Core: Automation

Automation tooling - Ansible vs Terraform and orchestration

Miro Kosut

Miro Kosut

— 2 min read
Share

Requirement / business driver

Pick the right tool for the job - the blueprint's emphasis is when to use each, not how to code them.

Options

  • Ansible - agentless config management; idempotent modules push config/state to existing devices.
  • Terraform - declarative provisioning with a state file; stands up infrastructure/cloud resources and manages their lifecycle.
  • Orchestration (NSO / controllers) - service-level models (YANG) with transactional rollback across many devices.
  • Python - the glue: custom logic, API calls, parsing, and anything the above don't cover.

Comparison

automation-tooling-matrix

Recommendation / justification

Map tool to task: Ansible to configure network gear, Terraform to provision infra/cloud, orchestration (NSO) for multi-device services needing transactional rollback, and Python to glue and extend. They combine (e.g., Terraform provisions, Ansible configures, Python integrates). Justify by what you're changing (device config vs infra lifecycle vs a service) and the need for rollback and state.

What would change this (mid-scenario twist)

  • Multi-device service with strict rollback -> orchestration platform (NSO) over ad-hoc playbooks.
  • Cloud/infra resources lifecycle -> Terraform's state-based plan/apply/destroy.

Validation checks

  • Does each tool match its sweet spot (config vs provisioning vs service orchestration)?
  • Is state/rollback handled appropriately for the change's blast radius?

IPv6 / dual-stack note

All are address-agnostic; the templates/models they apply must cover v4 and v6 alike.

Spaced repetition

Ansible vs Terraform sweet spots: Ansible = [...]; Terraform = [...].

Ansible vs Terraform sweet spots: Ansible = config management of existing devices (agentless, idempotent); Terraform = provisioning infra/cloud resources with a state file (lifecycle).

When do you reach for an orchestration platform (NSO) over playbooks?

For multi-device, service-level changes that need transactional rollback and maintained service state.

Python's role in the toolchain is [...].

Python's role in the toolchain is the glue: custom logic, API integration, parsing, extending the other tools.

Sources

  • Cisco Press, Network Programmability and Automation; Ansible / Terraform / Cisco NSO docs.

domain: Core · blueprint-ref: Core 8.2.b/8.2.c/8.2.d/8.2.e Tools (Ansible, Terraform, orchestration, Python) · type: design-decision · status: complete · tags: [core, core/automation, tradeoff/operability, tradeoff/complexity]

Read more