Configuration management

A company might have hundreds of servers that all need the same users, packages, settings and security patches. Doing that by hand, logging into each one, is slow and error-prone: sooner or later two servers that should be identical are not. Configuration management solves this by writing down the desired state of each machine in files, and letting a tool make every server match it.

The best-known tools are Puppet, Chef and Ansible. Puppet and Chef usually install a small agent on each server that checks in regularly and corrects anything that has drifted from the description. Ansible needs no agent: it connects over SSH and runs tasks written in YAML files called playbooks. In all of them the steps are meant to be idempotent, so running them twice changes nothing the second time: "make sure nginx is installed" rather than "install nginx".

It is a close cousin of infrastructure as code. Tools like Terraform create the servers, networks and databases; configuration management sets up what runs inside them. With containers and golden images, many teams now bake the setup in before launch instead of fixing servers afterward, but configuration management is still everywhere, especially for fleets of long-lived machines.