Posts

Terraform state at scale the easy way An RDBMS might seem like a cost effective way to centralize your Terraform state. The better choice is the “live” backend. It answers the same … The intoxicating mix of synthesis and execution When software engineers build infra toolchains they always mix synthesis with execution. It’s hard to resist when you carry a bag of golden hammers … Leave GitHub and take your CI with you Forge governance should be policy driven, and simple enough for anyone to setup. It also helps if you can carry the same pattern across forges in case you … Governance for GitHub, GitLab, and Forgejo Getting all your forge settings and repo configs aligned can take some effort. The forge wardens are here to help you: github-warden gitlab-warden … Invisible ownership is ridiculous Terraform has an ownership problem. From an org perspective, ownership is usually about who is accountable. This accountability gets encoded into … A plan preview for k8s with ownership kubectl can already dry-run an apply against the real API server and show you what it would produce. “chant kube apply” and “chant kube … knr-ops beats Crossplane on the token bill Token savings in IaC is so hot right now. It pays to understand which tools save you the most money and why. knr-ops beats Crossplane where the work … choudoufu cuts terralith optimization time in half choudoufu is a fork of OpenTofu with identity hooks. This blog takes a look at Cursor’s recent migration from Terraform to OpenTofu, and how it could … Good tools can survive great "culture" Culture rots. It’s perfectly normal and to some degree not preventable. It rots because it’s an honor system, and honor systems are only as … Tofu tastes better with identity hooks Outside of k8s, infra tooling generally has pretty specific way of looking at ownership. They keep a ledger, and if a resource is in the ledger, the tool … Terraform state has three pieces A state file does three jobs. It says which live resource an address refers to. It holds values the cloud has nowhere to put. And it records that an effect … A billion proofs a day Amazon’s Automated Reasoning Group just published a decade of reflections. It’s the story of a decade spent proving AWS correct. Their policy … Anthropic reached the same list Anthropic published how they secure an AI-native software development lifecycle. Claude writes roughly 80% of the code merged there, so no control that … Take a whiff of choudoufu Choudoufu is IAM-governed state for OpenTofu. Estates are inherited by granting access. Terraform bundles three jobs into a state model that has survived … Guardrails that survive the round trip chant CLICKOPS 💥 🔥 🔥 🔥 Kubectl and its cousins operate on your estate based on domain knowledge they carry. The revolving door of authoritative state Pulumi, an infra company founded on TypeScript, is now shipping HCL. Every argument Pulumi opened with has been repackaged as a feature. This pivot gave me … An ecosystem of gruel Configuration tooling keeps getting thrown into one cauldron. Start with eye of newt. Add a splash of versioning and a pinch of transformation and a few … aws-bench: scenario 1 wrap Scenario 1 is done. aws-bench puts an agent in front of a live AWS estate and grades its answers. Six configurations ran it on the same model Haiku 4.5. … Queryable Infrastructure Agentic ops means agents need to query your infra on demand. If the live details of your estate are fragmented this can lead to extra lookups costing time … Flame graphing the leftness of infra tooling Last month I claimed chant sits to the left of other infra toolchains when it comes to execution. To prove this claim I wrote the same small app for both …