Courses Infrastructure as Code & automationBeginner · Foundations

Declarative vs imperative

Describe the end state, not the steps.

Beginner10 min · lesson 2 of 23

IaC tools come in two philosophies, and understanding the difference explains how each behaves. An imperative approach describes the steps to reach a goal: "create a server, then install nginx, then start it." A declarative approach describes the desired end state: "there should be one server running nginx" — and the tool figures out what actions are needed to get there from wherever things currently are. Most modern IaC is declarative, and that choice has deep consequences.

Two philosophies

imperative (the steps)

do this, then that

a script of actions

re-running is unsafe

may repeat or conflict

declarative (the end state)

this is what should exist

the tool computes the diff

idempotent

re-run safely; no change if already correct

Terraform is declarative. Ansible is mostly declarative in effect (idempotent modules) though it reads like steps.

Idempotence: the key property

The superpower of the declarative model is idempotence — applying the same configuration repeatedly produces the same result, making no changes if reality already matches the desired state. Run terraform apply when everything is already correct and it does nothing; run it after a resource was deleted and it recreates just that one. This is what makes IaC safe to run continuously: you are not issuing commands that might double-execute, you are asserting a desired state the tool converges toward. An imperative script that says "create a server" run twice makes two servers; a declarative config that says "one server" run twice still means one.

How declarative tools work: the reconcile loop

A declarative tool follows the same pattern you saw in Kubernetes: it compares desired state (your code) against current state (what actually exists) and computes the difference — what to create, change, or destroy — then makes only those changes. This "diff then converge" is why Terraform shows you a plan before applying: it is telling you the exact set of changes it computed to reconcile reality with your code. Understanding that the tool is always doing desired-minus-actual demystifies its behavior.

Declarative means the tool may DELETE things

Because a declarative tool converges reality to your code, removing a resource from your code tells it that resource should no longer exist — so the next apply destroys it. This surprises newcomers: deleting a few lines can tear down a database. Always read the plan before applying (it shows every create, change, and especially every destroy), and treat a plan that proposes destroying something you did not mean to remove as a stop sign. The tool does exactly what your code says should exist — no more, no less.

What Infrastructure as Code isThe IaC & automation tool…