Infrastructure Automation Ledger 2026: 29 Tools Scored

How the Infrastructure Automation Ledger scores Terraform, OpenTofu, Pulumi, Ansible, Puppet, Chef, Salt and the rest: fixed anchors, licence history and public evidence only.

Red Hat's per-node subscription around ansible-core: deepest orchestration and AI in its group, no list price, upstream controller frozen since 2024.

The open-source engine inside Ansible Automation Platform: agentless and broad through its collections, with no state file, control plane or AI of its own.

Atlantis is the reference pull request workflow for Terraform, free and self-hosted, kept by three volunteers, with drift detection still an alpha API.

Azure Bicep: a typed, state-free language for Azure, shipped monthly; on-prem VMs only through Azure Arc, no Proxmox VE, Nutanix or XCP-ng target.

CFEngine is the steadiest product in this group, with no licence change on record, and the narrowest: hosts only, small ecosystem, fewer platforms since 3.27.

Chef converges fleets well; Progress is retiring the free server (EOL November 2026) and gating every download, so Chef 360 or Cinc is the next decision.

Cinc rebuilds Chef without licence keys and lags it by weeks; from November 2026 it must also maintain the server Progress retires, with no funding on record.

AWS CloudFormation with the CDK: strong planning, safety and AWS depth, no target outside AWS, and a managed MCP server since May 2026.

Crossplane makes a Kubernetes cluster a provisioning control plane that repairs drift continuously; v2 in 2025 rebuilt the model and the CNCF graduated it.

Digger, now OpenTaco, runs Terraform plans in your own CI and is adding state, drift and remote runs as an open-core startup without published pricing.

env zero pairs drift remediation and an open-source MCP server with per-apply pricing on a SaaS control plane; its rebrand went unannounced.

Foreman is the widest open source host lifecycle tool, released every quarter since 2013, and the engine that Red Hat sells as Satellite.

Harness IaCM ships monthly with the broadest agent line-up in Beta, sold only as part of the Harness platform bundle, with Terraform capped at 1.5.x.

Ironic is the reference bare-metal lifecycle engine, released every six months on a published schedule, and the engine under Metal3 and vendor OpenStack.

Juju deploys and operates charmed applications across clouds, LXD, vSphere and MAAS; it provisions hosts as a means, not as its purpose.

MAAS is Canonical's bare-metal lifecycle tool with a published per-machine support price; plan and drift come only from its Terraform provider.

Metal3 turns bare metal into Kubernetes objects reconciled by an operator on top of Ironic; CNCF Incubating since 2025, with no product of its own.

OpenTofu is the MPL 2.0 continuation of Terraform 1.5 with published support windows, state encryption and no vendor; orchestration lives in other products.

OpenVox is the drop-in continuation of open source Puppet since January 2025, run by volunteers; the engine matches Puppet, the console and the funding do not.

Pulumi pairs a stable Apache 2.0 engine in seven languages with a fast-moving cloud service whose tiers, prices and AI agent changed several times in 2026.

Puppet kept shipping while Perforce moved its builds behind an EULA in 2025; the engine's depth is intact, and the commercial terms changed most in this group.

Agent-based engine with real scale and event-driven depth, kept by a small Broadcom team that cut modules from core and slipped its LTS by 19 months.

Satellite is Red Hat's packaging of Foreman and Katello with a published lifecycle, sold by subscription for RHEL-centred estates.

Scalr is the narrowest of the paid platforms, Terraform and OpenTofu only, with the simplest price, pay per run, and the lowest commercial risk in the group.

A light web front end that schedules and runs Ansible, Terraform and OpenTofu, MIT with paid runners, SSO and HA, built mainly by one maintainer.

Spacelift runs six engine types with a self-hosted option and the group's most complete AI record, priced for teams that can sign an annual contract.

Terraform remains the reference for state and planning; since 2023 the licence change and the IBM purchase are what a buyer has to price in.

Terragrunt orchestrates OpenTofu and Terraform runs across many units; 1.0 in March 2026 gave it a compatibility promise and a paid GitOps layer.

Tinkerbell is the CNCF Sandbox bare-metal workflow engine that outlived its sponsor Equinix Metal; active 0.x releases, no plan mode, no vendor.