Infrastructure as Code and Configuration Management
Infrastructure as Code and Configuration Management tests whether you can treat network configuration like software: versioned, reviewed, tested and repeatable. Expect Ansible internals, Terraform mechanics, and CI/CD pipeline design for data center devices.
Ansible essentials
Agentless over SSH, NETCONF or HTTP; inventory (static or dynamic), playbooks, tasks, roles and collections. Cisco content ships as collections: cisco.nxos (nxos_interfaces, nxos_vlans, nxos_config), cisco.aci (aci_tenant, aci_bd, aci_epg), cisco.dcnm, cisco.nd. Declarative modules report changed only when they modify state; nxos_command does not - it runs the command every time and always reports changed.
Terraform essentials
HCL declares resources from a provider; the workflow is init, plan, apply, destroy. State maps real objects to declared ones, so it belongs in a shared remote backend with locking, never on a laptop or in Git. plan refreshes against reality and therefore exposes drift; apply executes a plan.
CI/CD for network change
Typical stages: branch and pull request, then lint and syntax checks (ansible-lint, ansible-playbook --syntax-check, terraform fmt -check, terraform validate), then role or unit tests (Molecule) or a plan-only dry run against a lab, then peer review and an approval gate, then apply with a canary device first. Secrets come from a vault or the CI secret store, never from the repository.
Worked example
Add VLAN 240 to 40 NX-OS switches.
Reasoning: keep the VLAN definition in a variable file in Git; write a cisco.nxos playbook using nxos_vlans with id and name; add a --check --diff run to the pull-request pipeline to prove no unintended changes; run against one canary switch; verify with a separate assert playbook; then run the full inventory in batches. Terraform is a poor fit here because the switches are not managed as complete declarative resources with state - a per-device task model matches better.
Traps that cost marks
- Assuming
--checkworks for every module; many do not support check mode. - Committing Terraform state (it can contain secrets in plaintext) or inventory credentials.
- Using
nxos_commandfor configuration and then claiming the playbook is idempotent. - Applying straight from a laptop with local state, bypassing review and locking.