Skip to content
SPECIFICTION
Get listed

Tofu Controller

flux-iac.github.io

Self-hosted
Visit flux-iac.github.io
Spec score 6.5 #33 of 35 in GitOps Tools

Spec sheet

Purpose
Tofu Controller is a controller for Flux that reconciles Terraform resources using GitOps.Read 7 Oct 2026 · flux-iac.github.io
Deployment
The guide documents installation through a Flux HelmRelease, Helm, or kubectl after installing Flux.Read 7 Oct 2026 · flux-iac.github.io
Integrations
The getting-started guide demonstrates using Flux source types including GitRepository, Bucket, and OCIRepository.Read 7 Oct 2026 · flux-iac.github.io
Support
The project directs users to file issues for bugs or feature requests and provides a Tofu Controller Slack channel through CNCF Slack.Read 5 Oct 2026 · github.com
License
The repository includes the Apache License, Version 2.0.Read 5 Oct 2026 · github.com
Automated apply
With approvePlan set to auto, it plans and applies resources and stores their state in a Kubernetes Secret.Read 5 Oct 2026 · flux-iac.github.io
Automatic apply
With `.spec.approvePlan=auto`, it plans and applies Terraform resources and stores their state in a Kubernetes Secret.Read 7 Oct 2026 · flux-iac.github.io
Compatibility
The published support matrix lists Tofu Controller v0.16 with Terraform v1.5.7, Source Controller v1.7.x, and Flux v2.6.x.Read 7 Oct 2026 · flux-iac.github.io
Dependencies
Terraform objects can declare dependencies, and the controller waits for them before reconciliation to support ordered module application.Read 7 Oct 2026 · flux-iac.github.io
Drift detection
It detects infrastructure drift and can automatically generate and apply a plan to correct it; read-only drift detection is also supported.Read 7 Oct 2026 · flux-iac.github.io
GitOps models
It supports GitOps automation, hybrid automation, state enforcement, and drift detection models.Read 7 Oct 2026 · flux-iac.github.io
Installation
The documentation provides Helm and kubectl installation methods for deployment into a Kubernetes cluster.Read 5 Oct 2026 · flux-iac.github.io
Multi-tenancy
Runner Pods can use a specified namespace and ServiceAccount for a soft multi-tenancy model that can be used with Flux multi-tenancy.Read 7 Oct 2026 · flux-iac.github.io
Plan approval
It supports separating plan from apply, with approval managed through a GitOps change that can be reviewed by a teammate.Read 7 Oct 2026 · flux-iac.github.io
Requirements
The getting-started guide requires Flux v2.0 or later for controller versions v0.15 and newer, and documents network access between the controller, Runner Pods, Source controller, and Notification controller.Read 5 Oct 2026 · flux-iac.github.io
Runtime requirements
The controller uses a Controller/Runner architecture with gRPC communication to Runner Pods on port 30000 and downloads source archives from the Source controller over port 80.Read 7 Oct 2026 · flux-iac.github.io
Security reporting
The project accepts vulnerability reports through its Security page, investigates reports through maintainers, and says it does not run a bug bounty program.Read 5 Oct 2026 · github.com
Terraform Cloud
Branch Planner can run plans and approved applies on Terraform Cloud and store state there; its documented Git provider support is currently GitHub only.Read 7 Oct 2026 · flux-iac.github.io
YAML configuration
The Terraform object supports configuring Terraform resources through YAML without adding extra CRDs to the cluster.Read 7 Oct 2026 · flux-iac.github.io

Where Specifiction places it

Alternatives to Tofu ControllerAll alternatives →