Skip to content

Terraform unit driver

The Terraform unit driver runs terraform init, creates a plan, and applies that plan during reconciliation. It can also run HTTP checks against observed Terraform outputs and supports a refresh-enabled read-only verification.

Kind: unit.gitopsctr.io/v1/Terraform
Capabilities: planning, reconciliation, verification

Authored unit

# yaml-language-server: $schema=https://niklasrosenstein.github.io/gitopsctr/schemas/apis/unit.gitopsctr.io/v1/Terraform/authored.schema.json
apiVersion: unit.gitopsctr.io/v1
kind: Terraform
metadata:
  name: infrastructure
spec:
  source:
    path: infra
    inputs: ["**/*.tf", "*.tfvars"]
  terraform:
    backend:
      key: example/dev.tfstate
    variables:
      environment: dev
    observeOutputs: [service_url]
    checks:
      - type: http
        urlOutput: service_url
        path: /health

source.path identifies the Terraform working directory relative to the root of the selected source revision. source.inputs is the input fingerprint, resolved relative to that working directory; glob patterns are supported. backend is passed to terraform init. Resolved variables are passed through a temporary JSON -var-file, so unit variables take precedence over terraform.tfvars and are removed after Terraform finishes. observeOutputs selects outputs that downstream units may consume. HTTP checks are optional and run after apply. Backend and variable values must be JSON-compatible scalar or object values accepted by the driver.

reconcile --plan runs the speculative plan and writes report evidence only; it does not apply or publish a receipt. verify runs a refresh-enabled, read-only plan and reports CLEAN or DRIFT.

Schemas