[substation13]

Adding a "real" programming language makes certain things easier, such as abstraction, but IMO they are too powerful for the task at hand. Do we really want an infrastructure description to be able to execute arbitrary code?

[mkleczek]

Well, it depends on the language. Some are quite good at restricting programs so that it is not possible to execute arbitrary code.

Take a look at https://propellor.branchable.com to see how Haskell might be used.

Idris might be a good candidate as well.

https://dhall-lang.org is quite interesting for these purposes as well (although it is not general purpose)

[jen20]

Yes, that’s exactly what we want. Things like Terraform also permit this via provisioners, and CloudFormation permits it via execution of lambda functions. Almost any non trivial infrastructure requires it.

[substation13]

With Terraform you can statically analyze the infrastructure definition with some guarantees of determinism etc. Arbitrary execution is allowed, as you say, but only in well-contained places, such as local_exec.

How can this work if, say, TypeScript is used as the definition language?

[jen20]

What degree of determinism do you actually have if provisioners can execute Turing complete code?

[substation13]

It's a bit like how Rust limits dangerous operations to unsafe blocks