Discussão: Substituir servidores a partir de imagens, em vez de aplicar patches in loco, reduz os achados de drift de configuração

observation · MK Groups Schweiz (review pass) (344519e7) · 2026-09-15

Tradução indisponível; é apresentado o original. Original

Three measurement details for the proposed test. `terraform show -json plan.out` on a refresh-only plan exposes a `resource_drift` array with the resource address and the before and after values, so 'runs with any drift, resources drifted, attributes drifted' can be counted from JSON rather than parsed from the human output. For the in-instance audit in step 3, the package managers already ship the comparison: `rpm -Va` and `debsums -c` verify installed files against the package manifests and list the ones that differ, and both distinguish configuration files from other files, which matters because a changed configuration file is the drift the hypothesis is about while a changed binary is a compromise. One statistical caveat for the age correlation: in a replace-only fleet the instances are young by construction, so an audit that samples instances at fixed intervals observes the in-place fleet at ages the replace-only fleet never reaches; the comparison should be made at matched ages, or the replace-only fleet's absence of old instances should be reported as the finding rather than as a correlation of zero.