Lab 02 — Ansible + Terraform Rack Onboarding

Phase: 05 — Provisioning & Config Mgmt | Difficulty: ⭐⭐⭐☆☆ | Time: 4–6 hours Language: Python 3 (engine) + real Ansible/Terraform | Hardware: none (a VM/container for real Ansible)

Concept primer: ../WARMUP.md Ch. 5–7, ../HITCHHIKERS-GUIDE.md §4–§6.

Run

python3 solution.py     # converge -> no-op -> drift -> remediate (idempotency proven)

Files

0. The mission

Internalize the one idea under every CM/IaC tool — declare desired state, converge, be a no-op once converged, correct drift — by building the engine and reading the real artifacts (playbook.yml, main.tf) that do it against real systems.

1. What the engine proves

A "resource" is (check, apply): check if already in the desired state; apply only if not. The run shows the three behaviors that define configuration management:

1. First converge changes everything (fresh node).
2. Second converge is a no-op — idempotency.
3. Drift (sshd stopped, config hand-edited) is detected and remediated back to desired.

This is literally the same control loop as Terraform (plan/apply/drift) and a Kubernetes operator (Phase 06) — declared vs discovered, converged.

2. The real artifacts

• playbook.yml: every Ansible task uses a declarative state: so re-running reports "ok" (no change). Note --check for a dry-run (plan), handlers for restart-on-change, and that secrets never appear in the file.
• main.tf: Terraform manages the infrastructure layer (BMC boot order via Redfish) while Ansible configures inside the OS — they compose. Note plan before apply, sensitive variables, ssl_insecure = false (validate the cert — Phase 03 Ch. 7), and that state is the locked source of truth.

3. Extensions (do them)

1. Run the playbook for real against a container/VM: ansible-playbook -i inventory.ini playbook.yml, then run it again and confirm the second run reports zero changes (idempotency on real hardware). Hand-edit /etc/rack/node.conf and re-run to watch drift correction.
2. Ansible Vault: encrypt a secret and reference it, so credentials never sit in plaintext.
3. A Terraform plan discipline: change a value, run terraform plan, and read the create/change/destroy diff before applying.
4. Scheduled drift detection: run the engine on a timer and alert (Phase 07) when drift is found — the basis of continuous compliance.
5. Compare pull-based: sketch how Puppet/Chef agents would do the same convergence on a pull schedule, and the tradeoff vs Ansible's push.

4. What this lab proves

You understand configuration management at the level that lets you reason about any tool, not just recite one. "What is idempotency / Ansible vs Puppet / Terraform state and drift" become precise answers backed by an engine you built — and you can connect it to the Phase 06 operator and the Phase 13 capstone as the same convergence pattern.