Blog
Terraform, Kubernetes, and GitOps
What breaks after the first apply: drift, Spot interruptions, policy, and who should approve the next plan.
Definitions
What drift is, Terraform vs OpenTofu, and who should approve an apply.
- Infrastructure driftInfrastructure drift is the gap between what your Terraform or OpenTofu files declare and what actually exists in AWS, Azure, GCP, or OCI. Here is what causes it, why it matters, and how teams classify it.
- Terraform vs OpenTofuTerraform and OpenTofu share HCL, state, and most providers. They differ in license, release cadence, and who you trust to ship the binary. Here is how to choose — and when a migration is actually worth it.
- IaC governanceIaC governance is the set of rules, reviews, and identity controls that decide who can change cloud infrastructure, what a plan is allowed to do, and how exceptions expire. It is not a style guide for Terraform.
- Detect Terraform driftDetect Terraform drift by refreshing state, saving a plan, and classifying the diff — then add cloud inventory for resources Terraform does not manage. A practical scan loop you can run in CI.
- AI for infrastructure as codeAI can draft Terraform, explain a plan, and classify drift. It should not skip review, invent cloud APIs, or apply without a saved plan. What is useful today — and what still needs a human.
Latest
Kubernetes
Karpenter Disruption: Consolidation, Budgets, and Why Pods Go Pending at 3am
How Karpenter decides to replace nodes, how disruption budgets interact with PDBs, and the settings that stop consolidation from evicting production at the worst time.
2026-09-08 · 4 min read
Kubernetes
Kyverno Policies That Teams Will Actually Keep Enabled
Validate, mutate, and generate with Kyverno without turning every deploy into a 403 — policy types, failure actions, exceptions, and a starter set for platform clusters.
2026-09-07 · 4 min read
Terraform
terraform test: Unit-Test Modules Without a Second CI Language
How to write terraform test files that catch module regressions in plan — run blocks, assert, mock providers, and when you still need Terratest.
2026-09-06 · 3 min read
ArgoCD
Multi-Cluster Argo CD: One Control Plane, Many Destinations, Fewer Foot-Guns
Hub-and-spoke vs per-cluster Argo CD, Application destination vs ApplicationSet, secrets, and the RBAC mistakes that let staging sync prod.
2026-09-05 · 4 min read
Kubernetes
Kubernetes Requests and Limits: Throttling, Eviction, and the 3x Guess
What CPU limits actually do, why memory limits OOMKill, how requests drive scheduling, and a way to set numbers from Prometheus instead of folklore.
2026-09-04 · 4 min read
Terraform
Terraform Best Practices That Hold Up in Production
State layout, locking, module contracts, provider pinning, and plan hygiene — the Terraform habits that prevent Friday-night apply incidents.
2026-09-03 · 5 min read
ArgoCD
Argo CD Sync Waves: Ordering Kubernetes Applies Without Hooks Spaghetti
How sync waves and sync phases actually work, when to use them instead of PreSync hooks, and the failure modes that leave apps stuck OutOfSync.
2026-09-02 · 5 min read
Kubernetes
Running Kubernetes on Spot: Interruptions, PDBs, and Node Pools That Survive
How to put real workload on Spot / preemptible nodes without turning every interruption into an incident — taints, PDBs, grace periods, and mixed on-demand capacity.
2026-09-01 · 5 min read
Terraform
Terraform for_each vs count: Choose the Index That Will Not Recreate Prod
Why count indexes by position, why for_each indexes by key, and how to migrate a live resource without a destroy/create.
2026-08-28 · 3 min read
CI/CD
GitHub Actions OIDC for Terraform: Apply Without Long-Lived Cloud Keys
Wire GitHub’s OIDC token to AWS, GCP, or Azure so Terraform CI can plan and apply without storing static access keys in repository secrets.
2026-08-25 · 4 min read
Kubernetes
External Secrets Operator: Stop Committing Sealed Blobs to Git
A practical ESO setup: ClusterSecretStore, ExternalSecret refresh, IRSA/Workload Identity, and the failure modes that look like “the app has empty env vars.”
2026-08-22 · 4 min read
Terraform
IaC Drift Triage Playbook: Detect, Classify, and Reconcile Safely
A practical playbook for turning Terraform/OpenTofu drift findings into safe, governed actions across AWS, Azure, GCP, and OCI.
2026-08-20 · 3 min read
Kubernetes
Kubernetes GitOps Best Practices for Platform Teams
Patterns for building reliable, auditable GitOps workflows on Kubernetes—covering repository structure, reconciliation hygiene, and governance gates.
2026-08-10 · 2 min read
Terraform
Terraform Module Design for Multi-Cloud Portability
How to design Terraform modules that remain reusable across AWS, Azure, GCP, and OCI without provider-specific spaghetti.
2026-07-28 · 2 min read
Policy
Policy-as-Code Patterns for IaC Governance Teams
Patterns for writing, testing, and enforcing infrastructure policy as code—so governance is consistent, auditable, and reviewable.
2026-07-15 · 2 min read
Approvals
Building Approval Gates for Safe Infrastructure Rollouts
How to design approval gates that catch risky IaC changes before they reach production, while avoiding approval fatigue.
2026-07-05 · 2 min read
Kubernetes
Kubernetes Cost and Security Hygiene Checklist
A platform-team checklist to keep clusters cost-efficient and security-hardened: quotas, least privilege, network restrictions, and rightsizing.
2026-06-20 · 2 min read
CI/CD
Structuring CI/CD Pipelines for IaC Validation
A blueprint for CI/CD pipelines that validate Terraform/OpenTofu plans before apply, combining format checks, policy evaluation, and review gates.
2026-06-10 · 2 min read
IaC
How to Scope Your IaC Governance Trial (What to Test in 14 Days)
A structured guide for teams evaluating OrchesTerra during a 14-day trial: connecting environments, triaging drift, validating generation, and measuring outcomes.
2026-06-01 · 2 min read
Platform evaluation
See OrchesTerra on your infrastructure
Request access to generate architecture from a repository, review the plan, and run governed reconciliation across AWS, Azure, GCP, and OCI.