Fabric.

http://www.fabfile.org/

Works over SSH. Uses pure Python. No need to deploy and configure minions/agents/etc.

Fabric also benefits from being highly composable. Since it's python, you can parametrize and reuse functions and create class-based tasks [1]

Want to use Fabric with python 3? Here is a fork with Python 3 support: https://github.com/mathiasertl/fabric/

If you use fabtools, I maintain a fork of it for fabric3: https://github.com/develtech/fabtools/tree/fabric3

[1] http://docs.fabfile.org/en/1.14/usage/tasks.html#task-subcla...

I've been writing so much boring backend Java for so long... Some Python would be a sorely needed breath of fresh air. Thanks for pointing me in this direction. I might just play around with it on my homelab for the fun of it!

This is an interesting read on Config Management which essentially concludes that makefiles with Jenkins (etc.) work best:

https://fortyft.com/posts/ansible-puppet-chef-no-thanks/

For more bells and whistles (and a steeper learning curve) try Escape:

https://escape.ankyra.io/docs/what-is-escape/

Thank you for the article link! It was an interesting read, indeed. I hadn't thought of this seemingly obvious approach, and it's one that won't be too difficult to pitch to management.

I've been trying as much as possible to stick to Packer[1] (create AMI's / Images) and Terraform[2] for executing arbitrary commands and shell scripts. Some may argue this is not truly configuration management because it does not constantly check and maintain desired state.

[1] - https://packer.io

[2] - https://terraform.io

> This has me thinking Ansible.

Yeah, no, bad choice. Ansible only pushes configs to remote servers, and on-line ones at that. Don't expect a retry if any of the servers is down. Good match for deploying things, but terrible for long term management. It's somewhat similar with this regard to Jenkins.

Also Ansible's approach of using SSH (directly to root or through sudo) is brittle; prepare for outages if you start changing sshd config or sudoers, as it's easy to cut off your all channels: configuration distribution, running predefined procedures, and debugging. And there's more, like managing hosts' public keys being PITA (as always with SSH) or weird way of encoding a programming language as YAML with mismatching preprocessor (Jinja2).

If you have Puppet deployed, stay with Puppet for managing configuration.

That’s not quite true. Ansible will happily run locally without SSH. A machine can easily be configured to pull Ansible roles from git or S3 and then run a playbook.

I use ansible to do remote execution, and upload more complex scripts to do tasks. Doing everything with Ansible is hard and most often you spend more time learning the quirks of Ansible and not solving problems.

Ansible for remote execution and your write your own scripts, tha has been a good combination for me.

Very resently I remake all my bash and makefile scripts to use just python scripts with https://github.com/mariocesar/boot.py, taking advantage that all my instances have Python 3.6 by default.

Have python3 for scripting makes doing sysadmin work joyful.

I use CFEngine -- because of its maturity, wide range of supported platforms, and the amazing support I experienced from the author and community.

I wrote this 3 years ago and it's still true today: http://verticalsysadmin.com/blog/cfengine-is-awesome/

Offering training and consulting on CFEngine has allowed me the privilege of training top-notch talent from all over the world (and to see more of the States).

The project I'm working on currently, it's 95% Chef. The remainder is Ansible. We use Ansible for what it's good at, and Chef for the rest.

Have you tried AWS OpsWorks for Puppet Enterprise or Stacks yet?