5 Configuration Management and Reusable Automation

What configuration management does

Configuration management describes, applies, and checks the settings systems need, including installed packages, files, services, users, and other resources. Teams keep these settings in readable files and use automation to apply them consistently rather than relying on undocumented manual changes.

Ansible and Puppet manage system configuration, while Terraform commonly describes and provisions infrastructure. Their roles can overlap within an automation workflow.

Desired state and repeatable automation

Declarative configuration states the desired result, and the automation tool determines what actions are needed to reach it. For example, declaring that a web service should be running specifies a target state rather than prescribing every command required to install, enable, and start it. By contrast, an imperative script focuses on a sequence of commands. Declarative approaches make the intended state easier to review and apply repeatedly.

Idempotence means that applying the same configuration again should leave the system in the same desired state without repeating unnecessary changes. If a package is already installed, an idempotent task reports no change. Not every task or module is automatically idempotent, so test automation before repeated or production use.

An Ansible playbook can declare that a package is present and that its service is enabled and running:

The exact outcome depends on the target system and available modules. In production, review changes and test in a safe environment before deployment.

Templates, roles, and modules

A template is a reusable text pattern with variable values. It can generate similar configuration files for different hosts or environments, avoiding the need to maintain a separate hand-edited copy for each one. Ansible templates use Jinja2 expressions, with variables supplying the differences.

For example, a template named templates/site.conf.j2 might contain:

A playbook can render the template using environment-specific values such as http_port and site_name. Keep a template focused, document its inputs, and validate the generated file: a syntactically valid template can still produce an invalid service configuration.

Reusable roles and modules package related automation or resource definitions behind a documented interface. Ansible roles organize reusable automation; Terraform modules group resources that can be called with different inputs. For example, a network module might create a standard subnet-and-routing pattern while each environment supplies its own address ranges. Reuse improves consistency, but shared components need clear inputs, outputs, documentation, and versioning so a change does not unexpectedly affect every consumer.

Version control and change workflow

Store configuration files, templates, and automation code in a version-control system such as Git. Version control records changes over time, making it possible to compare revisions, identify who changed a setting, collaborate, and restore an earlier version.

A practical change workflow is:

1. Edit configuration on a branch and explain the intent of the change.

2. Review the diff for unintended changes, unsafe values, or secrets.

3. Run syntax checks and tests; render or plan changes where the tool supports it.

4. Merge an approved change, then deploy it in a controlled way.

5. Check the results and update the configuration if the observed state differs from the intended state.

Keep credentials and sensitive values out of ordinary repositories. Use an appropriate secrets-management mechanism, restrict access, and avoid committing generated state files when the tool’s documentation advises against it. Terraform guidance specifically advises against storing state files, provider credentials, or sensitive values in version control.

Detecting and reconciling drift

Configuration drift occurs when a system’s actual settings diverge from the documented desired state, for example after an unreviewed manual edit. Configuration-management tools can reapply or check declared settings to help detect or correct differences.

Treat the repository as the reviewed record of intended configuration. If an emergency manual change is necessary, record and reconcile it afterward so the next automation run does not undo an undocumented decision.