Exploring the transition to open-source GitOps for Terraform and OpenTofu, and why moving away from proprietary “black box” CI/CD tools is the best move for modern infrastructure teams.

Breaking Free from Infrastructure Silos: Why Open Source GitOps for Terraform is the Future

I still have nightmares about the “Great State Lock of 2022.” We had a junior engineer—let’s call him Kevin—who was trying to fix a routing issue on prod-db-cluster-04. Kevin ran a manual terraform apply from his terminal while a GitHub Action was halfway through a deployment. The state file got mangled, the lock didn’t release, and for three hours, our entire production environment was essentially frozen in carbonite while I manually edited JSON state files in a cold sweat. It was the kind of day that makes you want to quit tech and start a goat farm. That’s when I realized that treating infrastructure as an afterthought in your CI/CD pipeline is a recipe for disaster.

The core of the problem isn’t Terraform or OpenTofu itself; it’s the “glue code.” Most teams try to wrap their IAC in standard CI tools like Jenkins or vanilla GitHub Actions. These tools are great for building Docker images, but they are “state-blind.” They don’t understand the nuance of a plan that needs human review before an apply, or how to elegantly comment plan outputs back to a Pull Request without hitting character limits or formatting nightmares.

The Fixes: From Hacky Bash to Production-Grade GitOps

If you’re tired of fighting your pipeline every time you want to spin up a new S3 bucket, here are three ways to handle your infrastructure workflow, ranging from “we need this fixed in five minutes” to “we’re building a world-class platform.”

Solution 1: The Quick Fix (The “Better-Than-Nothing” Wrapper)

If you aren’t ready to adopt a full orchestrator yet, you can at least stop the bleeding by using a specialized GitHub Action wrapper. This is a bit “hacky” because you’re still managing secrets and environment variables manually in the UI, but it beats running things from your local machine.

- name: Terraform Plan
  uses: hashicorp/setup-terraform@v2
- run: terraform plan -out=tfplan
- name: Post Plan to PR
  uses: actions/github-script@v6
  with:
    script: |
      const output = `#### Terraform Plan Output ...`;
      github.rest.issues.createComment({
        issue_number: context.issue.number,
        owner: context.repo.owner,
        repo: context.repo.repo,
        body: output
      })

Pro Tip: Always use a remote backend like S3 or GCS with DynamoDB locking. If you’re still using a local terraform.tfstate file, you’re living on borrowed time.

Solution 2: The Permanent Fix (The Terrateam GitOps Approach)

This is where the real magic happens. With Terrateam going open source, we can finally integrate a dedicated GitOps orchestrator that actually understands OpenTofu and Terraform. Instead of writing custom Bash scripts to parse plan files, you let the orchestrator handle the lifecycle. It listens for PR commands (like terrateam plan) and handles the concurrency for you.

By moving to an open-source orchestrator, we get the transparency we need. If something fails on staging-web-server-01, I can look at the Terrateam logs and see exactly which step of the plan failed without digging through 4,000 lines of Jenkins console output.

Solution 3: The ‘Nuclear’ Option (Self-Hosted Ephemeral Runners)

For those of you in high-security environments (looking at you, FinTech and Healthcare), you might need to go “Nuclear.” This involves using Terrateam in conjunction with self-hosted, ephemeral runners inside your own VPC. This way, your AWS keys never even touch a third-party server.

# Example: Using OIDC to assume roles without static secrets
- name: Configure AWS Credentials
  uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/GithubActionsRole
    aws-region: us-east-1

This setup is the gold standard. You get the GitOps workflow, the plan/apply transparency in the PR, and the security of knowing that your prod-admin credentials are scoped strictly to a single OIDC session. It’s a bit more work to set up, but you’ll sleep much better at night.

Final Thoughts

At TechResolve, we’ve learned the hard way that infrastructure is only as stable as the process used to deploy it. Moving to an open-source GitOps model isn’t just about using a new tool; it’s about giving your team the confidence to ship changes without the “Kevin scenario” happening again. Whether you’re sticking with Terraform or making the jump to OpenTofu, stop running applies from your laptop. Your future self will thank you.

Darian Vance

Lead Cloud Architect & DevOps Strategist

With over 12 years in system architecture and automation, Darian specializes in simplifying complex cloud infrastructures. An advocate for open-source solutions, he founded TechResolve to provide engineers with actionable, battle-tested troubleshooting guides and robust software alternatives.

🤖 Frequently Asked Questions