Configuration Management in DevOps: Concepts, Tooling, and a Practical Workflow

Configuration management is the DevOps practice of defining a desired system state (packages, services, files, users, policies) and enforcing that state consistently across servers and environments. This article is for platform, SRE, and infrastructure engineers who want a clear mental model, a tool comparison, and practical implementation patterns.

Originally published on 2010-03-21T21:03:26; fully revised and updated.

The original post primarily embedded a SlideShare deck. The original shortcode is preserved here:

{slideshare}[slideshare id=1117749&doc=configurationmanagement-090308134227-phpapp02]{/slideshare}

What configuration management does in a DevOps stack

At its core, configuration management reduces drift between what systems should look like and what they actually look like. Instead of manually editing servers, teams define state as code and apply it repeatedly.

• Desired state: declare the end state (for example, nginx installed and running).
• Idempotency: safe repeated runs without unnecessary changes.
• Version control: track who changed what and when.
• Auditability: reviewable pull requests and change history.
• Consistency: same baseline across dev, staging, and production.

Typical workflow from Git change to enforced state

Most teams run configuration management through Git-based change control and automated execution.

flowchart TD
    A[Engineer updates config in Git] --> B[Pull request review]
    B --> C[CI lint and syntax checks]
    C --> D{Checks pass}
    D -- No --> E[Fix and resubmit]
    D -- Yes --> F[Merge to main branch]
    F --> G[Run configuration management apply]
    G --> H[Nodes converge to desired state]
    H --> I[Drift and compliance report]

Tool comparison: Ansible, Puppet, Chef, Salt, and Terraform

Different tools can solve similar problems with different operating models. A quick comparison helps with initial selection.

Example: baseline Linux web server configuration with Ansible

The example below installs nginx, ensures it is enabled and running, and deploys a managed config file. This demonstrates the desired-state and idempotent style used in configuration management.

Inventory file

[web]
web01.example.internal
web02.example.internal

[web:vars]
ansible_user=automation

Playbook

---
- name: Configure web servers
  hosts: web
  become: true
  tasks:
    - name: Ensure nginx is installed
      package:
        name: nginx
        state: present

    - name: Ensure nginx service is enabled and running
      service:
        name: nginx
        enabled: true
        state: started

    - name: Deploy nginx config
      copy:
        src: files/nginx.conf
        dest: /etc/nginx/nginx.conf
        owner: root
        group: root
        mode: "0644"
      notify: Restart nginx

  handlers:
    - name: Restart nginx
      service:
        name: nginx
        state: restartedCode language: JavaScript (javascript)

Execution commands

ansible-playbook -i inventory/prod.ini site.yml --check
ansible-playbook -i inventory/prod.ini site.yml

Repository structure and environment promotion

Keeping configuration code organized makes review and promotion safer. A simple layout:

cm-repo/
├── inventory/
│   ├── dev.ini
│   ├── stage.ini
│   └── prod.ini
├── group_vars/
├── roles/
├── files/
├── templates/
└── site.yml

• Use pull requests for every change.
• Run lint/syntax checks in CI before merge.
• Promote the same reviewed change from dev to stage to production.
• Record execution logs for audit and incident review.

Best practices and common pitfalls

• Prefer small, reversible changes: large batches increase blast radius.
• Avoid snowflake servers: if a manual fix is needed, codify it immediately.
• Separate secrets from code: use a proper secrets manager or encrypted variable strategy.
• Design for drift detection: schedule regular convergence checks, not only one-time setup.
• Test in lower environments first: validate roles and modules before production rollout.

Done well, configuration management becomes a repeatable control plane for system state: consistent, reviewable, and automation-friendly.

Rajesh Kumar

I’m Rajesh Kumar, a DevOps, SRE, DevSecOps, Cloud, and Platform Engineering expert passionate about sharing practical knowledge, real-world experiences, and industry best practices. I have worked at Cotocus and regularly write about technology, travel, investing, health, product reviews, and digital marketing through my various platforms.

I publish technical articles at DevOps School, travel stories at Holiday Landmark, stock market insights at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow, and SEO and digital marketing strategies at Wizbrand.