Looking for a Desired State and Configuration as Code central configuration management framework

Question

I am looking for a central configuration management framework that supports the following scenarios:

1. Desired State Configuration. My expectation is to express the desired configuration in code and have the framework ensure it constantly to prevent the configuration drift. And, of course, it should support the pull mode.
2. All the configuration is managed in the Source Control (git, for example). I.e. no ad hoc scripts.

I come from the software development environment where having code outside of the Version Control is unthinkable. I want to treat my DSC specs the same - everything is in the version control, so when the configuration is changed by anyone it is easy to know exactly when, why, how and who changed it.

I started to look at the Azure Automation DSC, not sure if it fits the bill though - see Is it possible to keep all the DSC configurations in Version Control and make Azure Automation fetch it from there automatically?

Our servers are Windows Servers. Mostly 2012R2 with 2016 being slowly introduced.

Answer 1

Ansible is one example of a tool that that allows you to define all your configuration as scripts stored in your SCM and can deal with configuration drift. Ansible has modules to work with Windows in multiple ways including DSC through run books. Full information is available at: https://docs.ansible.com/ansible/latest/user_guide/windows.html.

For desired state configuration specifically - https://docs.ansible.com/ansible/latest/user_guide/windows_dsc.html#what-is-desired-state-configuration

There is also additional information in writing scripts to insure the system stays in the desired state. It is important to insure the way your writing the script does not in itself make differences in the system. - https://shadow-soft.com/ansible-idempotency-configuration-drift/

I know of many environments where the full system is defined and deployed with Ansible and it is used to remove any drift.

There are other ways to also help with the situation including using dynamic provisioning to shorten the life of systems. Only keeping them up for the length of a test or other short time frame.