Terrakube

Open source IaC Automation and Collaboration Software.

Open Terrakube in a GitHub Codespace to test it from your browser:

• Organizations and Workspaces: Use Organizations and Workspaces to manage your infrastructure in a structured and efficient way. Workspaces also support Tags, which let you group, organize, and filter your workspaces based on the tags you assign to them.

• Private Registry: Publish your Terraform Modules and Providers privately.

• Version Control Integration: Terrakube integrates with GitHub (Cloud and Enterprise), GitLab (EE and CE), Bitbucket and Azure DevOps to retrieve your terraform/opentofu code.

• Terraform Workflow: Terrakube allows you to run the Terraform / OpenTofu workflow from anywhere, anytime. You can perform actions such as terraform apply, terraform plan, and terraform destroy. You can also manage variables and access the Terraform state files.

• Custom Workflows: Enhance your IaC workflow with Infracost, or any other tool of your choice. You can use Terrakube extensions to integrate them seamlessly, or create your own custom integration using the Terrakube API. This way, you can automate compliance checks, cost estimates, security scans, and more for your Terraform projects.

• Policy as Code: Evaluate OPA policies against every plan before it is applied. Policy sets run at an advisory, soft mandatory or hard mandatory level, and exemptions can be scoped to an organization, project or workspace. See Policy Enforcement.

• Access Control: You can use Dex to authenticate in Terrakube with various identity providers, such as Azure Active Directory, Amazon Cognito, GitHub, SAML, and more. You can also leverage your existing groups to assign granular permissions to Workspaces, Modules, VCS, and other resources.

• Remote Backend: Terrakube supports both remote backend and cloud block so you can run your workflow directly from the Terraform / OpenTofu CLI.

• Dynamic Credentials: Give runs short-lived access to AWS, Azure, GCP or Vault through workload identity, so you do not store long-lived cloud keys in workspaces.

• Flexible Executors: Run on the built-in executor, on self-hosted agents, or as ephemeral Kubernetes jobs that exist only for the length of a run.

• Drift Detection and Schedules: Run plans on a schedule to catch drift, and chain workspaces with run triggers.

• Pull Request and CI Integration: Webhooks from GitHub, GitLab, Bitbucket and Azure DevOps trigger plans for your pull requests, and Terrakube posts the result back to the pull request on GitHub, GitLab and Bitbucket. You can also run Terrakube jobs from your pipelines with the Terrakube GitHub Action.

• Manage Terrakube as Code: Use the Terraform provider, the Terrakube CLI or the API to configure organizations, workspaces and policies.

Point the cloud block at your Terrakube API and run Terraform as usual. The run executes in Terrakube and the output streams back to your terminal.

terraform {
  cloud {
    hostname     = "terrakube-api.example.com"
    organization = "acme"

    workspaces {
      name = "hello-terrakube"
    }
  }
}

Run terraform login terrakube-api.example.com once, then terraform plan or terraform apply. More in CLI-driven workflow.

flowchart TB
    subgraph clients[" Clients "]
        browser[Browser]
        cli[Terraform or OpenTofu CLI]
    end
    subgraph terrakube[" Terrakube "]
        ui[UI]
        api[API]
        registry[Registry]
        executor[Executor]
    end
    subgraph data[" Data "]
        db[(Database)]
        redis[(Redis)]
        storage[(Object storage)]
    end
    dex[Dex and your identity provider]
    browser --> ui --> api
    cli --> api
    cli --> registry
    api -->|runs each step| executor
    api -->|sign in| dex
    executor ~~~ dex
    api --> db
    executor -->|live output| redis
    executor -->|state and output| storage

The executor writes the live output to Redis and the state and final output to object storage, and the API reads both back. Terrakube stores state and run output in Amazon S3 (or any S3-compatible service such as MinIO), Azure Blob Storage, Google Cloud Storage or local disk. The database is PostgreSQL or Azure SQL (H2 is available for local testing).

• Install Terrakube using Helm
• Install Terrakube using Docker Compose
• Test Terrakube using minikube
• Test Terrakube using Gitpod
• Develop Terrakube locally using Dev Containers

The user and administrator documentation is at docs.terrakube.io. Operational runbooks and reference pages that go with the code are in the docs folder of this repository.

Please report vulnerabilities privately to [email protected]. See SECURITY.md for what to include.

Terrakube welcomes any idea or feedback from the community. If you want to contribute to this project, please read our Contribution Guide for more details.

Sponsor	Thanks
JetBrains	For providing with free licenses to their great tools.
GitBook	For providing us with free OSS Plan.
Docker	For providing us with free OSS Plan.
Tuta	For providing us with free email service.

Hashicorp confirmed that Terrakube is compatible with the new Terraform BSL License, more information can be found in the following discussion.