Editing Quattor (section)

=== Configuration management system ===
Quattor's configuration management system is composed of a configuration database that stores
high-level configuration templates, the Pan compiler that validates templates and translates them
to XML or JSON profiles, and a machine profile repository that serves the profiles to client nodes. Only the
Pan compiler is strictly necessary in a Quattor system; the other two subsystems
can be replaced by any service providing similar functionality.

Devolved management in a cross-domain environment requires users to be authenticated and
their operations to be authorized. For the configuration database X.509 certificates can be used
because of the support offered by many standard tools, and access control lists (ACLs)
because they allow a fine-grained control (an ACL can be attached to each template). When many
users interact with the system, conflicts and misconfiguration may arise which require a roll back
mechanism; to this purpose, a simple concurrent transaction mechanism, based on standard version
control systems, was implemented.

Quattor's modular architecture allows the three configuration management subsystems to be
deployed in either a distributed or centralized fashion. In the distributed approach, profile compilation
(at development stage) is carried out on client systems, templates are then checked into a
suitable database, and finally the deployment is initiated by invoking a separate operation on the
server. The centralized approach provides strict control of configuration data. The compilation
burden is placed onto the central server, and users can only access and modify templates via a
dedicated interface.

Since the two paradigms provide essentially the same functionality, the choice between them
depends on which fits the management model of an organization better. For instance, the centralized
approach fits large computer centres well because of its strictly controlled work-flow, whereas multi-site
organizations such as GRIF prefer the distributed approach because it allows different parts of
the whole configuration set to be handled autonomously.