Terrapod is a free, open-source, self-hosted platform replacement for Terraform Enterprise — orchestrating OpenTofu, Terraform, Pulumi and Ansible. This beta completes the configure log's output story and closes a defect that cost every apply its stored log.
Highlights
- A configure log you can actually read — the Ansible output work is finished. A task announces itself when it starts, says it is still running rather than going quiet on a long step, and every line ansible prints is now a block: five callback hooks were leaking raw, unformatted lines into the log, which the per-host reader treats as closing the open block and so detached everything around them from the host filter. Delegated tasks keep
-> <delegate>, handlers are markedhandler:, and a task running in check mode has its label suffixed[CHECK MODE]— honouring your owncheck_mode_markers, which ansible defaults to off. (Terrapod passes no--checkof its own, by design, so what you reach ischeck_mode: truein your own playbook.) - Schedule a configure with cron — a first-class schedule on the workspace, cron rather than an interval, so "every Tuesday at 02:00" means that and does not drift against the wall clock. For a team arriving from AWX, where scheduling a job template is a first-class feature, "stand up your own cron against our API" was a materially worse answer — and one whose failure is silent, since a timer that stops firing looks exactly like a workspace with nothing to do.
The schedule reaches every surface it should: terrapod_workspace_create on the MCP server takes it at creation rather than forcing a create-then-update, and terrapod_autodiscovery_rule templates it onto the workspaces it creates — in the Terraform provider and, through the bridge, in Pulumi.
Bug Fixes
- Every apply lost its stored log, and every failed phase lost the log most worth having. The runner writes its combined phase log and resource profile at exit, after the result it posts has already moved the run terminal — so the run-lifetime token revocation refused both uploads on every single run. The run page showed the last live snapshot until that expired and then showed nothing. Those four end-of-exit routes now accept a write for two minutes after a run goes terminal, on a token still scoped to that one run and phase; reads are refused, every other route is refused, and a run whose end time is not recorded gets no window at all.
- A workspace whose last run failed now reports it as a health condition. The Health filter unions one term per condition and all six conditions came from persistent columns, so a workspace whose newest run
erroredreported no conditions at all: the status column saiderroredwhile the Health count said the estate was fine. - An attribute added to a
terrapod_*data source could be unreachable from Pulumi with every check green — the resource half of that gate has existed since 2.0.0-beta.2; the data-source half did not. - Four OCI registry writes promised idempotency and implemented it as a
SELECTabove anINSERT, which a concurrent client raced. - The pinned Checkov moves to 3.4.5. Security scanning pulls Checkov through the binary cache from binaries Terrapod builds — upstream stopped publishing an arm64 asset at 3.3.21 — so the pin can only name a version we have published, and 3.4.5 could not be built: it raised its Python floor to 3.10 against a build interpreter fixed at 3.9. The interpreter is now read per version from that version's own
Pipfile, so the next time upstream moves its floor nothing here has to change. - A CA generated without
keyUsagethat newer OpenSSL correctly refuses to verify through, and a Pulumi install that unpacked one binary from a tarball shipping twelve — both latent, both surfaced by theubuntu-latestrunner image moving.
Status
Beta — the 2.0 development line. Not supported for production; the 1.11.x and 1.10.x lines are.
Full Changelog: v2.0.0-beta.4...v2.0.0-beta.5