway                     │
│  (Single entry point, auth, routing)     │
├────────────┬──────────────┬─────────────┤
│ Controller │  EDA         │  Hub         │
│ (Jobs)     │  (Events)    │  (Content)   │
└────────────┴──────────────┴─────────────┘

Benefits:

Single TLS endpoint
Unified authentication
Centralized audit logging
Simplified firewall rules

Infrastructure Updates

Component	Old	New
PostgreSQL	13	17
Django	4.2	5.2 LTS
Python	3.9	3.11
Redis	6	7

Rulebook Best Practices

---
- name: Production event automation
  hosts: all
  sources:
    - ansible.eda.kafka:
        topic: production-events
        host: kafka.internal:9092
        group_id: eda-production

  rules:
    # Use specific conditions (not broad catches)
    - name: Database connection pool exhausted
      condition: >-
        event.alert.labels.alertname == "PostgresConnectionPoolExhausted"
        and event.alert.labels.severity == "critical"
        and event.alert.labels.environment == "production"
      throttle:
        once_within: 5 minutes  # Don't fire repeatedly
        group_by: event.alert.labels.instance
      action:
        run_playbook:
          name: scale-pgbouncer.yml
          extra_vars:
            target_host: "{{ event.alert.labels.instance }}"
            pool_increase: 50

Common Patterns

Auto-Remediation with Escalation

rules:
  - name: Disk space critical
    condition: event.alert.metric == "disk_usage" and event.alert.value > 95
    action:
      run_playbook:
        name: remediate-disk-space.yml
    on_failure:
      notify:
        - pagerduty
        - slack_ops_channel

Event Correlation

rules:
  - name: Multiple hosts failing health checks
    condition: >-
      events.health_check_failed.count > 3
      within 5 minutes
      group_by event.cluster
    action:
      run_workflow:
        name: cluster-investigation

Troubleshooting

Issue	Fix
Events not received	Check source plugin connectivity and auth
Rule never triggers	Verify condition matches event structure (`-vvv`)
Duplicate actions	Add `throttle` with `once_within`
High memory usage	Limit event buffer size, add filters at source

Best Practices

Throttle aggressively — prevent event storms from cascading
Filter at source — don't process events you'll discard
Test with --print-events — verify event structure before writing conditions
Separate dev/prod rulebooks — different throttles and approvals
Monitor EDA itself — alert on rulebook failures and backlogs

Conclusion

Event-Driven Ansible 2026 with 12 new collections covers the full enterprise event landscape — from cloud provider notifications through monitoring alerts to ITSM ticket workflows. The gateway-only architecture simplifies deployment while PostgreSQL 17 and Django 5.2 improve performance and security.