Blog
January 23, 2024
Why make a migration from Ansible to Puppet — or in some cases, start with Puppet over Ansible right out of the gate? In this blog, we’ll explore some common reasons that organizations say they chose Puppet over Ansible, citing specific use case examples around the functionality of each platform.
Table of Contents:
- Why Make an Ansible > Puppet Migration?
- Reason One: Security
- Reason Two: Scalability
- Reason Three: Harmony
- Get Started with Your Ansible to Puppet Migration
Why Make an Ansible > Puppet Migration?
Organizations choose Puppet over Ansible when they need to double down on continuous compliance and security — citing the scalability and agent-based approach to stay compliant with industry-specific regulations.
The short answer is that Puppet supports organizations that need to navigate complicated security and compliance requirements, all while ensuring that their code doesn’t run into conflict as it's executed.
Ansible: | Puppet: | |
Security: | Agentless approach requires an open connection each time a change or check is made — a security risk | Agent-based approach means that your security and compliance commands are executed on each server, even with an outage |
Scalability: | You will need to open a server connection for each change, update, patch, or etc., greatly reducing scalability | Puppet can run as many commands, updates, checks, etc., as needed, as often as you need it to every day |
Harmony: | More playbooks, more chance of conflict and problems with contradictory commands | Puppet lets you know when there is a conflict and shows you where the issue is before a problem occurs |
Reason One: Security
To understand how Puppet stacks up against Ansible for security and compliance, and why organizations choose Puppet, you have to understand how an agent vs. agentless approach works for security.
Not all organizations or industries face the same level of security concerns and compliance scrutiny. For orgs working in the healthcare, banking, or government industries as an example, weighing agent vs. agentless is a much weightier consideration. You’ll want to keep this in mind as we explore this comparison — what are your specific security requirements?
Agentless Security: More Open Connections, More Issues
With Ansible, you won’t have agents installed on your servers. To connect with your servers to execute a task or a patch for example, you will need to open a connection to those servers from your central point of command. This process requires an external login or an open firewall — which many security policies don’t allow. An open connection can create an open opportunity for security risk.
If a server is unreachable, critical compliance and security enforcement might be skipped. With Puppet, all necessary instructions are directly on the local server. No network? No problem — Puppet is always working.
Agent-Based Security: Always Online + Secure
Puppet’s agent-based approach means that an agent is installed on each of the servers that you need to keep secure. Without requiring an external connection, these agents stay busy enforcing compliance and security requirements automatically — there is no need to open a connection or remotely log in to make sure everything is running as planned.
Reason Two: Scalability
You can build an infrastructure that goes on forever — scalability isn’t defined by the number of servers you can manage, but rather, how often you need to manage them.
You might think about the post office — let’s say they deliver 3 million pieces of mail once a day to addresses across the country. But what if they needed to deliver mail twice a day, or three times a day? In this case, the scalability would be unmanageable, they would need 10x the number of employees, trucks, and infrastructure to support the frequency.
In this same way, it doesn’t matter if you have 10k servers or more, how often do you need to manage or maintain the health of those servers daily? With Puppet’s agent-based approach, it doesn’t matter if you need to execute 48 checks a day — you can accomplish this with the scalability that agents installed on your individual servers can provide.
Puppet can execute a script in the same way that Ansible can execute a script, but our definition of scalability is different. We’ve seen some customers use Ansible and Puppet simultaneously to execute different tasks. But for compliance and security, no one can achieve scalability like Puppet.
Reason Three: Harmony
Ansible uses a functional, simple language and a clear user interface — this is a selling point when you’re executing simple commands. The simple stuff is simple, users can build a playbook and then execute that playbook (AKA a series of tasks) across their servers without a problem.
The problem occurs when you start to deploy a playbook, and then another playbook, and then a playbook on top of that — we’ve heard from customers that this becomes difficult to track and manage, and that conflicts can arise and cause problems down the road.
Puppet prioritizes harmony by letting you know when there’s a conflict before a change is pushed out. It tells you when there’s an issue, automatically, and can handle incredibly complex and layered changes to your infrastructure. Puppet was built to handle complexity by default, making sure you don’t have to waste time searching for the source of a problem when you have conflicting commands.
Get Started with Your Ansible to Puppet Migration
Whether you’re considering a change from Ansible to Puppet or examining each of these platforms for the first time, we can help you make a more informed decision with a free trial of Puppet.
We’re confident that Puppet’s security, scalability, and harmony will all be powerful reasons to choose our platform above any other to accomplish your IT infrastructure goals and stay continuously compliant + secure.
The trial is free, why not see Puppet in action for yourself?