Configuration Management in DevOps: Workflow, Tool Comparison, and an Ansible Example

Originally published on 2010-03-21; fully revised and updated.

Configuration management is the practice of defining and enforcing system configuration as code so environments stay consistent over time. This rewrite is aimed at DevOps engineers and platform teams who need repeatable deployments, reduced drift, and safer change control across development, staging, and production.

The original post was a short SlideShare embed. This updated version provides a complete, practical reference you can use directly.

Original embedded slide deck (archival)

Original permalink: https://www.devopsschool.com/blog/power-point-ppt-configuration-management/

{slideshare}[slideshare id=1117749&doc=configurationmanagement-090308134227-phpapp02]{/slideshare}

What configuration management solves

Without configuration management, servers and clusters tend to diverge over time: package versions drift, manual fixes are forgotten, and incidents become harder to reproduce. With configuration managed as code, teams can track changes, review them, and apply them consistently.

• Consistency: same desired state across environments.
• Auditability: configuration changes are tracked in version control.
• Repeatability: rebuilding or scaling infrastructure is predictable.
• Drift control: unauthorized or accidental changes are easier to detect and correct.
• Safer operations: dry runs, peer review, and staged rollout reduce change risk.

End-to-end workflow in a DevOps pipeline

A robust workflow treats configuration exactly like application code: author, review, validate, stage, deploy, and continuously check for drift.

flowchart TD
    A[Define desired state as code] --> B[Commit to Git]
    B --> C[CI validates syntax and policy]
    C --> D[Review and approve]
    D --> E[Apply in staging]
    E --> F[Run service checks]
    F --> G{Promote to production}
    G -- no --> A
    G -- yes --> H[Apply in production]
    H --> I[Detect drift and open fix change]
    I --> A

Approaches and tools compared

Different tools can achieve configuration management, but they differ in operating model, complexity, and fit for scale.

Hands-on example: baseline web server configuration with Ansible

This example installs and enables NGINX on a target host group named web. It demonstrates idempotent configuration management with a dry-run step before enforcement.

Inventory file

[web]
web-01 ansible_host=192.0.2.10 ansible_user=ubuntu
web-02 ansible_host=192.0.2.11 ansible_user=ubuntu

Playbook

---
- name: Configure web servers
  hosts: web
  become: true
  tasks:
    - name: Ensure nginx is installed
      ansible.builtin.package:
        name: nginx
        state: present

    - name: Ensure nginx service is enabled and running
      ansible.builtin.service:
        name: nginx
        enabled: true
        state: startedCode language: CSS (css)

Validate first, then apply

ansible-playbook -i inventory.ini web.yml --syntax-check
ansible-playbook -i inventory.ini web.yml --check --diff
ansible-playbook -i inventory.ini web.ymlCode language: CSS (css)

Minimal CI validation stage

stages:
  - validate

validate_config:
  stage: validate
  script:
    - ansible-playbook -i inventory.ini web.yml --syntax-check
    - ansible-playbook -i inventory.ini web.yml --checkCode language: CSS (css)

Common pitfalls and best practices

• Pitfall: making emergency manual server edits and never backporting them. Best practice: every change goes through version control and pull request review.
• Pitfall: applying directly to production first. Best practice: validate in CI, then stage, then promote.
• Pitfall: treating configuration tools as ad-hoc scripting engines. Best practice: prefer idempotent resources and declarative patterns where possible.
• Pitfall: weak inventory and host-group design. Best practice: model environments and roles explicitly to prevent accidental broad changes.
• Pitfall: no drift checks after deployment. Best practice: schedule regular compliance runs and open fix changes automatically.

Rajesh Kumar

I’m Rajesh Kumar, a DevOps, SRE, DevSecOps, Cloud, and Platform Engineering expert passionate about sharing practical knowledge, real-world experiences, and industry best practices. I have worked at Cotocus and regularly write about technology, travel, investing, health, product reviews, and digital marketing through my various platforms.

I publish technical articles at DevOps School, travel stories at Holiday Landmark, stock market insights at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow, and SEO and digital marketing strategies at Wizbrand.