Alex Artigues on lex00

Lots of us are familiar with the set of decisions faced when inheriting a Terraform estate.

chant typed source many platforms choudoufu OpenTofu fork AWS or both your git forge GitHub · GitLab · Forgejo generated pipeline · gate in git your cloud resource owner tag resource owner tag resource owner tag your IAM gates on the tag the CLI and conso…

When software engineers build infra toolchains they always mix synthesis with execution.

An RDBMS might seem like a cost effective way to centralize your Terraform state.

Forge governance should be policy driven, and simple enough for anyone to setup.

Getting all your forge settings and repo configs aligned can take some effort.

Terraform has an ownership problem.

Token savings in IaC is so hot right now.

kubectl can already dry-run an apply against the real API server and show you what it would produce.

choudoufu is a fork of OpenTofu with identity hooks.

Outside of k8s, infra tooling generally has pretty specific way of looking at ownership.

Culture rots.

A state file does three jobs.

Amazon’s Automated Reasoning Group just published a decade of reflections.

Choudoufu is IAM-governed state for OpenTofu.

Anthropic published how they secure an AI-native software development lifecycle.

chant CLICKOPS 💥 🔥 🔥 🔥 Kubectl and its cousins operate on your estate based on domain knowledge they carry.

Pulumi, an infra company founded on TypeScript, is now shipping HCL.

Configuration tooling keeps getting thrown into one cauldron.

Scenario 1 is done. aws-bench puts an agent in front of a live AWS estate and grades its answers.

Agentic ops means agents need to query your infra on demand.

Last month I claimed chant sits to the left of other infra toolchains when it comes to execution.

Typed configuration languages are one fix for YAML hell.

By definition a tail is the small, infrequent remainder.

The sensible answer about Terraform and AI goes like this: the agent writes the HCL while Terraform keeps the governance and lifecycle that matter.

This is what an industry of coping mechanisms looks like.

Brian Grant coined the Kubernetes Resource Model and argues that configuration should be data, not a program you run to find out what it is. chant agrees, and most of the industry is still catching up to him.

This post makes one narrow claim, one you should check rather than take on faith.

The authoritative model Terraform made famous has always been a poor fit for teams just trying to automate a little infra.

Everyone is shifting policy left.

Call something a compile target and you have said two things about it.

Kubernetes made something uniform that people forget was ever a choice.

How easily can you prove that all your repositories have aligned configuration according to policy?

A GitOps pipeline on Kubernetes is full of tools.

Everyone is shifting left.

In the IaC world, who is spec native?

Two tools have made the same uncommon choice. chant and formae both refuse the authoritative state file.