Essential Configuration Management Tools

Why This Matters

Configuration management sits at the heart of modern DevOps practices—it's the discipline that ensures your infrastructure behaves predictably, scales reliably, and recovers gracefully. When you're tested on CI/CD concepts, you're really being evaluated on whether you understand infrastructure as code, declarative vs. imperative approaches, idempotency, and orchestration patterns. These tools aren't just software to memorize; they represent fundamentally different philosophies for solving the same problem: how do we make infrastructure reproducible and automated?

The tools in this guide fall into distinct categories based on their primary function and architectural approach. Some manage server configurations, others provision cloud infrastructure, and still others orchestrate containers at scale. Don't just memorize what each tool does—know why you'd choose one over another, what architectural trade-offs each makes, and how they fit together in a complete CI/CD pipeline. That's what separates surface-level recall from the deeper understanding exam questions target.

---

Agentless vs. Agent-Based Configuration Management

The fundamental architectural decision in configuration management is whether managed nodes need software installed on them. This choice affects security posture, network requirements, and operational complexity.

Ansible

• Agentless architecture using SSH—no daemon or agent software required on target machines, reducing attack surface and maintenance overhead
• YAML-based playbooks provide human-readable configuration that's easy to version control and review in pull requests
• Idempotent execution guarantees that running the same playbook multiple times produces identical results without unintended side effects

Puppet

• Declarative language defines the desired state rather than procedural steps, letting the system figure out how to achieve compliance
• Agent-based client-server model requires the Puppet agent installed on every managed node, enabling continuous enforcement
• Extensive module ecosystem provides pre-built configurations for common applications, accelerating implementation

Chef

• Ruby-based DSL uses "recipes" and "cookbooks" to define configurations, offering powerful programmatic flexibility
• Client-server architecture with a central Chef server that stores configurations and manages node convergence
• Test-driven infrastructure supports writing automated tests for configurations before deployment, catching errors early

SaltStack

• Master-minion architecture enables real-time command execution across thousands of nodes simultaneously
• Dual push/pull models provide flexibility—push for immediate changes, pull for scheduled convergence
• ZeroMQ messaging delivers exceptional speed and scalability compared to SSH-based alternatives

---

Infrastructure as Code (IaC) Tools

Infrastructure as Code treats infrastructure provisioning like software development—version controlled, tested, and reproducible. These tools focus on creating and managing cloud resources rather than configuring existing servers.

Terraform

• Provider-agnostic IaC supports AWS, Azure, GCP, and dozens of other platforms through a unified configuration language (HCL)
• State file management tracks the current state of deployed resources, enabling drift detection and planned changes
• Declarative resource definitions describe the desired end state, with Terraform calculating the execution plan automatically

CFEngine

• Lightweight footprint makes it ideal for resource-constrained environments and managing massive node counts with minimal overhead
• Promise theory foundation uses a unique model where agents "promise" to maintain defined states, emphasizing autonomous operation
• Built-in compliance auditing provides security-focused reporting without additional tooling

---

Container Technologies

Containers package applications with their dependencies into portable, isolated units. This approach solves the "works on my machine" problem and enables consistent deployment across environments.

Docker

• Container isolation packages applications with all dependencies, ensuring identical behavior from development through production
• Image versioning allows tagging and rolling back to previous versions, providing deployment safety nets
• Microservices enablement facilitates breaking monolithic applications into independently deployable services

Kubernetes

• Container orchestration automates deployment, scaling, and management of containerized applications across clusters
• Declarative desired state lets you specify what you want (3 replicas, 2GB memory) and Kubernetes maintains it automatically
• Self-healing capabilities include automatic restarts, rescheduling, and load balancing without manual intervention

---

CI/CD Pipeline Tools

Continuous Integration and Continuous Delivery tools automate the build-test-deploy cycle. They connect code changes to production deployments through automated pipelines.

Jenkins

• Plugin ecosystem with 1,800+ integrations connects Jenkins to virtually any tool in the DevOps landscape
• Pipeline as code using Jenkinsfile allows version-controlled, reviewable build definitions stored alongside application code
• Distributed builds support master-agent architecture for scaling build capacity across multiple machines

GitLab CI/CD

• Single-platform integration combines source control, CI/CD, and deployment in one unified interface
• .gitlab-ci.yml configuration defines entire pipelines in a single file, reducing context-switching between tools
• Built-in security scanning includes SAST, DAST, and dependency scanning without requiring external tool integration

---

Quick Reference Table

---

Self-Check Questions

1. Which two tools both use YAML for configuration but differ in their architecture (agentless vs. master-minion)? What are the practical implications of this difference?

2. If you needed to provision AWS EC2 instances and configure the software on them, which combination of tools would you use and why?

3. Compare and contrast Docker and Kubernetes: what problem does each solve, and why are they often used together rather than as alternatives?

4. A team wants continuous compliance enforcement where servers automatically correct configuration drift. Would you recommend Ansible or Puppet? Justify your answer based on their architectural differences.

5. An FRQ asks you to design a CI/CD pipeline for a microservices application. Which tools from this guide would you include at each stage (code commit → build → test → deploy → orchestrate), and what role would each play?