Infrastructure as Code (IaC)

The foundational paradigm shift from imperative scripting. Engineers define the desired end-state of the infrastructure (e.g., '5 instances, this IP range, this version'), not the step-by-step commands to get there. An automated engine (like a Kubernetes Operator) calculates the necessary actions to converge the live state to the declared state.

• Idempotency is a core guarantee: applying the same configuration twice produces the same result.
• Eliminates configuration drift by constantly enforcing the declared state.

All infrastructure definitions—network topologies, security policies, server specs—are stored as text files in a Git repository. This makes the repo the single, auditable source of truth for the entire network's desired state.

• Every change is tracked with a commit history, author, and timestamp.
• Enables collaborative development through branching, pull requests, and code reviews for infrastructure changes.
• Provides a powerful rollback mechanism: simply revert to a previous commit to restore a known-good state.

The core control mechanism that makes IaC self-healing. A software agent continuously observes the actual state of the system and compares it to the desired state defined in the source of truth. If a discrepancy is detected (e.g., a server crashes, a manual change is made), the agent automatically takes corrective action to restore the desired state.

• This is the practical implementation of a MAPE-K Loop (Monitor-Analyze-Plan-Execute over a Knowledge base).
• Transforms infrastructure management from a reactive, ticket-driven process to a proactive, autonomous one.

A deployment paradigm where components are never modified in-place after provisioning. Instead of patching a running server, a new, updated server is built from a common image, and the old one is simply decommissioned.

• Eliminates configuration drift and 'snowflake servers'—no two environments diverge over time.
• Dramatically simplifies rollbacks; just redeploy the previous, known-good version.
• Enables canary and blue-green deployments for network functions, reducing the blast radius of a bad update.

Security, compliance, and governance rules are defined in a high-level, machine-readable language and enforced automatically within the provisioning pipeline. A policy engine validates every infrastructure change against these rules before it's applied.

• Example: A policy can mandate that no storage bucket is publicly accessible or that all inter-service communication uses Mutual TLS (mTLS).
• Policies are versioned and tested alongside infrastructure code, shifting security left in the development lifecycle.
• Ensures continuous compliance with standards like SOC 2 or the EU AI Act without manual audits.

IaC tools promote breaking down complex systems into reusable, composable modules. A module encapsulates a specific piece of infrastructure (e.g., a secure subnet, a Kubernetes cluster) with defined inputs and outputs.

• Teams can build a library of approved, golden-path modules that embed organizational best practices.
• Reduces duplication and accelerates provisioning; a complex Network Service Descriptor (NSD) can be assembled from pre-built components.
• Promotes a 'Don't Repeat Yourself' (DRY) principle for infrastructure, making large-scale management feasible.

A deployment paradigm where components are never modified after provisioning. Instead of patching a running server, a new, updated instance is built from a common image and the old one is decommissioned.

• Consistency: Eliminates configuration drift and 'snowflake' servers.
• Reliability: The known-good state is baked into the image.
• Security: Reduces the attack surface by removing long-lived, manually-tweaked hosts.

A property of an operation ensuring it produces the same result regardless of how many times it is executed. This is a critical requirement for reliable automated provisioning scripts.

• Safety: Re-running a playbook or configuration does not create duplicate resources or cause errors.
• Convergence: The system only makes changes if the current state differs from the desired state.
• Example: A task to 'ensure a user exists' will create the user once and do nothing on subsequent runs.

A continuous control mechanism in declarative systems that compares the observed state of a resource against its desired state and automatically takes action to correct any drift.

• MAPE-K Loop: The autonomic computing model (Monitor, Analyze, Plan, Execute, Knowledge) that formalizes this process.
• Kubernetes Controllers: A canonical implementation where controllers constantly reconcile the cluster to match the declared specs.
• Self-Healing: The core mechanism enabling autonomous remediation without human tickets.