Skip to main content

opentofu-quickstart

Last updated on

OpenTofu is an open-source infrastructure-as-code tool, and Harness Infrastructure as Code Management (IaCM) runs your OpenTofu workspaces and pipelines with Git-backed configuration, connectors, and optional cost estimation.

This guide walks you from connectors and workspace creation through a standard provision pipeline (init, plan, apply) and an optional approval between plan and apply.

What will you learn?​

This guide covers the following:

  • Connectors and workspace: Create cloud and Git connectors, then create an OpenTofu workspace wired to your repository and OpenTofu version.
  • Provision pipeline: Generate or author a pipeline that runs init, plan, and apply for your workspace.
  • Approvals: Optionally gate apply behind an approval step.

Before you begin​

Before you use this guide, ensure you have the following:

  • Harness account with IaCM enabled: You need Infrastructure as Code Management under Infrastructure in Harness when it is entitled on your account. Go to Getting started with Harness Platform to access or create a Harness account.

    Contact Harness support

    If IaCM does not appear, go to Get started with IaCM, or contact your account administrator or Harness Support.

  • Pipeline permissions: View, Create/Edit, and Execute on Pipelines. Go to RBAC in Harness to review the permissions model, and go to Manage roles to assign a role that includes them.

  • Git repository: Access to a Git provider with your OpenTofu project.

  • Cloud provider: Access to a cloud provider such as AWS or Google Cloud Platform for the infrastructure you manage.

  • Harness organization and project: An organization and project set up on the Harness Platform.

Sample OpenTofu

The following example OpenTofu (.tf) file declares:

  • Provider Configuration: Specifies the AWS provider and sets the region to "us-east-1". Go to AWS Regions & Availability Zones for a complete region list.
  • Resource Definition: Creates an EC2 instance with the identifier my_first_ec2_instance.
  • AMI: Utilizes ami-123abc321cba18, go to AWS EC2 User Guide to find your AMI image ID.
  • Instance Type: Configures the instance to use a t2.micro. Go to the AWS t2 instances list.
    Tags: To facilitate easy identification and management within AWS resources, a tag name with the value my_first_ec2_instance is applied.
provider "aws" {
  region = "us-east-1"
}

resource "aws_instance" "my_first_ec2_instance" {
  ami = "ami-123abc321cba18"
  instance_type = "t2.micro" # Go to https://aws.amazon.com/ec2/instance-types/t2/ for a full T2 instance type list.

  tags = {
    Name = "my_first_ec2_instance"
  }
}

Go to OpenTofu Documentation to review currently supported workspace types.

Set up your workspace​

A workspace is a named environment for storing your OpenTofu configurations and resources. Connect your cloud provider and code repository through Connectors to manage infrastructure changes and updates with Harness IaCM pipelines.

info

Harness recommends configuring your connector before creating your workspace, however, you can also add new connectors during the Create Workspace flow.

Step 1: create a connector​

Use Harness AI to create and configure your cloud provider and code repository connectors before you create a workspace:

OIDC connectors

For easier access and token management, use the OIDC (OpenID Connect) option in the Credentials panel. This allows your connector to assume roles with permissions set in your Cloud Provider, updated only by authorized users. Go to the Use OIDC tab for setup details.

Step 2: create your workspace​

Once you have configured your connectors, you can create a workspace and select them in the New Workspace panel:

Migrate existing projects

For first-time use, use our migration tool to create new workspaces and import your existing Terraform projects into the Harness Platform.

Step 3: add a provision pipeline​

A pipeline structures workflows to manage tasks like planning infrastructure changes, enforcing policies, and approvals. Go to Harness Pipelines to review pipeline concepts. You can also add pipelines through the Harness Platform or use a code-first approach with YAML.

Harness AI pipeline generation​

The Provision operation adds three Terraform plugin steps: init, plan, and apply. Go to Tofu/Terraform Plugins to review supported OpenTofu/Terraform commands.

Step 4: run your pipeline​

Now run your pipeline to provision your infrastructure.

To run your provision pipeline, do the following:

  1. Click Save to save your pipeline.
  2. Click Run in the top right corner.
  3. Confirm any runtime inputs if prompted.
  4. Click Run Pipeline.

The pipeline executes the three steps in order: init, plan, and apply. Each step shows progress in real time. Click any step to view detailed logs.

After the apply step completes successfully, your infrastructure is provisioned. Go to the Workspaces view, select your workspace, and open the Resources tab to see the resources created.

Add production features

Go to Set Up OpenTofu Provisioner to add approval gates, cost estimation, and variable management to your provisioner.

Last updated on