[CoolCold]

I'm moving thinking that Ansible is simpler for simple things, but complex for complex things, I find it more and more often in our servers configuration to have "configuration drift" due to fact Ansible encourages to managing by parts, not as whole system. And very rare is run automatically over all nodes say every 15 minutes.

[_joel]

I'm not sure what you mean by parts and not a whole system. It's defined via hosts inventories which, by defintion are a whole system. You obviously include roles and further tasks for those definitions.

You'd use cloud-init, as the other poster mentions, to initalise, or use ansible in SSH mode with the inventory coming from your cloud provider or just an ini/YAML list curated by yourself, then run it regularly from something Jenkins/Rundeck/Cron whatever, in which case cloud-init configures your ansible run user and ssh keys so you can kick it off from the main box and perhaps register the node, or use tags in cloud provider, loads of ways.

[CoolCold]

> I'm not sure what you mean by parts and not a whole system. From what I see around, work with Ansible is organized via multiple playbooks i.e. * playbooks/nginx.yaml * playbooks/kafka.yaml * playbooks/monitoring.yaml

each of them configuring only subpart of the whole system. Some of them may have intercrossing functions, like changing sysctls. Thus, it's enforcing state of subset of services, and if, for example after Nginx playbook you logically need to run Monitoring playbook, it can be forgotten/skipped -> configuration drift grows.

Hope it clarifies.

[encryptluks2]

Isn't that the point of things like cloud-init, and other system tools. Ansible may not be great at deploying, but the whole purpose would be to catch the drift using Ansible.