Another big difference between Puppet and Chef that hasn't been mentioned is that Puppet will do all of the manifest compilation on the Server, whereas Chef (and cfengine) will do some or all of the work on the client.
What this means is
* Less CPU footprint on your client from running puppet, and
* Add-in Modules written in Puppet run on the server only.
The second part is important, because it makes it much easier to integrate Puppet with your other architecture. For example, if you want to pull data via an API from another application, under Puppet you only need install the necessary API modules on the Puppetmaster, and only need to grant that one server access to the API. Any credentials necessary also remain on the puppetmaster - much more secure.
We're integrated Puppet and SecretServer (to auto-rotate root passwords using puppet and store them into SecretServer). This would not have been possible or secure under Chef, as I understand the model.
