Configuration Management with Ansible and Terraform

What it is

Configuration management tools let you describe what you want in a structured file, and the tool makes it happen across many systems.

Writing a script for every task becomes hard to maintain. Two of the best known tools are Ansible and Terraform.

They solve related problems in different ways. Ansible is mostly used to configure the devices and servers that already exist. Terraform is mostly used to create and manage infrastructure, especially in the cloud, such as networks, virtual machines and firewall rules.

Both are used with the idea of infrastructure as code: the setup is written as text files, kept in version control, reviewed and then applied.

How it works

Ansible pushes tasks to existing devices, while Terraform builds infrastructure toward a declared end state.

Ansible

Ansible is an automation tool. Its key features are:

• Agentless: nothing needs to be installed on the managed devices. For network devices, Ansible connects over SSH or an API.
• Push model: a control machine sends the configuration out to the devices when you run it.
• YAML playbooks: the instructions are written in YAML, a readable text format.
• Idempotent: if a device is already in the desired state, the task changes nothing.

The main parts are:

• Inventory: the list of devices, often organised in groups such as switches or routers.
• Playbook: a file that lists what to do and to which devices.
• Play and tasks: a playbook contains plays, and each play has an ordered list of tasks.
• Modules: the units that do the work, such as one that manages VLANs or sends a configuration command.
• Variables and templates: let one playbook serve many devices with different details.

A small example:

- name: Configure VLANs
  hosts: switches
  gather_facts: false
  tasks:
    - name: Make sure VLAN 10 exists
      cisco.ios.ios_vlans:
        config:
          - vlan_id: 10
            name: SALES
        state: merged

What matters is not the exact syntax but that it is YAML, that it names the hosts and tasks, and that it describes a desired state.

Terraform

Terraform is a tool for provisioning infrastructure. Its key features are:

• Declarative: you write the desired end state, and Terraform works out the steps to reach it.
• Providers: plug-ins that let Terraform talk to a platform, such as a public cloud, a network controller or a firewall.
• HCL: the language is HashiCorp Configuration Language, a readable format designed for the purpose.
• State: Terraform keeps a record of what it has created, and compares it with your files to decide what to change.
• Agentless: it uses the APIs of the platform it manages.

The usual workflow has four commands:

terraform init
terraform plan
terraform apply
terraform destroy

init prepares the working directory and downloads the providers. plan shows what would change, without changing anything.

apply makes the changes. destroy removes what Terraform created.

A small example:

resource "example_vlan" "sales" {
  id   = 10
  name = "SALES"
}

The block says that a resource of a certain type should exist, with these settings. The resource type here is a placeholder, since real names depend on the provider.

Comparing the tools

Other tools exist, such as Puppet and Chef. They are generally agent-based and use a pull model, where the managed device checks in with a server for its configuration.

Why use them

• Repeatable: the same file gives the same result each time.
• Reviewable: changes can be read and approved before they are applied.
• Traceable: version control shows who changed what.
• Scalable: one file can serve hundreds of devices.
• Documented: the files themselves describe the intended network.