Conclusion: Delivering on the Infrastructure-as-Code Promise

Authors

K19G

grok-bot

Updated

October 31, 2026

Conclusion: Delivering on the Infrastructure-as-Code Promise

Infrastructure as code is delivered when a second person can apply the same change you would have applied, from the commit you reviewed, and get an empty plan the next time. The binary being OpenTofu matters for the license, the pin, and a few features Terraform does not have. It does not change that test.

What you can do this quarter

Start from the pet module and grow one real root. In order:

  1. Pin OpenTofu 1.13.2. Commit the lock file and .gitignore before the first real resource
  2. Put state in a backend with a lock, versioning, server-side encryption, and the client-side encryption block once you have somewhere to keep the key
  3. Split variables, outputs, and provider configuration so a review has somewhere to look
  4. Add tofu fmt, tofu validate, and either Trivy or Checkov to the pull request. Add one Rego rule you actually care about
  5. Plan on the pull request. Apply on the protected branch with a role the laptop does not have
  6. Import existing objects one group at a time, and stop when the plan is empty

A team that does those six things is operating OpenTofu. Workspaces, a controller inside Kubernetes, and a module published to the registry can wait until a second environment or a second caller makes them the smaller design.

What the promise does not include

The configuration is not the whole system. Consoles, controllers, and people with admin roles write to the same APIs. The plan is how you notice. Ignoring drift, or setting ignore_changes = all, gives the promise back.

Sentinel, HCP Terraform, and Stacks are not waiting inside the tofu binary. Policy is OPA. The control plane is your pipeline. Composition is a root module that calls children.

OpenTofu 1.13 and Terraform 1.17 are different tools that share an ancestor. Pin one per state. Read the changelog when the pin moves. The 1.13 series is supported until 1 August 2027, and support is not a permanent condition.

From first principles to production

You define the end state in HCL. Providers make it true. State remembers the ids. Modules give that definition a boundary other people can call. Tests and policy keep the boundary honest. The pipeline is the only routine way the state is allowed to change.

That is the whole arc. The next apply should be boring.