Alex Artigues on lex00

A plan preview for k8s with ownership

Fri, 28 Aug 2026 00:00:00 +0000

kubectl can already dry-run an apply against the real API server and show you what it would produce.

“chant kube apply” and “chant kube delete” make that the default action instead of a flag you have to remember. Pass --yes to persist.

chant’s k8s client adds ownership knowledge on top of that.

Ownership at two granularities

kubectl’s manager identity is generic, stamping whatever invoked it as the name on the field.

knr-ops beats Crossplane on the token bill

Fri, 28 Aug 2026 00:00:00 +0000

Token savings in IaC is so hot right now.

It pays to understand which tools save you the most money and why.

knr-ops beats Crossplane where the work happens

Here is a new round of iac-cd-bench with a result showing Crossplane losing on token spend to knr-ops

Haiku 4.5, k=3, all seven stacks, cold and warm, 252 runs.

Crossplane does better on two task types, review and deep semantic questions. This is because Crossplane’s CRDs are cheaper than a Flux/kustomize overlay.

choudoufu cuts terralith optimization time in half

Tue, 25 Aug 2026 00:00:00 +0000

choudoufu is a fork of OpenTofu with identity hooks.

This blog takes a look at Cursor’s recent migration from Terraform to OpenTofu, and how it could have gone differently if it wasn’t held back by state.

choudoufu writes ownership on the resource itself

choudoufu adopts by stamping. Terraform adopts by fixing resolution in state.

Two tags on the resource, read live at plan time. That’s the whole trick of identity hooks.

Good tools can survive great "culture"

Sun, 23 Aug 2026 00:00:00 +0000

Culture rots. It’s perfectly normal and to some degree not preventable.

It rots because it’s an honor system, and honor systems are only as strong as the participants.

Above the clouds of responsibility

There is an invisible caste system in many orgs, and ops is at the bottom of it. The euphemism “Ops problem” has survived every re-org I’ve experienced.

Watching the players at higher levels in the system feign ignorance about who will end up holding the bag can be maddening, because the answer is always the same. Ops.

Tofu tastes better with identity hooks

Sun, 23 Aug 2026 00:00:00 +0000

Outside of k8s, infra tooling generally has pretty specific way of looking at ownership.

They keep a ledger, and if a resource is in the ledger, the tool owns it. Simple.

This simplicity feels so powerful, and it is, as long as you never get tasked with migration of the ledger across org boundaries.

Defining ownership in AWS

choudoufu writes the answer onto the resource itself, as two tags.

tofu-estate = prod-networking
tofu-address = aws_vpc.main

choudoufu treats these tags as hooks at plan time.

Terraform state has three pieces

Wed, 19 Aug 2026 00:00:00 +0000

A state file does three jobs.

It says which live resource an address refers to. It holds values the cloud has nowhere to put. And it records that an effect happened.

Those got bundled because one file happened to do all of them. Bundling is what turns persistence into a permission boundary, a secret, and a thing to lock.

Take them apart and each goes somewhere AWS already has. Identity becomes two tags on the resource. Values go in a record store. Effects get a receipt you declare, so the plan shows the migration coming before anything fires.

A billion proofs a day

Sat, 15 Aug 2026 00:00:00 +0000

Amazon’s Automated Reasoning Group just published a decade of reflections.

It’s the story of a decade spent proving AWS correct. Their policy engine Zelkova answers a billion SMT queries a day about what policies permit. Every one of these queries happens after the artifact exists. The queries are against normal JSON that nothing upstream cleans up or constrains.

CDK has a miniature version of this. It runs a risky statement merge at synth, so a machine-checked Alloy model in the repo proves the merge algorithm safe in advance.

Anthropic reached the same list

Fri, 14 Aug 2026 00:00:00 +0000

Anthropic published how they secure an AI-native software development lifecycle. Claude writes roughly 80% of the code merged there, so no control that depends on a human reading everything survives.

Accessible Ops is fourteen principles for infrastructure operations, written for the same pressure from the other end. Most of what Anthropic describes lands on rows in that list.

Their governing rule, the Principle of Least Agency, draws hard boundaries around what an agent can access and do rather than relying on what it is told. chant is partway there. chant build imports your TypeScript and runs it, held safe only by lint rules. chant build --fold reduces the source to a value without executing the module, and --sandbox confines whatever falls back. Anthropic’s rule is a good argument for making fold the default.

Take a whiff of choudoufu

Fri, 14 Aug 2026 00:00:00 +0000

Choudoufu is IAM-governed state for OpenTofu. Estates are inherited by granting access.

Terraform bundles three jobs into a state model that has survived for too long. Ownership, estate boundaries, and effect memory all live in the same artifact, behind the same lock, at the same access level.

This is an extremely convenient workflow for the folks who get to drive it. It can also make life terribly difficult for operators who are blessed with inheriting the estate as teams are “restructured”. Orgs who share a single production account across many teams see the worst of this.

Guardrails that survive the round trip

Mon, 10 Aug 2026 00:00:00 +0000

Kubectl and its cousins operate on your estate based on domain knowledge they carry.

The revolving door of authoritative state

Tue, 04 Aug 2026 00:00:00 +0000

Pulumi, an infra company founded on TypeScript, is now shipping HCL.

Every argument Pulumi opened with has been repackaged as a feature.

This pivot gave me whiplash reading it today. Imagine moving out of one authoritative state prison into another.

I build chant, an infra compiler. You write TypeScript, it compiles to CloudFormation or Kubernetes YAML, and nothing runs.

TypeScript as Data was Pulumi’s to have

Luke Hoban co-created TypeScript and then brought it to infrastructure.

An ecosystem of gruel

Mon, 03 Aug 2026 00:00:00 +0000

Configuration tooling keeps getting thrown into one cauldron. Start with eye of newt, then add a splash of versioning, a pinch of transformation, and a few sprigs of authoritative state.

Gruel ends up tasting the same no matter how it gets started. Once cooked you have no way to cleanly extract any of the ingredients.

Clean separation of concerns with toolchains like this boils down to the fact that you get to drink yours from one bowl. This sounds pretty convenient at first. If you like your food served this way then everything is fine.

aws-bench: scenario 1 wrap

Fri, 31 Jul 2026 00:00:00 +0000

Scenario 1 is done. aws-bench puts an agent in front of a live AWS estate and grades its answers.

Six configurations ran it on the same model, Haiku 4.5: chant, Pulumi, Terraform, AWS CDK, Alchemy, and an agent holding nothing but the AWS CLI. Eight questions, three attempts each, 24 trials apiece, against six EC2 instances spread over three regions.

The results live on chant-bench

I used to keep a post per matchup. That stopped working the first time I re-ran the benchmark and half the numbers moved, so the results now live where they are generated.

Queryable Infrastructure

Tue, 28 Jul 2026 00:00:00 +0000

Agentic ops means agents need to query your infra on demand. If the live details of your estate are fragmented this can lead to extra lookups costing time and tokens.

I measured this on aws-bench: asked which security groups were attached to nothing, every toolchain that reads a stored copy of the estate scored 0 out of 3.

Many things can be queried like a database without being one. The live cloud is one of them.

Flame graphing the leftness of infra tooling

Mon, 27 Jul 2026 00:00:00 +0000

Last month I claimed chant sits to the left of other infra toolchains when it comes to execution.

To prove this claim, I wrote the same small app for both CDK and chant. Next, I verified both produce the same resources, and ran each tool with Node’s profiler recording.

TypeScript is the right choice for infra

Sun, 26 Jul 2026 00:00:00 +0000

Typed configuration languages are one fix for YAML hell. Pkl, CUE, and KCL give you types, value constraints, and a compiler.

TypeScript solves the same problem, but it keeps going. It is the ideal foundation for an infrastructure toolchain, and chant is the proof.

The config languages take Wheeler’s deal

David Wheeler’s line is that any problem in computer science can be solved by adding another level of indirection. Kevlin Henney’s addendum is that this fails on the problem of too many levels of indirection.

The long tail is a tail

Sat, 25 Jul 2026 00:00:00 +0000

By definition a tail is the small, infrequent remainder. The long tail of spec-less APIs never touches chant. Here’s why.

chant compiles a typed source to the platform’s native spec, while some platforms are a pure API with nothing declarative underneath.

The platforms that run most production infrastructure all have specs. AWS is the largest cloud most shops build on, and its spec is deep, over 1,500 resource types in CloudFormation. The specced surface is the ground everyone stands on.

Temporal and chant saw it coming

Wed, 22 Jul 2026 00:00:00 +0000

A common line drawn about AI and infrastructure: “It changes how things get written, not how they get operated.” It casts the near term as a moment when AI reshapes authoring while operations waits without an answer.

This tends to come from people observing the shift rather than shipping on it, and it already reads as dated. It also has the timing backwards, treating writing and operating as a sequence when they are moving together. Temporal and chant are already built for it.

The long road back to cloud native

Wed, 22 Jul 2026 00:00:00 +0000

The sensible answer about Terraform and AI goes like this: the agent writes the HCL, and Terraform keeps the parts that matter, governance and lifecycle. William Collins makes that case well, and I agree with more of it than you might expect. That case rests on one thing: the value it credits to Terraform lives in the tool itself.

Look at what Terraform is, underneath. It takes your cloud’s native spec, the CloudFormation template or the Kubernetes object the platform already defines, and reimplements it as HCL plus a state file. It is a layer over the platform’s own API, one that stands in for the native spec instead of compiling to it. For a while that was a fine trade.

An entire industry exists to fix Terraform

Tue, 21 Jul 2026 00:00:00 +0000

This is what an industry of coping mechanisms looks like. One attempt to leave Terraform’s model outright, Winglang, compiled a new language down to Terraform and shut down in 2025. When Terraform’s own license changed, the community forked the whole thing rather than let it go. The tool is too entrenched to abandon, so the market lines up to patch it.

The last column is the whole story. State’s real job is to bind the name you wrote, MyResource, to the opaque id the provider hands back, so the next run knows the two are the same thing. Terraform drives a raw API, catches that id, and makes you hold on to it. chant drives no raw API. It compiles to the platform’s own spec, which keeps the binding itself, so there is no pair to store.

Configuration as code, and as data

Mon, 20 Jul 2026 00:00:00 +0000

Brian Grant coined the Kubernetes Resource Model and argues that configuration should be data, not a program you run to find out what it is. chant agrees, and most of the industry is still catching up to him.

His case is simple: declarative configuration is data. It is separated from the code that transforms it. This is a huge part of what makes Kubernetes manageable.

chant is configuration as data

chant compiles a typed source to the platform’s own spec and hands that spec back untouched.

Honor the lower layer

Sun, 19 Jul 2026 00:00:00 +0000

This post makes one narrow claim, one you should check rather than take on faith.

Every tool sits on a lower layer. For infrastructure it is a cloud’s native spec or a Kubernetes API. For a programming language it is the machine itself. Good abstractions honor that layer, while poor ones reimplement it with something that only pretends to match, up until the pretense breaks.

Two people in two fields, Gregor Hohpe in software architecture and Adam Chlipala in formal verification, describe that same failure and the same fix.

A lifecycle needs an orchestrator

Fri, 17 Jul 2026 00:00:00 +0000

Terraform 1.14 shipped Actions, its biggest language change in years. An Action fires a provider operation, a Lambda invoke or a cache invalidation, on a resource’s create, update, or destroy. The imperative work that used to hide in null_resource finally has a place to sit.

Then you ask what runs it, and the answer is nothing. No typed input, no retry, no timeout, no gate, no record it ran. An Action is a trigger with no executor, and every one of those gaps is that same missing piece.

Policy belongs left of the platform

Fri, 17 Jul 2026 00:00:00 +0000

Everyone is shifting policy left. HashiCorp just shipped tfpolicy, a policy-as-code framework in HCL, and it moves the catch earlier than Sentinel ever did. Provider and module rules run pre-plan before a download, resource rules run at plan, and computed values get checked at apply. One language does all of it, so the second one that Sentinel and OPA made you learn is gone.

It still runs at the platform. tfpolicy evaluates inside HCP Terraform, against a plan, with credentials. Its rules are HCL over attrs, a dynamic bag nothing type-checks. attrs.encryption_settings_collection[0].enabled is a string path you either get right or find out about at evaluation time, in the run, not in your editor.

Your infra database is a road to hell

Fri, 17 Jul 2026 00:00:00 +0000

The authoritative model Terraform made famous has always been a poor fit for teams just trying to automate a little infra. The state file is only its most visible cost. Give up the model and three questions decide the tool: how the truth is represented, where it lives, and what lifecycle runs around it. ConfigHub and formae are already past it, and chant answers the same three again.

Representation. ConfigHub makes the truth data in a store. formae makes it Pkl. chant makes it typed TypeScript that is the spec itself.
Location. ConfigHub puts the truth in a database. formae pushes it into the source code and reconciles the cloud back to it. chant leaves it in the live system, where it already is.
Lifecycle. ConfigHub builds one around its store. formae builds one that pulls reality into code. chant hands the lifecycle to you, dialed per environment.
Ownership. Terraform ties it to state. ConfigHub delegates it to live markers in ArgoCD and Crossplane, which is right. chant reads it straight off the resource, no store in the loop.
Verdict. Three tools past the authoritative model, and one that also refuses to own you: typed source you already write, truth left live, artifacts that outlive the tool.

ConfigHub owns all three

ConfigHub replaces the file with a database, and the database is the truth. You author in it through an API. It actuates from it. Brian Grant is right that configuration is data and that Git is a poor place to keep it, and the product follows honestly from that.

A release is a compile target

Tue, 14 Jul 2026 00:00:00 +0000

Call something a compile target and you have said two things about it. It can be correct by construction, and it is cheap to produce. A compiler checks the output before it emits it, and it emits it from a description shorter than the output itself. That is the whole reason to have one.

Say it about a release and both claims carry. The deploy can be correct before it runs, and adding one costs a declaration instead of a pipeline.

The apply verb you only get on Kubernetes

Mon, 06 Jul 2026 00:00:00 +0000

Kubernetes made something uniform that people forget was ever a choice. Every service deploys the same way. A manifest describes the desired state, kubectl apply hands it over, and a controller makes it real. Because the verb is shared, the CI around it is shared too. A platform team writes one pipeline and a hundred services ride it, since from the pipeline’s point of view they are all the same operation.

Governance without the state file

Sat, 20 Jun 2026 00:00:00 +0000

How easily can you prove that all your repositories have aligned configuration according to policy?

Governance is easy when it comes to things people rarely touch. I’ll bet a lot of you reading this manually tune your repo settings, and have already thought about how you might make them more consistent.

Why policy drifts

Platform settings are stateful and the typical case is that nothing reconciles them. You set branch protection once. After that it is a value in a database that any admin can change.

A TypeScript compiler for Kubernetes manifests

Thu, 18 Jun 2026 00:00:00 +0000

A GitOps pipeline on Kubernetes is full of tools. Reconcilers like Flux or Argo watch git and converge the cluster. Drift gets detected and alarmed while policy engines gate what reaches the cluster at every stage.

The least guarded stage is the one where the manifests get written. YAML gets patched with Kustomize and templated with Helm, then goes unchecked for meaning until the reconciler tries to apply it.

chant is a compiler for that layer. Typed TypeScript goes in and native Kubernetes YAML comes out. The build type checks and semantic lints and synthesizes deterministically, then stops and hands a standard manifest to the existing deploy path.

The far-left IaC tool

Wed, 03 Jun 2026 00:00:00 +0000

Everyone is shifting left. It’s the safest opinion in infrastructure, and most tools honor it by shifting left exactly one notch and calling it a platform.

Terraform shifted left with plan, Bicep with what-if. Same idea, see the change before you apply it. Both are real improvements, and both still wait until you’re talking to the cloud to tell you something is wrong. That’s the centrist position. It’s good, but it isn’t the leftmost spot on the line.

TypeScript vs Pkl for IaC

Wed, 27 May 2026 00:00:00 +0000

Two tools have made the same uncommon choice. chant and formae both refuse the authoritative state file. Most infrastructure tools keep one. These two do not. That shared move is the right place to start, because it is the right move.

The state file was never the part that matters

An authoritative state file is a flat file doing a database’s job. It needs a lock on every change. It holds secrets because the tool needs them to diff. It can corrupt and take a deploy down. Teams carry all of that because they believe state is essential. What is actually essential is governance. A known change before apply. An audit trail. A limit on blast radius. State was one way to get those. It was never the only way.

Which infrastructure tool actually keeps the spec?

Wed, 27 May 2026 00:00:00 +0000

In the IaC world, who is truly spec native?

Most infrastructure tools put a layer between you and the target spec. The layer is the product. It owns state, deployment, and a model of your cloud that is not quite the cloud’s own model. Chant makes a different choice. Its types come from the target spec. Its output is the target spec. Nothing chant specific survives in the artifact.

This post explains that choice. It also shows where Terraform, AWS CDK, and Pulumi drift from the spec, and what staying close to the spec buys you.

Governance is what IaC depends on

Mon, 25 May 2026 00:00:00 +0000

State is essential. Anyone who has run infrastructure past a toy project knows this. William Collins makes the case for AI through IaC rather than instead of it, and I agree with most of it. My argument is narrower. Essential is not the same as authoritative. Almost everything you value about state is essential without being authoritative.

What the file actually costs

Start with what a state file charges you. A global mutex on every apply. An all-or-nothing changeset. Secrets sitting in the file because the tool needs them to diff. A corruption surface that can take a stack down. None of that is the language. None of it is the providers. It is a flat file doing the work of a database, and the database has no tooling.

The consolidation problem

Sat, 28 Mar 2026 00:00:00 +0000

The pull request didn’t start as a bureaucratic institution. It started because someone needed a way to propose changes to code they didn’t own. The only mechanism for that was to ask the owner. The queue, the approval chain, the blocked deploy: none of it was planned. It followed from that one fact.

The person holding the key usually didn’t ask for the job. A senior engineer merges things because she has the access and nobody else does. She goes on vacation and the team waits. She burns out and the PRs pile up. She never wanted to be a gatekeeper. The tool made her one.

Infrastructure deserves a compiler

Mon, 23 Feb 2026 00:00:00 +0000

Every IaC tool tries to own the full lifecycle. Provisioning, state management, drift detection, rollback. The synthesis step got bundled in with the rest. Turning source code into deployable output is a compilation problem. It deserves to be treated like one.

What bundling synthesis costs you

When synthesis is embedded in a provisioning tool, it inherits that tool’s constraints. You get the type system the tool provides. You get the validation the tool exposes. You lint what the tool lets you lint.