Resources · Integration patterns
Terraform and GitOps delivery
Infrastructure and environments are code; changes go through review, a plan and automatic apply.
Integration status: Documented pattern
A documented pattern. The product manages no client infrastructure.
Description
Terraform describes infrastructure and GitOps the desired state of environments. A pull request shows the plan; after approval a pipeline with short-lived permissions applies the change.
Prerequisites
- Remote state with locking.
- Modules and versions.
- Separate permissions per environment.
When to use it
- Repeatable environments.
- An audit trail of changes is needed.
- Several teams and environments.
When not to use it
- A one-off experiment.
- Resources designed to change manually.
- No review discipline.
Reference diagram
An illustration of the components and the flow — not a running system.
01Change
- Pull request
- Terraform plan
02Review
- Approval
- Policy checks
03Apply
- Pipeline with OIDC
- Remote state with locking
04Compliance
- Drift detection
The diagram as a list
| Stage | Components |
|---|---|
| Change | Pull request, Terraform plan |
| Review | Approval, Policy checks |
| Apply | Pipeline with OIDC, Remote state with locking |
| Compliance | Drift detection |
Security controls
- Short-lived pipeline permissions (OIDC).
- No secrets in code or state.
- Policy as code before apply.
Observability
- Apply duration and success.
- Drift per environment.
- Frequent changes per module.
Failure modes
| Failure | Mitigation |
|---|---|
| Manual change and drift | Periodic drift detection. |
| Locked state | A release procedure. |
| Dangerous plan | Review and deletion protection. |