Event-Driven Ansible (EDA): Automate Responses to Events

What is Event-Driven Ansible?

Event-Driven Ansible (EDA) automatically triggers actions in response to events — monitoring alerts, webhook calls, log patterns, and system changes. Instead of running playbooks manually, events trigger them.

Event Source → EDA Rulebook → Condition Match → Action (Run Playbook)

How It Works

1. Event Sources

Sources generate events from external systems:

Webhooks — GitHub, GitLab, Jira, PagerDuty
Monitoring — Prometheus Alertmanager, Nagios, Zabbix
Message queues — Kafka, RabbitMQ
Cloud events — AWS EventBridge, Azure Event Grid
Log watchers — file changes, syslog
Custom sources — any Python plugin

2. Rulebooks

Rulebooks define what events to listen for and what actions to take:

---
- name: Respond to webhook events
  hosts: all
  sources:
    - ansible.eda.webhook:
        host: 0.0.0.0
        port: 5000

  rules:
    - name: Deploy on push to main
      condition: event.payload.ref == "refs/heads/main"
      action:
        run_playbook:
          name: deploy.yml

3. Actions

What happens when a condition matches:

run_playbook — Execute an Ansible playbook
run_module — Run a single module
set_fact — Store data for later rules
post_event — Forward to another rulebook
print_event — Log the event (debugging)
noop — Do nothing (useful for testing)

Practical Examples

Auto-Remediate Disk Full

---
- name: Auto-remediate disk alerts
  hosts: all
  sources:
    - ansible.eda.alertmanager:
        host: 0.0.0.0
        port: 8000

  rules:
    - name: Clean logs when disk full
      condition: event.alert.labels.alertname == "DiskFull"
      action:
        run_playbook:
          name: cleanup-disk.yml
          extra_vars:
            target_host: "{{ event.alert.labels.instance }}"

Auto-Scale on High CPU

---
- name: Auto-scale web tier
  hosts: localhost
  sources:
    - ansible.eda.alertmanager:
        host: 0.0.0.0
        port: 8000

  rules:
    - name: Scale up on high CPU
      condition: >
        event.alert.labels.alertname == "HighCPU" and
        event.alert.labels.severity == "critical"
      action:
        run_playbook:
          name: scale-up.yml

    - name: Scale down on low CPU
      condition: >
        event.alert.labels.alertname == "LowCPU" and
        event.alert.status == "resolved"
      action:
        run_playbook:
          name: scale-down.yml

Restart Service on Failure

---
- name: Service health monitor
  hosts: all
  sources:
    - ansible.eda.url_check:
        urls:
          - http://web1:8080/health
          - http://web2:8080/health
        delay: 30  # Check every 30 seconds

  rules:
    - name: Restart unhealthy service
      condition: event.url_check.status == "down"
      action:
        run_playbook:
          name: restart-service.yml
          extra_vars:
            target_host: "{{ event.url_check.host }}"

GitHub Webhook Deployment

---
- name: Deploy on GitHub push
  hosts: all
  sources:
    - ansible.eda.webhook:
        host: 0.0.0.0
        port: 5000

  rules:
    - name: Deploy to staging
      condition: >
        event.payload.ref == "refs/heads/develop" and
        event.meta.headers.X-GitHub-Event == "push"
      action:
        run_playbook:
          name: deploy-staging.yml

    - name: Deploy to production
      condition: >
        event.payload.ref == "refs/heads/main" and
        event.meta.headers.X-GitHub-Event == "push"
      action:
        run_playbook:
          name: deploy-production.yml

Getting Started

Install

pip install ansible-rulebook ansible-runner

# Install the EDA collection
ansible-galaxy collection install ansible.eda

Run a Rulebook

ansible-rulebook --rulebook my-rulebook.yml -i inventory.yml

EDA vs Traditional Ansible

Aspect	Traditional	Event-Driven
Trigger	Manual / cron / CI	Automatic (events)
Response time	Minutes	Seconds
Use case	Planned changes	Reactive automation
Runs	On-demand	Continuously listening

When to Use EDA

Incident response — auto-remediate alerts
GitOps — deploy on push
Compliance — fix drift when detected
Scaling — respond to load changes
Security — block IPs, rotate credentials on alerts

Learn more about Ansible automation in our 800+ tutorials and Learning Paths.