Pedro Barbero

Multi-source infrastructure reconciliation

Virtual estate exports, patch management, endpoint security, vulnerability scanning, identity and monitoring each hold a partial truth about the same servers. The pipeline normalises all of them, crosses them against each other, and turns every mismatch into a ticket for the team that owns it — instead of a spreadsheet nobody reads.

The value is the crossover: no single tool knows the whole estate, so the mismatches between them are the actual findings.

FIG. 01 MULTI-SOURCE RECONCILIATION SCALE: N.T.S. REV. C

Pentaho Data IntegrationVMware vSphereCrowdStrikeTenableFreeIPAIcingaJiraGitLab

Discovery, dependency mapping and the reconciled register

Credentialed agentless scanning looks inside each host — running processes, installed packages, configuration files, listening ports — and a pattern engine turns those raw findings into recognised software instances and the dependencies between them. That is what populates the CMDB datasets, which are then reconciled against the automation register before any host is managed on its planes.

A register nobody verifies drifts, and everything downstream — provisioning, patching, hardening — inherits that drift.

FIG. 02 DISCOVERY → CMDB → RECONCILED REGISTER SCALE: N.T.S. REV. C

BMC Atrium DiscoveryDependency mappingCMDBBMC BladeLogicLinuxWindowsCompliance

Automated content view release & promotion

A scheduled job reads each lifecycle from configuration and decides, per content view, whether a new version is due, whether it was already published in this run, and which environments are ready to receive it. Promotion walks the lifecycle backwards, so every environment inherits the exact version already proven in the one before it.

Nothing reaches production that has not already run in every environment before it; the schedule, not a person, decides when each hop happens.

FIG. 03 CONTENT VIEW RELEASE & PROMOTION SCALE: N.T.S. REV. C

Red Hat SatelliteKatelloPythonBashcronGit

Patch execution on the host

The content policy decides what a host may install; this is what actually runs on it. The inventory is generated from Satellite host groups at run time, and every host passes a set of gates — free space, staged downloads, exclusion lists — before a single package is applied. Reboots happen only where the kernel actually requires one.

Staging the downloads ahead of the window is what turns a risky maintenance slot into a short, predictable one.

FIG. 04 PATCH EXECUTION ON THE HOST SCALE: N.T.S. REV. C

AnsibleAWXRed Hat SatelliteKatelloRHEL / OEL / CentOSYAML

PedroJoséBarberoIglesias

Multi-source infrastructure reconciliation

Discovery, dependency mapping and the reconciled register

Automated content view release & promotion

Patch execution on the host

Want the full picture?