I've solved that problem in my infrastructure by using Puppet for Configuration Management and SaltStack for orchestration.
I have the Puppet Agent apply a SaltStack module to automatically configure each node as a minion of my Salt Master (which is also my Puppet Master), then I just SSH into my master server and tell SaltStack to run the Puppet Agent on nodes that match my criteria.
There are several SaltStack modules on the Puppet Forge.
You could certainly use other tools, such as RunDeck, or even Puppet's own MCollective, but I personally found them to be more complicated to work with.