In a past life, I used CFEngine to manage around one-hundred onprem systems (physical and Vmware) and a couple dozen AWS EC2 systems. This pulled changes from one of a couple CFEngine "hubs" that I managed.

In my current role, it's Ansible to manage thirty onprem systems (also a mix of physical and Vmware) and a handful of AWS EC2 systems. I push the changes with Jenkins CI jobs that run playbooks on a periodic schedule; I also trigger jobs after a GitHub commit is detected.

This will not be a popular opinion, but I (although I do like Ansible very much) I preferred CFEngine for a number of reasons. One of those is there's a queryable "percent of promises completed" value that I could push up to a data store and view in a little web app I wrote. With Ansible, I'm having Jenkins alert me via Slack if any part of a playbook fails.