Infrastructure as Code and Automation

# CHAPTER 18

Infrastructure as Code and Automation #

1. Introduction #

2. Learning Objectives #

• Define Infrastructure as Code (IaC) and its operational benefits.

• Differentiate between Mutable and Immutable infrastructure paradigms.

• Architect an integration pipeline combining Terraform and Ansible.

• Understand the concept of "Golden Images" (Packer + Ansible).

• Define the core tenets of a DevOps culture.

3. Beginner-Friendly Explanation #

• Mutable Infrastructure (The Old Way): You buy 10 taxis. When the brake pads wear out, you pull the taxi into the garage, manually unscrew the old pads, and install new ones. Over 5 years, every taxi has been repaired differently and has different quirks. (Ansible patching live servers).

• Immutable Infrastructure (The Modern Way): You buy 10 taxis. When the brake pads wear out, you *crush the taxi into a cube*, throw it away, and instantly instantly instantly 3D-print a brand new, perfect taxi. You never fix anything; you only replace. (Containers and Auto-Scaling Cloud Servers).

Ansible can manage the old way perfectly, but it truly shines when used to "3D-print" the perfect taxi in the modern way.

4. Mutable vs. Immutable Infrastructure #

• *Pros:* Faster deployments (you just copy files).

• *Cons:* "Configuration Drift." Over 3 years, artifacts build up. If you try to build a 2nd identical server, it might fail because of a forgotten dependency from 2 years ago.

Immutable (Unchangeable): You *never* log into a live server to update it. Instead, when there is a code update, you use Ansible to configure a *brand new* server template (an AMI or Docker Image). You test it. If it works, you deploy 50 copies of the new template to the cloud, and delete the 50 old servers.

• *Pros:* Perfect consistency. Zero Configuration Drift. Easy rollbacks.

• *Cons:* Slower deployments (you have to build and boot whole servers/images).

5. The Ultimate DevOps Trinity: Packer + Terraform + Ansible #

1. 1. Packer (The Baker): Spins up a temporary server.

1. 2. Ansible (The Recipe): Logs into the temporary server, installs Nginx, security hardening, and your application code. Packer then saves this perfect server as a "Golden Image" (an AWS AMI) and deletes the temporary server.

1. 3. Terraform (The Delivery): Takes the Golden Image and deploys 50 exact copies of it to the live cloud behind a Load Balancer.

*In this modern workflow, Ansible never actually touches the live production servers. It is used strictly in the CI/CD pipeline to bake the Immutable Golden Image.*

6. Mini Project: Build Production-Ready Infrastructure Setup #

The Repository Architecture:

infrastructure-repo/
├── .github/workflows/   (CI/CD Pipeline triggers)
├── terraform/           (Hardware Definition)
│   ├── main.tf          (Builds VPC, Load Balancers, EC2s)
│   └── outputs.tf
└── ansible/             (Software Definition)
    ├── inventory/       (Dynamic AWS inventory plugins)
    ├── roles/           (Nginx, MySQL, Hardening)
    └── site.yml         (The master playbook)

*When a developer wants to add a new server, they don't click buttons in AWS. They edit terraform/main.tf to define the hardware, and ansible/site.yml to define the software. They open a Pull Request. The entire company's infrastructure is entirely described by text files.*

7. Real-World Scenarios #

8. Best Practices #

• Idempotency is Mandatory: Whether you use Mutable or Immutable infrastructure, your Ansible code MUST be idempotent. If a pipeline runs twice by accident, it should not crash the server or deploy two copies of an application. The changed=0 status is the hallmark of a mature DevOps codebase.

9. Security Recommendations #

• Git Repository Security: If your entire company's infrastructure is defined in a GitHub repository, that repository is the most sensitive asset your company owns. Access to the main branch must be fiercely protected. Implement Branch Protection rules, mandate Two-Factor Authentication (2FA) for all contributors, and require at least two approving reviews before any Pull Request can be merged.

10. Troubleshooting Tips #

• Ansible Execution Speed: If you have 1,000 Mutable servers and Ansible is taking an hour to run, you are likely hitting the default forks limit. By default, Ansible only talks to 5 servers at a time. In your ansible.cfg, increase forks = 50 or higher to drastically speed up massive fleet orchestration.

11. Exercises #

1. 1. Explain the operational difference between Mutable and Immutable infrastructure regarding handling application code updates.

1. 2. In the "Packer + Terraform + Ansible" architecture, what is Ansible's specific responsibility?

12. FAQs #

13. Interview Questions #

• Q: Define "Infrastructure as Code." How does managing infrastructure via Git repositories fundamentally alter a company's disaster recovery capabilities?

• Q: Contrast the operational philosophies of Mutable versus Immutable infrastructure. Describe an enterprise deployment workflow utilizing Packer, Ansible, and Terraform to achieve an immutable release cycle.

14. Summary #

15. Next Chapter Recommendation #