Desired state and idempotency - the foundations of CM

Configuration management works by declaring desired state (“the file should contain X”) and letting the tool enforce it. Idempotency means applying the same configuration twice is safe.

Imperative vs declarative

Imperative (“do this”):

apt install nginx
systemctl start nginx
echo "worker_processes 4;" > /etc/nginx/nginx.conf
systemctl reload nginx

If you run this twice, the result depends on the starting state. If nginx is already installed, fine. If the config file was different, it is overwritten.

Declarative (“the state should be”):

# Ansible
- apt:
    name: nginx
    state: present
- service:
    name: nginx
    state: started
- copy:
    content: |
      worker_processes 4;
    dest: /etc/nginx/nginx.conf
- service:
    name: nginx
    state: reloaded

If you run this twice, the result is the same: nginx is installed, running, with the right config. Running the playbook is idempotent.

Why idempotency matters

• Safe to re-run: if the playbook crashes halfway, you can re-run it without breaking anything.
• Drift correction: a drifted host can be brought back to desired state by re-running the playbook.
• Verification: idempotent operations can be checked after-the-fact; the state is known to be correct.

Non-idempotent operations (e.g. command: rm -rf /tmp/foo) can be destructive if run twice or in the wrong order.

Idempotency patterns

Ansible modules are designed to be idempotent. Shell commands are not. Prefer modules.

Avoid common pitfalls

• Always run a playbook twice to verify it is idempotent.
• Never use command for things Ansible has a module for.
• Never use shell that depends on the order of operations.
• Always read the diff before applying in production.

Desired state examples

# Package state
- apt:
    name:
      - nginx
      - postgresql-15
    state: present

# Service state
- service:
    name: nginx
    state: started
    enabled: yes

# File state
- copy:
    src: files/nginx.conf
    dest: /etc/nginx/nginx.conf
    owner: root
    group: root
    mode: '0644'

# User state
- user:
    name: deploy
    state: present
    shell: /bin/bash

Each declares what should be true. Ansible figures out how to make it true.

Knowledge check