I85PREP
⌘ K
GISI ADO Level study materials
GISI ADO Level study resources

GISI ADO Level: Configuration Management and Automation

GISI ADO Level · Work through your exam, one topic at a time.

All guide sections

Configuration Management and Automation

Scope of this domain

Configuration Management and Automation tests desired-state tooling for servers and middleware: convergence, idempotent resources, inventories, templating, execution order and testing. Expect questions on Ansible task behaviour and on agent-based tools such as Puppet and Chef.

Core rules and concepts

  • Desired-state tools converge a machine to the declared state and report whether anything changed; procedural scripts just run commands.
  • Ansible is agentless and push-based over SSH: inventory, playbooks, roles, modules, handlers triggered by notify, and --check with --diff for dry runs.
  • Puppet and Chef use an agent pull model with a catalog or run list, converging periodically to enforce state continuously.
  • Idempotency comes from modules such as user, package, service and template, not raw shell. When shell is unavoidable, guard it with creates, changed_when and failed_when.
  • Facts and variables drive templating; secrets come from Vault or a cloud secret store, never plaintext group variables.
  • Ansible executes tasks in order within a play; handlers run at the end. serial and strategy settings control rollout batches.
  • Test with ansible-lint, syntax check and Molecule or Testinfra. Bake images with Packer for immutable hosts and reserve configuration management for runtime configuration.

Worked example

A task runs useradd deploy on every run and always reports changed. Reasoning: the shell command has no concept of current state, so it is not idempotent and its handler fires every time. Replace it with the user module at state: present, which checks whether the account exists and reports changed only when it acts. Run the playbook twice in CI: the second run must report zero changes, and --check catches regressions early.

Traps that cost marks

  • Shell or command tasks without creates or changed_when guards.
  • Storing secrets in inventory or group variables.
  • Manual patching that drift later reintroduces or hides.
  • Treating configuration management as a one-time bootstrap instead of continuous convergence.
  • Applying untested playbooks to production without a check-mode run.