Running existing Terraform inside Kubernetes GitOps

I was in Bologna for ContainerDay with a lightning talk on tofu-controller. Thanks to GrUSP for having me, and to everyone who spent fifteen minutes after their lunch break on Terraform.

The framing of the talk is a gap most platform teams know well. Applications are reconciled by a loop: push to Git, the controller applies it, drift gets fixed without anyone typing. Infrastructure still goes through a plan pipeline, a human review, and an apply pipeline. There is nothing wrong with that pipeline on its own, but it means apps and infra live in two separate loops, and only one of them closes by itself.

The argument I made is don’t rewrite, run it. tofu-controller is a Flux controller that executes your existing Terraform or OpenTofu from a GitRepository source in a runner pod, driven by a Terraform custom resource. Adopting it does not require migrating to Crossplane or re-expressing the platform as CRDs. The code your team already maintains stays where it is.

What the fifteen minutes covered:

• The Terraform resource pointing at an existing root module through path and sourceRef.
• Outputs written to a Secret with writeOutputsToSecret, then read by a Deployment with secretKeyRef. No glue scripts between the two layers.
• A single dependency graph for stacks and apps: dependsOn between Terraform resources, and a Kustomization waiting for a stack to finish.
• The approval gate moved into Git: storeReadablePlan: human and approvePlan bound to a plan name that carries the commit SHA, so what gets reviewed is exactly what gets applied.

It’s not all unicorns and fairies: Terraform state is still required, cloud credentials live in the cluster, debugging means reading pod logs, drift detection gets expensive on big stacks, and the API is still alpha and community maintained.

Slides are on SpeakerDeck, the source is in gionn/tofu-controller-lightning-talk, and the project docs are at flux-iac.github.io/tofu-controller.

🇬🇧 🇺🇸 If you found value in my content, consider supporting me by treating me to a coffee, beer, or pizza. Your contributions help fuel more quality content creation.

🇮🇹 Se hai apprezzato i miei contenuti, considera di supportarmi offrendomi un caffè, una birra o una pizza. I tuoi contributi aiutano a creare contenuti di qualità.

• Paypal
• Buy me a coffee
• BTC
• ETH

View source on GitHub