> Except you'll find that if you have more than one person looking after the machine, someone will install a package directly and it'll get removed by the next

> Except you'll find that if you have more than one person looking after the machine, someone will install a package directly and it'll get removed by the next person to run the script. This is explicitly the purpose of what is being done here. The state of the machine (or at least "which packages are installed") is described completely by the list. Here is a common problem that you get with Ansible: I go and build a new machine using an Ansible Playbook that has worked perfectly for 6 months. The production code doesn't run. It turns out that's because there is a package missing that is needed. That package was manually installed on the other server by someone to do a debug task, and then somewhere along the line an implicit dependency on it happened. With this approach that isn't possible - you've specified the entire (package) state of the system so it isn't possible for the config of the machine to drift from your code that specifies it. No need to worry your playbook is wrong, no need to do a nightly test of your playbook on a fresh VM.