tofu-controller

Tofu Controller

Chainguard's redistribution of the tofu-controller Helm chart, pre-configured with hardened Chainguard Images.

The tofu-controller is a GitOps OpenTofu and Terraform controller for Flux. It reconciles Terraform custom resources by launching tf-runner pods that plan and apply your infrastructure code.

Prerequisites

The tofu-controller is a Flux controller and expects Flux (in particular the source-controller) to be installed in the cluster, for example with the flux2 Helm chart.

Authentication is required to access this chart and its images. First, authenticate with Chainguard and configure your environment:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret for the cluster:

kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace flux-system

Installation

helm install tofu-controller oci://cgr.dev/ORGANIZATION/charts/tofu-controller \
  --namespace flux-system \
  --create-namespace \
  --set imagePullSecrets[0].name=cgr-pull-secret

The chart's imagePullSecrets value applies to the controller pod only. The tf-runner pods the controller creates run under the runner service account (tf-runner by default) in each namespace that hosts Terraform resources, so make the pull secret available to that service account as well, for example:

kubectl patch serviceaccount tf-runner -n flux-system \
  -p '{"imagePullSecrets": [{"name": "cgr-pull-secret"}]}'

Images

This chart maps the following image slots to Chainguard Images:

The runner image is passed to the controller through the RUNNER_POD_IMAGE environment variable. The optional branch planner (branchPlanner.enabled, off by default) is not mapped because Chainguard does not publish a branch-planner image.

About This Chart

This is a redistribution of the upstream tofu-controller Helm chart. All upstream configuration options and documentation apply.

For full documentation, see: https://flux-iac.github.io/tofu-controller/