DevSecOps Practice Hub

Configuration Management

Keep system configuration declarative, versioned and continuously reconciled against drift.

IntermediateConfiguration ManagementInfrastructure

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Deploy Policy enforcement, admission control and infrastructure security.
  • Operate Runtime security, secrets rotation and configuration reconciliation.

Overview

Declarative configuration plus scheduled reconciliation means hardening survives manual changes, reboots and rebuilds.

Why it matters

Hardening applied once decays. Continuous reconciliation is what keeps a benchmark true.

How it works

  1. 01Desired state is defined in version control.
  2. 02Runs are scheduled in check mode to detect drift and in enforce mode to correct it.
  3. 03Compliance scans verify against a published benchmark.

Common tools

AnsibleOpenSCAPPuppetAnsibleLinuxRed Hat

Implementation examples

bashDetect drift without changing anything
ansible-playbook site.yml --check --diff
Check mode reports what would change, which is a practical drift report.

Best practices

  • Schedule reconciliation, do not run it only on change.
  • Alert on drift volume, not just individual diffs.

Common mistakes

  • Hardening at build time only, with no ongoing enforcement.