Ansible vs Chef vs Puppet (2026)

Choose the right configuration management tool for your infrastructure. Compare Ansible, Chef, and Puppet across architecture, learning curve, scalability, and ecosystem — with real examples.

Feature Comparison

Ansible — Example Playbook

# playbooks/nginx.yml — Install and configure Nginx
---
- name: Configure web servers
  hosts: webservers
  become: true
  vars:
    nginx_port: 443
    server_name: app.example.com

  tasks:
    - name: Install Nginx
      ansible.builtin.package:
        name: nginx
        state: present

    - name: Configure Nginx
      ansible.builtin.template:
        src: templates/nginx.conf.j2
        dest: /etc/nginx/nginx.conf
        owner: root
        group: root
        mode: '0644'
      notify: Restart Nginx

    - name: Open firewall port
      ansible.posix.firewalld:
        port: "{{ nginx_port }}/tcp"
        permanent: true
        state: enabled

    - name: Ensure Nginx is running
      ansible.builtin.service:
        name: nginx
        state: started
        enabled: true

  handlers:
    - name: Restart Nginx
      ansible.builtin.service:
        name: nginx
        state: restarted

Chef — Example Recipe

# cookbooks/webserver/recipes/default.rb
package 'nginx' do
  action :install
end

template '/etc/nginx/nginx.conf' do
  source 'nginx.conf.erb'
  owner 'root'
  group 'root'
  mode '0644'
  variables(
    port: node['webserver']['port'],
    server_name: node['webserver']['server_name']
  )
  notifies :restart, 'service[nginx]', :delayed
end

firewalld_port "{node['webserver']['port']}/tcp" do
  action :add
  zone 'public'
  permanent true
end

service 'nginx' do
  action [:enable, :start]
end

Puppet — Example Manifest

# modules/webserver/manifests/init.pp
class webserver (
  Integer $port        = 443,
  String  $server_name = 'app.example.com',
) {
  package { 'nginx':
    ensure => installed,
  }

  file { '/etc/nginx/nginx.conf':
    ensure  => file,
    owner   => 'root',
    group   => 'root',
    mode    => '0644',
    content => epp('webserver/nginx.conf.epp', {
      'port'        => $port,
      'server_name' => $server_name,
    }),
    require => Package['nginx'],
    notify  => Service['nginx'],
  }

  service { 'nginx':
    ensure  => running,
    enable  => true,
    require => Package['nginx'],
  }
}

When to Choose Each Tool

• Choose Ansible when: small to medium fleet (<500 nodes), team without Ruby/DSL expertise, ad-hoc automation needs, mixed Windows/Linux environments, simple deployments and orchestration tasks.
• Choose Chef when: large scale (>1,000 nodes), strong compliance testing requirements (InSpec), team has Ruby experience, complex dependency graphs in cookbooks, enterprise compliance with Chef Automate.
• Choose Puppet when: very large fleet (10,000+ nodes), strong idempotency guarantees needed, declarative model preferred, Puppet Forge module coverage is critical, or existing Puppet investment.
• Use Terraform alongside all three for cloud resource provisioning — configuration management tools should not manage cloud API resources.