Ansible

Ansible configures machines by connecting over SSH and executing modules. Playbooks are YAML listing tasks against inventory groups. There is no agent and no server, which is the single fact that explains its adoption.

Why agentless matters so much

Every other tool in the category — Puppet, Chef, Salt — requires installing an agent on managed hosts and usually running a central server. That is a bootstrapping problem and an ongoing operational commitment before any configuration is managed at all.

Ansible needs SSH access and Python on the target. Both are already there. You can manage a machine five minutes after deciding to, and that difference in adoption cost is why Ansible is often the tool in place — it can be adopted incrementally, on one host, without a project.

The corollary is real: it is also easy to adopt badly, as a directory of playbooks nobody has organised.

Push, and what it costs

Ansible pushes: an operator runs a playbook against hosts. Agent-based tools pull, checking in periodically and correcting drift on their own.

Push gives precise control over what changes and when, which suits deployments. It also means configuration is only enforced when someone runs it. A host that drifts between runs stays drifted, and a host that was down during a run is silently skipped. Nothing notices.

That is the fundamental trade against Puppet and Salt. For continuous convergence across a large fleet, pull is the better model. For orchestrated sequences across hosts in a defined order — rolling restarts, coordinated upgrades — push is much more natural, and this is where Ansible is strongest.

Practical notes

Idempotency is a property of the modules, not the tool. Well-written modules check state before changing it. A shell or command task does not, and a playbook full of shell tasks is a script with worse ergonomics. Reaching for shell is usually a sign the right module exists and has not been found.

Speed is the common complaint. SSH connections per task, across many hosts, add up. Pipelining, mitogen, and raising forks all help; it remains slower than agent-based alternatives at scale.

YAML is not a programming language. Playbooks with heavy conditionals, loops, and Jinja expressions become genuinely hard to read, and this is the point at which the tool is being pushed past its shape.

See also: Puppet, Chef, SaltStack, the comparison, and OpenSSH.