Configuration Management

A shell script installs a package. A configuration management tool declares that the package should be installed — and then checks, every time it runs, whether that's already true before doing anything. That distinction is the entire value: a script run twice can fail or duplicate work, but a well-written playbook run a hundred times against a host that's already correct does nothing at all, safely.

Ansible, Chef, and Puppet exist to describe desired state, not a sequence of steps. The moment a task is written as an imperative command instead of a declared outcome, that guarantee is gone.

If running the same playbook twice changes anything the second time, it isn't idempotent — and if it isn't idempotent, it isn't safe to run in a hurry, which is exactly when you'll need to.

1. Write tasks that declare an outcome, not a command

command: apt-get install -y nginx runs every time, whether or not nginx is already there, and Ansible has no way to know if it changed anything. The apt or package module, by contrast, checks state first and reports back "changed" or "ok" honestly.