mattrobinsonsre/terrapod v2.0.0-alpha.1

on GitHub

Terrapod is a free, open-source platform replacement for Terraform Enterprise — the
collaboration, governance, state and UI layer around tofu or terraform. This is the
first 2.0 pre-release: Terrapod now orchestrates Ansible and Pulumi alongside
OpenTofu and Terraform, and it carries 2.0's breaking changes.

Highlights

• Ansible, as a configure operation — not a peer engine. A workspace declares a
  config_directory and gains a configure that runs after its apply, or on its own,
  through the same run lifecycle as a plan: the same RBAC, the same run options, the same
  notifications and audit trail. Inventory is seven first-class tables — hosts, groups,
  membership, children, and variables at host, group and global scope — authored through the
  API, the SDK, the provider or the UI, and resolved by ansible itself, merged with any
  committed VCS source.
• Execution environments, one per ansible-core line — 2.12 through 2.21, published and
  rebuilt on upstream patches, run as a native sidecar beside the orchestrator. A workspace
  picks its line; an operator may supply their own image instead. Picking a line is how you
  choose which target Pythons a playbook can reach, which is what keeps EL7-era fleets
  in scope.
• Ansible credentials, placed by the inventory — ansible_machine_auth and
  ansible_vault_auth are variable categories, so they inherit encryption at rest,
  variable sets and per-run Secret delivery. A ${terrapod:name.field} placeholder in an
  inventory variable says where each field is used, rather than a mapping guessing for
  you. Host-key verification is on, with a known_hosts field to satisfy it and a
  per-workspace switch to relax it that a single host can still override.
• A configure reports per host — one row each, with a status that distinguishes not
  reached from nothing happened, a per-host log view switchable mid-run, and
  partial-configure recovery that retries only the remainder.
• Pulumi as a first-class engine — all four language runtimes install their own
  dependencies offline, Terrapod is the Pulumi service backend for agent runs, and previews
  carry drift detection, state views, cost estimation and AI summaries. pulumi_config
  variables merge with a committed stack file rather than replacing it.
• A Pulumi provider for Terrapod, bridged from the Terraform provider — so the
  Terraform schema stays the one canonical surface and a resource added there appears in
  Pulumi with no second definition to keep in step.
• Saved-plan runs — tofu plan -out=FILE then tofu apply FILE, with the state-serial
  guard that makes deferring an apply safe.
• Service catalog — a catalog item provisions a workspace from a module, including an
  Ansible-first one that carries only as much Terraform as it takes to declare its
  inventory.
• The MCP surface is missing nothing — every workspace setting an agent can read it can
  now also set, because the MCP server is not an authorization boundary: it carries the
  user's own token and the API applies the same RBAC it applies to every other client.
  Reading a setting you cannot change is the asymmetry the parity gate exists to catch, and
  it had drifted for as long as that gate had existed.
• Per-workspace cloud identity — Terrapod is an OIDC issuer for runs, so a workspace
  federates to AWS, Azure, GCP or Vault as itself, with no stored credential and a phase
  claim separating plan from apply. A configure mints its own.

Breaking Changes

Read Upgrading to 2.0 before upgrading. It documents every
one with the exact change it needs, and several want action before the upgrade rather
than after — the SSO callback URLs in particular must be re-registered with your IdP first.
In brief:

• SSO callback URLs move to /api/v1; the deprecated path aliases are still served.
• A variable is identified by its category and key together, and there is one variable
  category per role rather than one per engine.
• An explicit = "" clears an optional string; removing the line no longer does.
• Label rules take a list of values per key; an IdP group can no longer grant admin or
  audit; a web session ends when the roles behind it change.
• The five SAML assertion checks are strict by default, and listeners must prove they hold
  their certificate's private key.
• Terrapod owns the token signing key, adopting a used deployment's existing one.
• The engine on/off switch, api.config.default_ansible_version and
  registry.platform_tools.pulumi_version are removed.
• TF_VAR_terrapod_run_phase is no longer exported.
• An operator-supplied execution environment must run as uid 1000.
• The Python floor moves to 3.14.

Status

Alpha — published so the 2.0 surface can be exercised ahead of GA. The UI has not yet
had its accumulated review pass, and that plus the remaining 2.0 items are targeted at the
next pre-release; the API, SDK, provider and MCP contracts are snapshot-gated and additive.
Not recommended for production. The supported 1.x lines are unaffected and continue to
receive security and obvious bug fixes.

Full Changelog: v1.11.2...v2.0.0-alpha.1