Terraform and Ansible are both called infrastructure as code. How do they differ, and when would you use each?
What the interviewer wants to hear
- Terraform is declarative provisioning of cloud resources with state
- Ansible is mostly configuration management over SSH, agentless, no state file
- Terraform plans changes before applying
- Ansible fits OS config, packages and app setup on servers
- With immutable images and Kubernetes, Ansible use often shrinks
Model answer
Terraform is a declarative provisioning tool. I describe cloud resources such as VPCs, databases and clusters, and it keeps a state file so it can plan the exact create, change and destroy steps before applying them. It is strongest at the lifecycle of infrastructure objects through cloud APIs. Ansible is mainly a configuration management tool: it connects to existing machines over SSH without an agent and runs idempotent tasks to install packages, write config files and restart services. It has no state file; it checks the current state of each host when it runs. So I would use Terraform to create the servers, network and managed services, and Ansible to configure long-lived VMs or network devices, or to bake machine images with Packer. In container-based platforms the Ansible part often shrinks, because configuration moves into images and Kubernetes manifests.
Can you answer it under time pressure?
Take a timed easy round and get scored on every answer.
More easy DevOps Engineer questions
- What does DevOps mean to you, and how is it different from a traditional operations team?
- Walk me through the stages of a typical CI/CD pipeline you would build for a web service.
- How is a container different from a virtual machine? When would you choose one over the other?
- What is Infrastructure as Code and why is it better than creating resources by clicking in the cloud console?
- Explain how a Deployment, a Service and an Ingress work together to expose a web app in Kubernetes.
- Compare trunk-based development with GitFlow. Which would you choose for a team that deploys several times a day, and why?
- Walk me through what happens when you run docker run -p 8080:80 nginx:1.27 on a fresh machine.
- What is the difference between monitoring and observability, and what are the main signals you would collect for a web service?
- How does a load balancer use health checks, and what makes a good health check endpoint?