09 · Automation

Automation that converges

Desired state, actual state and a loop between them. A second run should change nothing.

2-minute guide
All field guides

The model

Automation declares a desired state and closes the gap to the actual one: a playbook run, an infrastructure plan, a controller’s reconcile loop. Good automation converges. Run it twice and the second run changes nothing.

Exit code 0 means the steps ran. It does not mean the service accepts the result. Check with the service’s own validation and a real request. Before any apply, read what it proposes: a replaced object loses whatever it held.

Illustrative — fictional names; a sync loop with automatic correction.

Worked example

Git declares 3 replicas. At 02:00 someone scales to 5 by hand. The controller compares every 3 minutes, so by 02:03 the cluster is back to 3. The hand edit drifted and lost. To change the outcome, change the source, or pause sync on purpose and record it.

Scripts and playbooks face the same test. Before trusting one, run it against a target that is already correct: it should report no changes, and the service should still pass its own checks.

Commands worth running

Example names are fictional.

ansible-playbook site.yml --check --diff

Predicts changes without making them. After a real run, a converged host reports changed=0.

tofu plan

Compares configuration with recorded state and prints what apply would do. Read the add, change and destroy counts before approving.

kubectl get deployment web -o yaml

Compare metadata.generation with status.observedGeneration. Equal means the controller has acted on the latest spec; the conditions say whether it worked.

Self-check

You fix production by hand at 02:00. What happens at the next sync?
Show answer
With automatic sync, the controller reverts your edit to match the source. Put the fix in the source, or pause sync deliberately and say so.

References

Practise it

Downloads went dark after routine maintenance Workshop lists cannot be retrieved