Tofu Controller
The facts below are what the maker publishes about Tofu Controller, checked and dated. Our editors have not written about it yet.
The facts
Each one read from Tofu Controller's own pages, with the date it was checked.
Where it runs
- Automated apply
- With approvePlan set to auto, it plans and applies resources and stores their state in a Kubernetes Secret.checked 5 Oct 2026
- Automatic apply
- With `.spec.approvePlan=auto`, it plans and applies Terraform resources and stores their state in a Kubernetes Secret.checked 7 Oct 2026
What it does
- Compatibility
- The published support matrix lists Tofu Controller v0.16 with Terraform v1.5.7, Source Controller v1.7.x, and Flux v2.6.x.checked 7 Oct 2026
- Dependencies
- Terraform objects can declare dependencies, and the controller waits for them before reconciliation to support ordered module application.checked 7 Oct 2026
- Deployment
- The guide documents installation through a Flux HelmRelease, Helm, or kubectl after installing Flux.checked 7 Oct 2026
- Drift detection
- It detects infrastructure drift and can automatically generate and apply a plan to correct it; read-only drift detection is also supported.checked 7 Oct 2026
- GitOps models
- It supports GitOps automation, hybrid automation, state enforcement, and drift detection models.checked 7 Oct 2026
- Installation
- The documentation provides Helm and kubectl installation methods for deployment into a Kubernetes cluster.checked 5 Oct 2026
- Integrations
- The getting-started guide demonstrates using Flux source types including GitRepository, Bucket, and OCIRepository.checked 7 Oct 2026
- License
- The repository includes the Apache License, Version 2.0.checked 5 Oct 2026
- Multi-tenancy
- Runner Pods can use a specified namespace and ServiceAccount for a soft multi-tenancy model that can be used with Flux multi-tenancy.checked 7 Oct 2026
- Purpose
- Tofu Controller is a controller for Flux that reconciles Terraform resources using GitOps.checked 7 Oct 2026
- Requirements
- The getting-started guide requires Flux v2.0 or later for controller versions v0.15 and newer, and documents network access between the controller, Runner Pods, Source controller, and Notification controller.checked 5 Oct 2026
- Runtime requirements
- The controller uses a Controller/Runner architecture with gRPC communication to Runner Pods on port 30000 and downloads source archives from the Source controller over port 80.checked 7 Oct 2026
- Security reporting
- The project accepts vulnerability reports through its Security page, investigates reports through maintainers, and says it does not run a bug bounty program.checked 5 Oct 2026
- Support
- The project directs users to file issues for bugs or feature requests and provides a Tofu Controller Slack channel through CNCF Slack.checked 5 Oct 2026
- Terraform Cloud
- Branch Planner can run plans and approved applies on Terraform Cloud and store state there; its documented Git provider support is currently GitHub only.checked 7 Oct 2026
- YAML configuration
- The Terraform object supports configuring Terraform resources through YAML without adding extra CRDs to the cluster.checked 7 Oct 2026
Money
- Plan approval
- It supports separating plan from apply, with approval managed through a GitOps change that can be reviewed by a teammate.checked 7 Oct 2026
Alternatives to Tofu Controller
- 1
Portainer
Free planOpen sourceAndroidiOSWebAPI8.6Free plan - 2
Plural
Free planOpen sourceWebAPILinuxmacOS8.2From $450 a month - 3
Nullstone
Free planWebAPILinuxmacOS7.9From $50 a month - 4
PipeCD
Free planOpen sourceWebAPILinuxmacOS7.5Free plan - 5
Pulumi
Free planWebAPILinuxmacOS7.4From $40 a month - 6
Google Config Sync
Free planOpen sourceWebAPILinuxSelf-hosted7.2Free plan