We have discussed the possibility of introducing some gitlab-ci automation for tofu-infra.
In this early stage, we are mostly interested in tofu plan. We have detected an upstream gitlab integration for opentofu that we could reuse/adapt to our own (but not just mirror because that is only possible with GitLab Premium).
As a first step, we should consider generating a new set of credentials for novaobserver to run "tofu plan" from gitlab ci in read-only mode. The credentials will also need to access the Object Storage bucket containing the Tofu state file, so maybe we will need a separate user?
Other ideas to explore:
- integrate with pre-commit
- consider using Atlantis or Digger