Mannan Duggal explains why platform teams hit the limits of push-based IaC, where drift goes unnoticed until the next pipeline run fails. He argues for Crossplane's Kubernetes pull-based reconciliation loop and composite XRDs that turn clusters into self-service control planes.

Kalpit Swami rebuilds a MERN e-commerce deployment after realizing one Terraform state was juggling infrastructure, app pods, and secrets, leaking credentials into S3 and hanging every destroy. He splits work across Terraform, ArgoCD, and External Secrets Operator, one tool per lifecycle.

Mateen Anjum wires Infracost into terraform plan and pipes the JSON into OPA via conftest, failing any PR that adds more than 500 dollars a month. Three months in, it has blocked 2,400 dollars of accidental NAT Gateways, oversized RDS, and orphaned Elastic IPs before the invoice arrived.

OpenGeni is an open-source, self-hostable agent runtime with durable Postgres-backed sessions, replayable history, Temporal orchestration, and sandboxed tool execution. Its default image ships with Terraform and Checkov baked in, so agents can do real infra work out of the box.

Jason Waldrip argues scheduled release windows are a confidence workaround, not discipline, and that batching changes is what makes releases dangerous. He lays out a confidence stack of merge trains, build-once images, and automated canary, with TF for the building and Git for the lights.

OpenGeni is a self-hostable managed agent service for long-running infrastructure work.

A standalone infrastructure-as-code engine that saves the state in a database. Open-source alternative to Terraform.

Stop your AI agent from shipping insecure IaC. ops0 CLI sits between Claude Code, Codex or Gemini and your cloud, scanning every .tf the agent writes and blocking destroy commands before they run.