FREEDOM251

Freedom251 › GitOps Tools

Tofu Controller

Free plan Self-hosted

Visit Tofu Controller Alternatives

Tofu Controller's own site

What Tofu Controller is

Tofu Controller is a free, self-hosted Kubernetes controller that reconciles OpenTofu and Terraform resources through Flux using GitOps workflows. It documents automation, hybrid automation, state enforcement, and drift-detection models. With approvePlan set to auto, it plans and applies resources and stores state in a Kubernetes Secret. Teams can instead separate planning from applying, then approve plans through a GitOps change reviewed on a branch. Drift may be corrected automatically or detected in read-only mode without plan or apply steps. Terraform resources can be configured with YAML without extra CRDs, while declared dependencies make modules run in order. Runner Pods can use a specified namespace and ServiceAccount for soft multi-tenancy. Installation is documented through a Flux HelmRelease, Helm, or kubectl. Integrations include Flux GitRepository, Bucket, and OCIRepository sources, plus Branch Planner with Terraform Cloud. The guide requires Flux v2.0 or later for controller versions v0.15 and newer.

Who it suits

Tofu Controller suits teams managing OpenTofu or Terraform resources in Kubernetes with Flux and GitOps. It fits operators needing drift handling, staged approvals, or self-hosted deployment.

What it does well

  • Free, self-hosted deployment
  • Automatic or read-only drift detection
  • GitOps approval can separate plans and applies
  • YAML configuration without extra CRDs
  • Flux and Terraform Cloud integrations

What to know first

  • Requires a Kubernetes cluster
  • Flux v2.0 or later required for newer versions
  • Documented Git provider support is GitHub only
  • Runtime uses specified network ports

Verdict

Tofu Controller provides GitOps reconciliation for OpenTofu and Terraform, including automated applies, staged approvals, and drift workflows. Deployment requires Kubernetes and the documented Flux and networking setup.

Facts from Tofu Controller's own pages

Automated apply
With approvePlan set to auto, it plans and applies resources and stores their state in a Kubernetes Secret. · flux-iac.github.io, 5 Oct 2026
Automatic apply
With `.spec.approvePlan=auto`, it plans and applies Terraform resources and stores their state in a Kubernetes Secret. · flux-iac.github.io, 7 Oct 2026
Compatibility
The published support matrix lists Tofu Controller v0.16 with Terraform v1.5.7, Source Controller v1.7.x, and Flux v2.6.x. · flux-iac.github.io, 7 Oct 2026
Dependencies
Terraform objects can declare dependencies, and the controller waits for them before reconciliation to support ordered module application. · flux-iac.github.io, 7 Oct 2026
Deployment
The guide documents installation through a Flux HelmRelease, Helm, or kubectl after installing Flux. · flux-iac.github.io, 7 Oct 2026
Drift detection
It detects infrastructure drift and can automatically generate and apply a plan to correct it; read-only drift detection is also supported. · flux-iac.github.io, 7 Oct 2026
GitOps models
It supports GitOps automation, hybrid automation, state enforcement, and drift detection models. · flux-iac.github.io, 7 Oct 2026
Installation
The documentation provides Helm and kubectl installation methods for deployment into a Kubernetes cluster. · flux-iac.github.io, 5 Oct 2026
Integrations
The getting-started guide demonstrates using Flux source types including GitRepository, Bucket, and OCIRepository. · flux-iac.github.io, 7 Oct 2026
License
The repository includes the Apache License, Version 2.0. · github.com, 5 Oct 2026
Multi-tenancy
Runner Pods can use a specified namespace and ServiceAccount for a soft multi-tenancy model that can be used with Flux multi-tenancy. · flux-iac.github.io, 7 Oct 2026
Plan approval
It supports separating plan from apply, with approval managed through a GitOps change that can be reviewed by a teammate. · flux-iac.github.io, 7 Oct 2026
Purpose
Tofu Controller is a controller for Flux that reconciles Terraform resources using GitOps. · flux-iac.github.io, 7 Oct 2026
Requirements
The getting-started guide requires Flux v2.0 or later for controller versions v0.15 and newer, and documents network access between the controller, Runner Pods, Source controller, and Notification controller. · flux-iac.github.io, 5 Oct 2026
Runtime requirements
The controller uses a Controller/Runner architecture with gRPC communication to Runner Pods on port 30000 and downloads source archives from the Source controller over port 80. · flux-iac.github.io, 7 Oct 2026
Security reporting
The project accepts vulnerability reports through its Security page, investigates reports through maintainers, and says it does not run a bug bounty program. · github.com, 5 Oct 2026
Support
The project directs users to file issues for bugs or feature requests and provides a Tofu Controller Slack channel through CNCF Slack. · github.com, 5 Oct 2026
Terraform Cloud
Branch Planner can run plans and approved applies on Terraform Cloud and store state there; its documented Git provider support is currently GitHub only. · flux-iac.github.io, 7 Oct 2026
YAML configuration
The Terraform object supports configuring Terraform resources through YAML without adding extra CRDs to the cluster. · flux-iac.github.io, 7 Oct 2026

Where Tofu Controller stands on Freedom251

Look at these too