This is an interesting read on Config Management which essentially concludes that makefiles with Jenkins (etc.) work best:

https://fortyft.com/posts/ansible-puppet-chef-no-thanks/

For more bells and whistles (and a steeper learning curve) try Escape:

https://escape.ankyra.io/docs/what-is-escape/