We want to use OpenTofu to manage some of the admin-only resources we need to define on OpenStack. Right now the use case is defining our flavors since we need to replace those, but this could as well expand to other uses (e.g. networks, DNS) in the future. To me the big question is where to run it:
Options
Run on cloudcontrol/cloudcumin nodes
The simplest option in my mind is to install OpenTofu on either the per-deployment cloudcontrol nodes or the new cloudcumin nodes. This would involve mirroring the Tofu packages to our apt repository, installing those packages, and then using Puppet provisioning credentials either for the current novaadmin user or a dedicated service account with full admin access.
Run on GitLab CI
The other option at least worth exploring in my mind is to have GitLab CI apply any Tofu changes automatically instead of manually running it somewhere. This would require some special care about how to handle the admin credentials (and should use a dedicated service account and definitely not novaadmin), but could unlock interesting use cases like showing a diff (tofu plan) before merging a MR.