一句话：首次系统分析 Ansible、Puppet、Chef 中 360 个 IaC 缺陷，总结其表现、根因、复现条件与修复方式。
现代应用日益复杂，手工安装与配置已不现实，IT 组织广泛依赖基础设施即代码（IaC）技术来自动化计算基础设施的供给、配置与维护。IaC 系统通常提供声明式领域特定语言（DSL），让管理员和开发者以可靠、可预测且可文档化的方式描述基础设施的期望状态。然而，IaC 软件如同传统程序一样会存在缺陷，从部署失败到严重影响生产系统的错误配置。本文首次对 Ansible、Puppet 和 Chef 等主流 IaC 生态中的 360 个缺陷进行深入分析，研究这些缺陷如何表现、其根本原因、复现所需的系统状态或输入特征，以及它们如何被修复。基于分析结果，作者评估了现有 IaC 可靠性技术，指出其局限，并为未来研究提出建议。
Modern applications have become increasingly complex and their manual installation and configuration is no longer practical. Instead, IT organizations heavily rely on Infrastructure as Code (IaC) technologies, to automate the provisioning, configuration, and maintenance of computing infrastructures and systems. IaC systems typically offer declarative, domain-specific languages (DSLs) that allow system administrators and developers to write high-level programs that specify the desired state of their infrastructure in a reliable, predictable, and documented fashion. Just like traditional programs, IaC software is not immune to faults, with issues ranging from deployment failures to critical misconfigurations that often impact production systems used by millions of end users. Surprisingly, despite its crucial role in global infrastructure management, the tooling and techniques for ensuring IaC reliability still have room for improvement. In this work, we conduct a comprehensive analysis of 360 bugs identified in IaC software within prominent IaC ecosystems including Ansible, Puppet, and Chef. Our work is the first in-depth exploration of bug characteristics in these widely-used IaC environments. Through our analysis we aim to understand: (1) how these bugs manifest, (2) their underlying root causes, (3) their reproduction requirements in terms of system state (e.g., operating system versions) or input characteristics, and (4) how these bugs are fixed. Based on our findings, we evaluate the state-of-the-art techniques for IaC reliability, identify their limitations, and provide a set of recommendations for future research. We believe that our study helps researchers to (1) better understand the complexity and peculiarities of IaC software, and (2) develop advanced tooling for more reliable and robust system configurations.
@article{DrososSAM024,
title = {When Your Infrastructure Is a Buggy Program: Understanding Faults in Infrastructure as Code Ecosystems},
author = {Georgios-Petros Drosos and Thodoris Sotiropoulos and Georgios Alexopoulos and Dimitris Mitropoulos and Zhendong Su},
journal = {Proceedings of the ACM on Programming Languages},
volume = {8},
number = {OOPSLA2},
year = {2024},
doi = {10.1145/3689799}
}