Configuration management software keeps servers in a declared state: packages installed, services running, files and settings identical across a fleet.
This guide ranks eleven products on setup effort, the bill once support and security modules are added, how policy code and inventory leave, and whether you can buy and run one without a partner.
Vendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. How that works.
In short
What configuration management software does
Configuration management software holds the intended state of servers in code, applies it through agents or SSH, reports drift and corrects it, so large fleets stay consistent and auditable.
In this order: setup effort, what it really costs, how your data comes back out, whether you can leave, and who each configuration management tool is built for. Challengers hold places 1 to 3 wherever the category has them. Established brands begin at place 4. For why these five were chosen, and why nothing here gets a numeric score, see how we work.
Security-first configuration management from a Paris company, GPL core, per-node licences
Ranked #1 of 11 in Best Configuration Management Software in 2026.
Open sourcePricing on requestEurope
Rudder splits its offer into security configuration management, patch and vulnerability management, and benchmark compliance. Enterprise includes one of the last two; the Corporate Security Suite includes all of them with premium support.
The Core edition is open source, so a small team can start there. Price comes per node per year after contact, which makes budgeting a request rather than a lookup, and training and setup can be added.
What stands out
GPL 3 core
Per-node licence
Patch and CVE reports
Where it costs you
Commercial prices are not published, so cost needs a conversation.
A one-time onboarding fee applies in the first year if SLAs are required.
Right for
Security and compliance teams patching mixed Linux and Windows fleets under benchmarks
Wrong for
Teams wanting a plain application deployment tool
FrancePer node per year, quoted; one-month trial; Core edition open source
Long-running agent-based tool from Northern.tech, open Community edition and one-price Enterprise
Ranked #2 of 11 in Best Configuration Management Software in 2026.
Open sourcePricing on requestEurope
CFEngine splits cleanly: Community is open source under the GPL for Linux, and Enterprise is a commercial licence that adds a web interface, inventory and compliance reports, alerts and wider operating system support.
The vendor says Enterprise is sold as one product with no paid add-ons, which simplifies comparison. A free trial connects up to 25 hosts. The cost is learning its own policy language.
What stands out
Community and Enterprise
Linux or multi-OS
Single price per licence
Where it costs you
The Community edition runs on Linux only.
Enterprise prices are not listed, only a request for a quote.
Right for
Operations teams wanting an agent-based tool with one clear commercial price
Wrong for
Teams who want playbooks they already know
NorwayEnterprise at one price per licence, quoted; trial up to 25 hosts; Community edition open source
Per-node configuration management with published SaaS rates and a Business trial
Ranked #3 of 11 in Best Configuration Management Software in 2026.
Published pricingNorth America
Among the eleven products ranked here, Chef is one of the few that publishes rates, though only for the SaaS Business and Enterprise tiers. Enterprise Plus is quoted and allows 50 concurrent jobs against 10 below it.
Progress owns the product, and the Chef Infra source on GitHub is Apache 2.0. Chef is also sold through the AWS and Azure marketplaces, which may help if procurement already runs there. Count nodes before shortlisting, since the annual bill follows that figure.
What stands out
Per node per year
SaaS or self-managed
Apache 2.0 source
Where it costs you
Self-managed plans show only a quote button, so an on-premises buyer cannot compare rates with the SaaS tiers.
Only the Business tier has a trial, so Enterprise features cannot be tried before purchase.
Right for
Buyers who want to compare published SaaS rates in a market where most rivals hide prices behind a form.
Wrong for
Buyers who need to test the top tier first or want one flat fee across the whole fleet.
United StatesPer node per year; Business and Enterprise published; Enterprise Plus quoted; trial on request
Declarative configuration management with a developer tier and quoted commercial plans
Ranked #4 of 11 in Best Configuration Management Software in 2026.
Open sourcePublished pricingNorth America
Puppet sits near the top of this ranking for buyers who must prove security posture. Perforce sells Core with CVE remediation targets of 14 days for critical and 30 days for high issues, plus CIS Benchmark and DISA STIG modules, with Standard or Premium support.
Below 25 nodes Core is a free developer licence. Above that, every tier needs a quote. Open source Puppet remains available and maintained, so a small team can start there and decide on the paid build later.
What stands out
Tiered by nodes
Perforce-owned
CIS and STIG modules
Where it costs you
Commercial Core, Enterprise and Advanced are all priced through a form, so the real bill is unknown until sales replies.
The pricing page mentions no trial, which leaves the free developer licence as the only way to test.
Right for
Regulated teams that want CIS and DISA STIG modules with fixed CVE fix deadlines from the vendor.
Wrong for
Buyers who need a price list before first contact or a trial of the paid builds.
United StatesCore free below 25 nodes; commercial Core, Enterprise and Advanced quoted per request
Python-based remote execution and state tool with master, minions or SSH
Ranked #5 of 11 in Best Configuration Management Software in 2026.
Open sourcePricing on requestElsewhere
Salt costs nothing under Apache 2.0, which makes it the cheapest route into this category for a team that supports itself. The docs describe a Python code base, YAML as the default renderer, ZeroMQ as the default transport, with Tornado TCP as an option.
Salt SSH needs only port 22, and a proxy mode exists too. The trade-off is on the buying side: there is nothing to quote, so any support arrangement would have to be found outside the project site.
What stands out
Apache 2.0
Master and minion
YAML states
Where it costs you
The project site shows no commercial edition or price list, so a supported contract cannot be compared with Chef or Puppet.
The site carries a Broadcom copyright line but does not state a country, which leaves vendor location unclear for procurement files.
Right for
Engineering teams comfortable with Python who want a free tool with a choice of minion or SSH delivery.
Wrong for
Buyers whose procurement rules require a named vendor contract with published support terms.
Not stated by the vendorOpen source; the project site shows no vendor price list
Server lifecycle manager that classifies hosts for Puppet, Salt and Ansible
Ranked #6 of 11 in Best Configuration Management Software in 2026.
Open sourcePricing on requestElsewhere
Foreman provisions across bare metal, Amazon EC2, Google Compute Engine, OpenStack, Libvirt, oVirt and VMware, then classifies hosts for the configuration tool of your choice.
It shows host health dashboards and reports from Puppet, Salt and Ansible. Hammer CLI and a REST API serve automation, and plugins extend it. The code is GPL 3. Support, training and services pages exist, but their terms are not on the homepage.
What stands out
GPL 3
Provisioning
Hammer CLI and API
Where it costs you
It does not apply configuration by itself; it needs Puppet, Salt or Ansible.
The homepage names no company or commercial support terms.
Right for
Admins who provision bare metal and virtual machines and want one inventory
Wrong for
Teams wanting a single vendor to call
Not stated by the vendorOpen source under GPL 3; no vendor price list
Salt-based patching and Linux fleet management from the openSUSE Project
Ranked #7 of 11 in Best Configuration Management Software in 2026.
Open sourcePricing on requestElsewhere
Uyuni runs on Salt and can manage Linux servers, edge devices and Kubernetes environments from your own data centre, a third-party one or public cloud.
Patches and packages flow through channels you assign, and OS templates can be deployed on bare metal, virtual machines or containers. Compliance audits identify drift from hardened profiles. The licence is GPL 2.0 only, and the project belongs to openSUSE.
What stands out
GPL 2.0
Built on Salt
Patch channels
Where it costs you
Scope is Linux servers; the site does not describe other systems.
No paid support terms appear on the project site.
Right for
Linux estates needing patch channels, hardened templates and compliance reporting
Wrong for
Mixed Windows and Linux fleets
Not stated by the vendorOpen source under GPL 2.0; no price stated on the project site
Agentless SSH automation, community core plus Red Hat's paid platform
Ranked #8 of 11 in Best Configuration Management Software in 2026.
Open sourcePricing on requestNorth America
For setup speed, Ansible is the simplest option in this ranking. The README states a design principle of no custom agents and no extra open ports, so the existing SSH daemon does the work and a new machine is manageable at once. The core is GPL 3.
Money enters with Ansible Automation Platform, offered as a managed service, a managed application or self-managed, with Standard or Premium support, a trial option and cloud marketplace listings. Decide early whether the free core is enough.
What stands out
Agentless over SSH
GPL 3 core
Managed or self-managed
Where it costs you
No rates are listed online, and Red Hat prices by sizing and subscription choice after contact.
Red Hat is part of IBM and based in the United States, which matters if European vendor ownership is a requirement.
Right for
Teams that need to manage new servers on day one with no agent rollout and an open source start.
Wrong for
Buyers who want a single price they can read online, or a European-owned vendor.
United StatesOpen source core; Automation Platform quoted by sizing, Standard or Premium support
Web interface, REST API and task engine for Ansible, source only
Ranked #9 of 11 in Best Configuration Management Software in 2026.
Open sourcePricing on requestElsewhere
AWX is the open source console, API and job runner layered on Ansible, and one of the upstream projects behind Red Hat Ansible Automation Platform.
The licence is Apache 2.0, and the install guide sits in the repository. The warning at the top says the last release was on 2 July 2024 and a service-oriented rebuild is under way, so check the forum updates first.
What stands out
Apache 2.0
Ansible front end
Releases paused
Where it costs you
The README says releases are paused while the code is rewritten.
No vendor price or support is listed in the repository.
Right for
Evaluators wanting to see Ansible's web interface and API before buying
Wrong for
Production teams needing releases and support
Not stated by the vendorOpen source under Apache 2.0; no vendor price list
Provisioning, patching and compliance for Red Hat Enterprise Linux estates
Ranked #10 of 11 in Best Configuration Management Software in 2026.
Pricing on requestNorth America
Satellite gives one console for provisioning, patching and compliance over RHEL, with rules-based bare-metal discovery and compute profiles across VMware, KVM and physical machines. It verifies signatures on synced content and runs in disconnected or air-gapped networks.
Configuration advisories and vulnerability prioritisation are included, and offline analytics exist. Satellite 6.19 is the current release shown, while 6.20 ships as containers on RHEL 10.
What stands out
RHEL-focused
Air-gap capable
Patch curation
Where it costs you
Pricing and trial terms are not on the product page.
Satellite 6.20 is limited to current Satellite users through a sign-up programme.
Right for
Organisations running many Red Hat Enterprise Linux machines, including disconnected sites
Wrong for
Estates built mainly on other operating systems
United StatesRed Hat subscription; product page shows no prices or trial, talk to Red Hat
Provisioning tool that plans and applies infrastructure changes from configuration files
Ranked #11 of 11 in Best Configuration Management Software in 2026.
Published pricingElsewhere
Terraform is ranked last here because it solves a neighbouring problem. It follows a write, plan, apply cycle, builds a resource graph so changes run in parallel, and has providers for AWS, Azure, Google Cloud and Kubernetes.
HCP Terraform bills per resource per month in Essentials, Standard and Premium tiers with published rates and a 500 dollar trial credit. Terraform Enterprise is self-managed and quoted. Treat it as a partner to the other tools, not a replacement.
What stands out
Business Source License
Per-resource billing
State file
Where it costs you
Terraform 1.6.0 and later is under the Business Source License, whose use grant bars hosted offerings that compete with IBM paid versions.
It keeps a state file as its source of truth, which adds a storage and access task that agent-based tools do not have.
Right for
Platform teams that create cloud infrastructure first and pair it with a separate tool for server settings.
Wrong for
Buyers looking for a single product to patch and enforce settings on servers already running.
Not stated by the vendorHCP Terraform per resource per month, rates published; Enterprise self-managed quoted; trial credit
Configuration management software holds the intended state of servers in code, applies it through agents or SSH, reports drift and corrects it, so large fleets stay consistent and auditable. What separates these products is rarely a feature. Work through the steps below.
01
Work out how much a sales call is worth to you
Only 3 of the 11 print a price; 8 quote per organisation. Comparable without a sales call: Chef, Puppet, Terraform.
02
Weigh the vendor's home jurisdiction
Look at the contracting entity: these 11 vendors sit in 4 countries, split by region as Elsewhere 5, North America 4, Europe 2. The servers can be anywhere; the legal obligations follow the company.
03
Check the open source options
Open source here means Rudder, CFEngine, Puppet, SaltStack, Foreman, Uyuni, Ansible, AWX. The price of self-hosting is the time your team spends maintaining it.
Configuration management software: agents or SSH decides your first month
The architecture you pick sets the setup effort more than any feature list. Ansible and AWX use the SSH daemon, so a new server can be managed the day it exists, with nothing to bootstrap. Chef, Puppet, CFEngine and Rudder lean on agents that report in, which costs an install and certificate step per node but gives continuous checks.
SaltStack offers both, a master with minions or Salt SSH for machines that cannot run one. Before you commit, list which servers cannot take an agent, such as network appliances or locked images, and see whether the tool has a proxy or SSH route for them. Then time a pilot of ten machines from blank to reporting, and write down every manual step, because those steps are what you will repeat at fleet scale.
Which of your machines cannot run an agent?
How many hours did the ten-machine pilot take from blank to reporting?
Does the tool have an SSH or proxy mode for the awkward systems?
The real price: nodes, tiers and the support line
Prices here follow the node. Chef publishes SaaS rates per node per year, Puppet Core steps from a small-fleet developer licence to custom pricing, and Rudder sells per node per year by quote. CFEngine Enterprise states one price per licence with no add-on modules, which is easy to compare. Ansible Automation Platform depends on sizing and a Standard or Premium support tier.
Terraform meters resources, not servers, so a large cloud estate can cost differently from a large server estate. Ask for the full bill with support, training, onboarding and security modules, and multiply by your expected node count in two years, not today. A quote that looks cheap at fifty nodes can change shape at five hundred, so ask for the price table.
What is the total with support, onboarding and modules for your node count?
Does billing follow nodes, resources or sizing?
What happens to the price when the fleet doubles?
Exit: policy code, state and inventory
Leaving a configuration tool means rewriting your policies, so the question is what survives. Terraform keeps a state file that holds the mapping to real resources, and Foreman holds host inventory and classification for Puppet or Salt, so both need a planned export. Ansible playbooks and Salt states are text in YAML that you own in your own repository.
CFEngine policies are .cf files in its own language and travel less well to another engine. Red Hat Satellite and Uyuni hold package channels and patch history, which matter for audits. Before signing, ask where policies, inventory and reports live, and run an export once, on a test environment, to learn what is missing before the contract is signed.
In what format are policies, inventory and reports kept?
Can you export host inventory and patch history on demand?
How much of your code would a different tool reuse?
Independence: open core, owned names and paused releases
Many of these names have a commercial owner and a community edition that are no longer the same thing. Perforce owns Puppet, Progress owns Chef, Broadcom is named on the Salt site, Red Hat belongs to IBM, and Terraform moved from open source to the Business Source License under IBM.
AWX shows the other risk: its README says releases are on hold. Independent vendors such as Rudder and CFEngine have one product and a GPL core you can read. Check the licence file in the repository, the date of the last release, and who answers the phone. A fork or a paused project can leave a team patching its own tool.
Which licence covers the version you would run?
When was the last release, and is the project paused?
Who is your support contact, and do they sell a competing product?
What goes wrong most often when buying configuration management software
Choosing Terraform to patch and tune running servers, when it provisions resources and tracks them in a state file.
Treating AWX as a free copy of Ansible Automation Platform when its maintainers have stopped shipping releases for now.
Comparing a per-node SaaS rate from Chef with a per-resource rate from Terraform as if the units matched.
Starting on Foreman or Uyuni without deciding who supports them, since neither site states commercial terms.
07
Frequently asked questions
7 answers
What is the best configuration management software in 2026?
Rudder takes first place among the 11 we reviewed. Rudder is sold by Normation, whose contact page gives a Paris address, and its Core edition is open source under GPL 3.
Commercial tiers are licensed per node per year without a list price, with a one-time onboarding fee in year one when SLAs are wanted. The site frames it as security automation, covering patching, CVE reports and CIS or NIST benchmarks, so expect less emphasis on general application deployment.
Which configuration management tools publish their pricing?
The ones that do, with the model each states:
Chef: Per node per year; Business and Enterprise published; Enterprise Plus quoted; trial on request.
Puppet: Core free below 25 nodes; commercial Core, Enterprise and Advanced quoted per request.
Terraform: HCP Terraform per resource per month, rates published; Enterprise self-managed quoted; trial credit.
The other 8 quote per organisation.
Is there a free configuration management tool?
No, every product on this page is paid.
Where are these configuration management software vendors established?
In 4 countries across 3 regions: Elsewhere 5, North America 4, Europe 2.
Rudder: France.
CFEngine: Norway.
Chef: United States.
Puppet: United States.
SaltStack: Not stated by the vendor.
Foreman: Not stated by the vendor.
Uyuni: Not stated by the vendor.
Ansible: United States.
AWX: Not stated by the vendor.
Red Hat Satellite: United States.
Terraform: Not stated by the vendor.
Which configuration management tools are open source?
CFEngine is for Operations teams wanting an agent-based tool with one clear commercial price; Chef is for Buyers who want to compare published SaaS rates in a market where most rivals hide prices behind a form..
Who should not buy Rudder?
Teams wanting a plain application deployment tool. Commercial prices are not published, so cost needs a conversation..
We rank 11 configuration management software products on this page. If we missed one, its maker can write to us about its purpose and customers. We pick what gets added; the terms of a listing are set out under software advice.
