I think the problem is the implicit assumption that configuration has to be all the way one way or the other. In my experience you want configuration to be mostly declarative, but you also want to augment that configuration with limited amounts of actual code.

I think it's an explicit assumption. Either a configuration language is Turing complete or it isn't.

I think I know where you're coming from - if you are a human reading the configuration then you can analyze the actual code. But that's only one dimension of the problem, because it requires a human to be in the loop.