🛸 Hitchhiker's Guide — Phase 05: Provisioning & Config Management
Read this if: "PXE, Foreman, Ansible, Terraform" is a list of words. This is the compressed map — the boot chain, the one big idea, and the tool tradeoffs.
0. The 30-second mental model
Bare metal → running node has two halves: provisioning (network-boot an OS onto a diskless box: DHCP → bootloader → installer) and configuration (converge the OS to a declared state, idempotently). The one idea under all of it — PXE, Ansible, Terraform, and the Phase 06 operator alike — is declare desired state, converge reality to it. At fleet scale the must-have is a resumable per-node state machine, not a big script.
1. The PXE/iPXE boot chain (the #1 question)
power on → NIC PXE firmware
→ DHCP (gives IP + option 66 next-server + option 67 filename; arch tag = BIOS/UEFI)
→ TFTP/HTTP fetch bootloader (pxelinux / iPXE / UEFI binary)
→ iPXE script over HTTP → fetch installer kernel + initrd
→ installer runs UNATTENDED (kickstart / autoinstall / cloud-init)
→ reboot into installed OS → config management takes over
Gotchas: TFTP is slow/UDP-fragile (prefer iPXE-over-HTTP); UEFI vs BIOS needs the right bootloader (arch detection); Secure Boot requires signed shim→GRUB→kernel or it won't boot.
2. Automated install answer files
| OS | file | pointer |
|---|---|---|
| RHEL/Rocky | kickstart ks.cfg | inst.ks=http://.../ks.cfg |
| Ubuntu | autoinstall (YAML) | autoinstall ds=nocloud-net;s=http://... |
| any image | cloud-init user-data | first-boot config (users, keys, packages, runcmd) |
3. Foreman in one line
Orchestrates DHCP/TFTP/DNS/installer via smart proxies (local services, central control), with host groups + templates and a discovery image that inventories unprovisioned nodes — the software form of Phase 01 commissioning.
4. Idempotency (the core idea)
Declare end state, not steps → apply N times = same result, no-op once converged, corrects
drift. useradd bob (breaks on re-run) vs resource "user bob present" (always fine). This is
the same loop as a k8s operator and Terraform.
5. Ansible vs Puppet vs Chef
| Ansible | Puppet | Chef | |
|---|---|---|---|
| agentless, push, SSH, YAML | agent, pull, DSL | agent, pull, Ruby | |
| pick when | no agents, ad-hoc, orchestration | strong declarative @ scale | programmatic flexibility |
They're all idempotent convergence engines — architecture is the differentiator.
6. Terraform in four words
Providers · State (the map; lock it, never hand-edit) · plan (see the diff, incl. destroy) · apply (reconcile). Drift = reality diverged → next plan shows it. IaC declares infrastructure; CM configures inside the OS; they compose.
7. The onboarding pipeline (what to build)
discover → EBOM reconcile → firmware baseline → OS install → configure → validate → join orch → READY
Must-haves: persisted resumable state machine · idempotent steps · validation gates (quarantine bad nodes) · EBOM reconciliation · observability. Not a sequential script.
8. The "done this before" tells
"Is the step idempotent?" · "Does it resume from the last state?" · "BIOS or UEFI PXE?" ·
"Is the boot chain signed for Secure Boot?" · "What does the validation gate check?" ·
"Where's the Terraform state stored?" · "Did you plan before apply?"
9. How this phase pays off later
The state-machine + declared-vs-discovered pattern is the Phase 06 operator and the
Phase 13 capstone. Validation gates use Phase 04 (PCIe/sensors) and Phase 08 (firmware).
Observability is Phase 07. "Design a provisioning service" is system-design/05.