tofu-controller
A Flux controller for GitOps automation of OpenTofu and Terraform resources in Kubernetes.
What is tofu-controller?
Tofu Controller is a Kubernetes controller for Flux that enables GitOps automation for OpenTofu and Terraform resources. It allows teams to manage infrastructure and application resources declaratively, integrating infrastructure-as-code workflows with GitOps practices. The controller supports multiple models, from full automation to drift detection, providing flexibility in adoption.
Platform engineers, DevOps teams, and SREs managing Kubernetes clusters who want to apply GitOps principles to their OpenTofu or Terraform infrastructure. It's ideal for organizations using Flux for GitOps and seeking to extend it to infrastructure management.
Developers choose Tofu Controller because it seamlessly integrates Terraform/OpenTofu with Flux's GitOps capabilities, offering multiple operational models that allow incremental adoption. Its flexibility in handling existing infrastructure and drift detection makes it a practical tool for real-world infrastructure management.
Overview
A GitOps OpenTofu and Terraform controller for Flux
Use Cases
Best For
- GitOps automation for Terraform or OpenTofu-managed infrastructure
- Incremental adoption of GitOps for existing infrastructure resources
- Drift detection and enforcement for infrastructure state
- Managing Kubernetes cluster components like EKS nodegroups or security groups via GitOps
- Platform teams wanting consistent infrastructure management across environments
- Organizations using Flux who need infrastructure-as-code GitOps capabilities
Not Ideal For
- Teams using infrastructure-as-code tools other than Terraform or OpenTofu, such as Pulumi or AWS CDK
- Organizations without an existing Flux installation, as it requires Flux to function
- Projects needing immediate, push-button infrastructure changes without Git-based workflows
Pros & Cons
Pros
Offers multiple operational models from full automation to drift detection, enabling teams to adopt GitOps incrementally without disrupting existing setups, as highlighted in the README's 'at your own pace' philosophy.
Built specifically for Flux, leveraging its GitOps engine to manage Terraform resources declaratively within Kubernetes, ensuring a consistent workflow for platform teams.
The Hybrid and State Enforcement models allow applying GitOps to parts of existing infrastructure, such as managing individual EKS components, making it practical for real-world environments.
Includes a dedicated model for monitoring infrastructure drift through GitOps, helping teams detect and respond to unauthorized changes proactively, as described in the feature list.
Cons
Requires a Kubernetes cluster and Flux setup, adding significant operational overhead and complexity for teams not already using this ecosystem, limiting its portability.
For small or static infrastructure with infrequent changes, the GitOps workflow and multiple models can introduce unnecessary complexity compared to direct Terraform execution.
Only supports Terraform and OpenTofu, excluding other popular IaC tools like Pulumi or CloudFormation, which may not suit diverse tooling environments.
Frequently Asked Questions
Related Projects
terraform-github-actionsGitHub actions for Terraform and OpenTofu
TF-via-PRPlan and apply Terraform/OpenTofu via PR automation, using best practices for secure and scalable IaC workflows.
setup-opentofuThe `opentofu/setup-opentofu` action is a tool for GitHub Actions that automates the setup of the OpenTofu CLI. It enables developers to seamlessly integrate infrastructure-as-code practices into their CI/CD pipelines by providing the necessary command-line tools directly in their workflow runners. ## Key Features - **Version Management** — Installs a specific version of OpenTofu CLI or reads it from a version file, supporting semantic versioning ranges and pre-release versions. - **Wrapper Script** — Optionally wraps the `tofu` binary to expose its STDOUT, STDERR, and exit code as outputs for subsequent steps. - **Credential Configuration** — Configures credentials for Terraform Cloud or Terraform Enterprise instances directly from GitHub Secrets. - **Binary Caching** — Supports caching of the OpenTofu binary to reduce download times on subsequent runs, particularly beneficial for self-hosted runners. - **Multi-Platform Support** — Runs on Ubuntu, Windows, and macOS GitHub Actions runners, with Bash shell support on Windows. ## Philosophy The action is designed to be a reliable, community-maintained utility that simplifies OpenTofu integration in automated workflows, emphasizing flexibility through configurable inputs and outputs.
pre-commit-opentofupre-commit git hooks to take care of OpenTofu configurations
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.