Add remove old kernel configuration

ansible/roles/sysconfig/handlers/main.yml

@@ -8,6 +8,10 @@
   retries: 60
   until: apt_status is success or ('Failed to lock apt for exclusive operation' not in apt_status.msg and '/var/lib/dpkg/lock' not in apt_status.msg)
 
+- name: systemd daemon reload
+  systemd:
+    daemon_reload: true
+
 - name: update locale
   command: locale-gen
 
@@ -21,6 +25,16 @@
     name: sshd
     state: restarted
 
+- name: restart unattended-upgrades
+  service:
+    name: unattended-upgrades
+    state: restarted
+
+- name: restart ntp
+  service:
+    name: ntp
+    state: restarted
+
 - name: update cache
   apt:
     force_apt_get: true
@@ -30,13 +44,4 @@
   retries: 60
   until: apt_status is success or ('Failed to lock apt for exclusive operation' not in apt_status.msg and '/var/lib/dpkg/lock' not in apt_status.msg)
 
-- name: systemd daemon reload
-  systemd:
-    daemon_reload: true
-
-- name: restart ntp
-  service:
-    name: ntp
-    state: restarted
-
 ...

ansible/roles/sysconfig/tasks/main.yml

@@ -43,6 +43,13 @@
       APT::Periodic::Update-Package-Lists "1";
       APT::Periodic::Unattended-Upgrade "1";
 
+- name: remove old kernel with unattended-upgrades
+  replace:
+    dest: /etc/apt/apt.conf.d/50unattended-upgrades
+    regexp: '^//Unattended-Upgrade::Remove-Unused-Kernel-Packages.*$'
+    replace: 'Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";'
+  notify: restart unattended-upgrades
+
 - name: enable root login via ssh with key
   replace:
     dest: /etc/ssh/sshd_config