Tofu-Controller lightning talk @ Containerday 2026

Slides for a 15-minute lightning talk at ContainerDay on running existing Terraform inside Kubernetes GitOps with tofu-controller, instead of rewriting it.

The talk covers the Terraform custom resource, writing outputs to Secrets, ordering stacks and apps with dependsOn, approving plans through Git, drift detection, and the trade-offs.

Transcript

1. Evolution, not revolution Pushing Terraform into Kubernetes GitOps Giovanni Toraldo · DevOps Engineer @ Hyland ContainerDay 2026
2. 2 Your apps: git push → reconciled
3. 3 Your infra: git push → plan pipeline → manual review → apply pipeline
4. 4 Infra git push plan pipeline review apply pipeline Cloud Apps git push Reconcile loop Cluster Not a missing automation. Missing a shared one
5. 5 ♻️ Don’t rewrite. Run it in Kubernetes
6. 6 tofu-controller A Flux controller that runs your Terraform GitRepository Terraform CR Runner pod Cloud API
7. 7 Introducing Terraform Custom Resource Point your existing stack, tofu-controller applies it. apiVersion: infra.contrib.fluxcd.io/v1alpha2 kind: Terraform metadata: name: rds spec: path: ./root-modules/rds sourceRef: kind: GitRepository name: infra vars: - name: size value: small interval: 10m approvePlan: auto
8. 8 🔐 Outputs become Secrets
9. From state to Secret to Pod Terraform CR Deployment spec: writeOutputsToSecret: name: rds-output outputs: - endpoint - password - db_arn spec: containers: - name: webapp env: - name: DB_ENDPOINT valueFrom: secretKeyRef: name: rds-output key: endpoint - name: DB_PASSWORD valueFrom: secretKeyRef: name: rds-output key: password 9
10. 10 One dependency graph Terraform rds Terraform iam-role Deployment webapp
11. 11 dependsOn , both ways Terraform after Terraform App after infra apiVersion: infra.contrib.fluxcd.io/v1alpha2 kind: Terraform metadata: name: iam-role spec: dependsOn: - name: rds varsFrom: - kind: Secret name: rds-output varsKeys: - db_arn apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization metadata: name: webapp spec: dependsOn: - name: infra wait: true
12. 12 🚦 Where did the approval gate go?
13. Merge, plan, review, approve spec: storeReadablePlan: human approvePlan: "" apiVersion: v1 kind: ConfigMap metadata: name: tfplan-default-rds annotations: savedPlan: plan-main-b8e362c206 data: tfplan: | # aws_db_instance.rds will be created + resource "aws_db_instance" "rds" { + identifier = "rds" ... } spec: storeReadablePlan: human # plan-<branch>-<10 char git sha>, tied to the exact commit planned approvePlan: plan-main-b8e362c206 13
14. 14 Humans love to click a console What’s on Git wins anyway
15. 15 ⚠️ Where this gets harder Terraform state still required Cluster holds infrastructure credentials Debugging means watching pod logs Drift detection is costly for big stacks Still an alpha API, community maintained
16. 16 One repo, one loop One control plane
17. 17 Thanks 🐟 github .com/gionn/tofu-controller-lightning-talk flux-iac.github .io/tofu-controller Add me on LinkedI n: linkedin.com/in/giovannitoraldo/