Configuration Management

IaC provisions the box. Configuration management installs packages, drops files, configures users, and ensures the running state matches the declared state.

The major tools

• ★ Ansible — agentless, SSH-based, YAML playbooks, idempotent modules. The default for new projects in 2026; almost everyone knows or can read it.
• SaltStack — agent-based (or agentless via salt-ssh); event-driven; faster at huge scale than Ansible. Smaller community now than its peak.
• Puppet — agent-based, mature, declarative DSL; still common in big enterprise.
• Chef (now Progress Chef) — Ruby-flavored cookbooks; less common in 2026.
• CFEngine — original CM tool; niche.
• cdist — Python; targets minimal embedded systems.

Lighter / Ansible-adjacent

• Pyinfra — Python alternative to Ansible; faster, scripting-feel.
• mgmt — event-driven, parallel; James Shubin's interesting take.
• Mitogen for Ansible — Python plugin that makes Ansible 5–10× faster.

Bash-script-replacement tier (very small fleets)

• Bash + ssh + a Makefile — fine for 1–3 servers. Don't over-engineer.
• Just / Make / Taskfile — task runners; pair with SSH commands.
• AWS Systems Manager Run Command — AWS-native shell command broadcaster.

Bootstrap / first-boot

• ★ cloud-init — see Cloud-init & Provisioning; the standard for first-boot config on cloud VMs.
• Ignition — Fedora CoreOS / Flatcar / Talos first-boot config.
• Packer — bake the config into the image instead.

Common tasks Ansible handles

• Install / update packages with apt / dnf / pacman.
• Manage users, groups, sudoers.
• Drop config files from templates (Jinja2).
• Manage systemd services.
• Manage firewall rules (iptables / nftables / ufw).
• Set kernel sysctls.
• Roll out file mode / SELinux contexts.
• Run one-off commands.

What Ansible isn't great at

• Image building (use Packer).
• Container orchestration (use k8s / Nomad / Kamal).
• Stateful coordination across hosts (use Consul / etcd).
• Speed at huge scale (Salt / Mitogen / Puppet beat plain Ansible).

Patterns to adopt

• ★ Small modules, one purpose each. Long monolithic playbooks become unmaintainable.
• Idempotency first. Re-running should be safe. Use modules, not raw command.
• Inventory in YAML / dynamic from cloud. Don't hand-edit hosts.
• Vault encrypted secrets for ansible-vault — or use SOPS.
• Run in CI with check mode (--check) before apply.
• Test with Molecule for important roles.

Tooling around Ansible

• Molecule — test framework for Ansible roles.
• AWX / Ansible Automation Platform — Red Hat's web UI for runs / RBAC.
• Semaphore — open-source AWX alternative.
• ansible-lint — style + best-practice linter.

Pick this if…

• Default for any small / medium fleet: Ansible.
• You need huge-scale event-driven CM: Salt or Puppet.
• You'd rather write Python: Pyinfra.
• 3 or fewer servers and you live in ssh: scripts + a Makefile.
• Cloud VMs that should self-bootstrap: cloud-init for first boot, Ansible for ongoing.