A Kubernetes operator for Terraform
Magos runs Terraform inside Kubernetes. The controller spawns a short-lived pod for every plan and every apply, then tears it down. No shared runner, no long-lived shell, no company behind it.
Built by folks who worked on Terraform, Atlantis, Kubernetes.
VCS
Infrastructure
Execution
State
VCS
Infrastructure
Execution
State
Extends the Kubernetes API. Manage Terraform declaratively.
Four custom resources. Manage them like any other Kubernetes manifest; the controllers reconcile.
Workspace
Points at a Git source and a Terraform version. The controller spawns one short-lived pod per plan and per apply, fully isolated from every other Workspace.
Project
Groups related Workspaces, sets shared variables, declares default policy gates. Members inherit unless they explicitly override.
Rollout
Executes Workspaces in sequential, parallel, or layered order. Promotion across environments is a CR field, not a multi-stage pipeline.
VariableSet
Wires Kubernetes Secrets and ConfigMaps into Terraform inputs through SecretKeySelector. Values never touch the controller.
Three properties we will not trade away.
Every decision in Magos has to preserve them. Compromise one and the feature does not ship. Opinionated software, written by engineers with backgrounds at HashiCorp, Microsoft, GitHub, AWS, and Google who have run Terraform at scale.
- Per-Workspace pod isolation. Every plan and every apply runs in its own short-lived pod with its own PVC. Two Workspaces never see each other's plan, credentials, or providers.
- Policy gates on plan output. Magos uses Kyverno
ValidatingPolicy. The plan pod evaluates every matching policy against the plan JSON. A violation blocks apply before any cloud API has been touched. - Bring your own backend. State lives wherever your module's
backendblock puts it. S3, GCS, Postgres, or whatever your team already runs. Magos does not store, lock, or proxy state.
Build the next version of how Terraform runs.
Apache-2.0, built in the open. Read the code, weigh in on RFCs, ship a PR. The contributors are the project.