Comparison
Ansible vs Chef vs Puppet
The three classic configuration-management tools compared — agent model, language, and where each still fits today.
In short — All three enforce desired server state, but differ in architecture and language. Ansible is agentless and procedural-ish YAML; Chef and Puppet are agent-based with a Ruby DSL and a declarative model, respectively.
| Ansible | Chef | Puppet | |
|---|---|---|---|
| Agent | Agentless (SSH) | Agent + server | Agent + server |
| Language | YAML playbooks | Ruby DSL (recipes) | Declarative Puppet DSL |
| Model | Push, ordered tasks | Pull, converge | Pull, declarative catalog |
| Learning curve | Gentle | Steep (Ruby) | Moderate |
| Idempotency | Per-module | Resource-based | Resource-based |
| Best for | Ad-hoc + orchestration | Developer-heavy shops | Large, long-lived fleets |
Which should you use?
Ansible wins for most new work: agentless, readable, and doubles as an orchestrator. Puppet still shines for large, long-lived fleets that want strict declarative enforcement. Chef fits teams comfortable in Ruby with existing cookbooks — but new adoption has slowed.
Go deeper
Full, hands-on DevSecOps courses