Why Ansible Won Mindshare
Ansible (released 2012, acquired by Red Hat in 2015) disrupted the CM market with a single architectural decision: no agents. It connects to target servers over standard SSH (or WinRM for Windows) — the same protocol sysadmins already use. There is nothing to install on managed nodes.
This eliminated the biggest operational burden of Chef and Puppet: bootstrapping. Before you could manage a server with Chef, you had to install the Chef agent on it. Before you could install the Chef agent, you needed some other mechanism to do that installation. Ansible breaks this chicken-and-egg problem.
| Feature | Chef / Puppet | SaltStack | Ansible |
|---|---|---|---|
| Agent Required | Yes | Yes (or SSH) | No |
| Connection Model | Pull (HTTP) | Pull (ZeroMQ) or Push (SSH) | Push (SSH / WinRM) |
| Setup Complexity | High (Master + Agents) | Medium (Master + Minions) | Low (pip install) |
| Change Latency | ~30 min (periodic) | Seconds (persistent conn) | Immediate (on-demand) |
| Drift Correction | Automatic (continuous) | Automatic (continuous) | Manual (re-run playbook) |
| Language | Ruby DSL / Puppet DSL | YAML + Jinja2 | YAML |
| Ideal For | Long-lived servers, compliance | Large fleets, real-time ops | Cloud, ephemeral infra |
The Trade-off Ansible Makes
Ansible's agentless model has a cost: no continuous enforcement. Chef and Puppet agents run every 30 minutes and will revert unauthorized changes. Ansible only runs when you explicitly trigger it. If someone manually changes a config file on a server managed by Ansible, that change persists until the next playbook run.
For immutable infrastructure this doesn't matter — you never change a running server, you replace it. But for long-lived servers in regulated environments (PCI-DSS, HIPAA), the continuous enforcement of Chef/Puppet is a genuine compliance advantage.
A common interview question: "If Ansible has no agents and is simpler, why would anyone still use Chef or Puppet?" The answer is continuous drift correction. In a compliance-heavy environment (financial services, healthcare), you need a guarantee that a server's configuration hasn't been tampered with between deployments. Chef and Puppet provide this automatically. Ansible requires you to schedule regular playbook runs to achieve the same effect — which is operationally equivalent but requires explicit orchestration.
Key Point: The choice between agent-based and agentless tools is not purely about simplicity — it is about whether you need continuous enforcement (agent-based wins) or operational simplicity and cloud-native compatibility (agentless wins). Most modern organizations use Ansible or Terraform for new infrastructure and maintain Chef/Puppet only for legacy fleets they haven't yet migrated.