Why doesn't Ansible require agents on managed nodes?

Ansible was deliberately designed to avoid the operational overhead that agent-based tools carry: installing, upgrading, and keeping a background service running and secure on every single managed node, which itself becomes something that needs monitoring and patching over time.

Instead, Ansible pushes a small amount of Python code over an existing SSH (or WinRM) connection at the moment a task runs, executes it on the target, and then cleans up, leaving nothing persistent behind. Since SSH access is already how most Linux infrastructure is administered, there's no new listening service or network port to open, and no separate credential/agent lifecycle to manage. The trade-off is that Ansible depends on Python being present on managed nodes (for most modules) and on a reachable SSH connection, so extremely locked-down or agent-only environments (or very large fleets with strict connection-per-second limits) sometimes still favor a persistent-agent model, but for the majority of infrastructure the agentless approach reduces both attack surface and operational burden.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.