What is configuration drift?

Configuration Drift is the mismatch between the current state of a system's configuration (server, application, infrastructure) and its desired or expected state. It occurs when changes are made manually or uncontrollably, bypassing automated configuration management tools. Over time, this can lead to instability, errors, diagnostic difficulties, and reduced security.

Causes:

• Manual changes by administrators or developers.
• Absence or malfunction of configuration management tools.
• Insufficiently strict deployment and change management processes.
• Errors in automated update or deployment processes.

Consequences:

• Unpredictable system behavior.
• Difficulties in reproducing errors.
• Scaling issues.
• Security vulnerabilities.
• Increased troubleshooting time.

Dealing with drift:

• Using configuration management tools: Puppet, Chef, Ansible, SaltStack.
• Infrastructure as Code (IaC): Terraform, CloudFormation. Describing infrastructure as code for automatic creation and management.
• Immutable infrastructure: When changes are made, new components with the required configuration are created instead of updating existing ones.
• Monitoring and auditing systems: Tracking changes and comparing the current state with the baseline.
• Strict CI/CD processes: Automated deployment, testing, and change implementation through pipelines.

Example (simplified):

Desired state: Nginx is installed on the server with a specific virtual host. Drift: Someone manually deleted the virtual host configuration file.

// Desired state:
server {
    listen 80;
    server_name example.com;
    location / {
        root /var/www/html;
        index index.html;
    }
}

If this file is deleted or manually changed, and the configuration management system has not reapplied it, drift occurs. IaC or configuration management tools will detect or correct this discrepancy on the next run.