TerraPod
AI Skill Hub 推荐使用：TerraPod 是一款优质的AI工具。AI 综合评分 7.5 分，在同类工具中表现稳健。如果你正在寻找可靠的AI工具解决方案，这是一个值得深入了解的选择。
📚 深度解析
**为什么要使用开源工具而非商业 SaaS？**
对于个人开发者和有隐私需求的用户，本地部署的开源工具意味着数据不离本机，不受第三方服务商的数据政策约束。同时，开源工具通常没有使用次数限制和月度费用，一次安装即可长期使用，对于高频使用场景的总拥有成本（TCO）远低于订阅制商业工具。
**安装与环境准备**
TerraPod 依赖 Python 运行环境。建议通过 pyenv（Python）或 nvm（Node.js）管理 Python 版本，避免全局环境污染。对于新手用户，推荐先创建虚拟环境（python -m venv venv && source venv/bin/activate），再安装依赖，这样即使出现问题也可以随时删除虚拟环境重新开始，不影响系统稳定性。
**社区与维护**
GitHub Issue 和 Discussion 是获取帮助的最快渠道。在提问前建议先检查 Closed Issues（已关闭的问题），大多数常见问题都已有解答。遇到 Bug 时，提供 pip list 的输出、完整错误堆栈和最小可复现示例，能显著提高开发者响应速度。AI Skill Hub 将持续追踪 TerraPod 的版本更新，及时通知重要功能变化。
📋 工具概览
TerraPod 是一款基于 Python 开发的开源工具，专注于 ai、devops、docker 等核心功能。作为 GitHub 开源项目，它拥有活跃的社区支持和持续的版本迭代，代码完全透明可审计，支持本地部署以保护数据隐私。无论是个人使用还是集成到企业工作流，都能提供稳定可靠的解决方案。
📖 中文文档
TerraPod 是一款基于 Python 开发的开源工具，专注于 ai、devops、docker 等核心功能。作为 GitHub 开源项目，它拥有活跃的社区支持和持续的版本迭代，代码完全透明可审计，支持本地部署以保护数据隐私。无论是个人使用还是集成到企业工作流，都能提供稳定可靠的解决方案。
- 开源免费，支持本地部署，数据完全自主可控
- 活跃的 GitHub 开源社区，持续迭代更新
- 提供详细文档和使用示例，新手友好
- 支持自定义配置，灵活适配不同使用环境
- 可作为基础组件集成进现有技术栈或进行二次开发
- 本地部署运行，保护数据隐私，满足合规要求
- 自定义集成到现有系统，扩展技术栈能力
- 作为开源基础组件进行商业化二次开发
# 方式一：pip 安装（推荐）
pip install terrapod
# 方式二：虚拟环境安装（推荐生产环境）
python -m venv .venv
source .venv/bin/activate # Windows: .venv\Scripts\activate
pip install terrapod
# 方式三：从源码安装（获取最新功能）
git clone https://github.com/mattrobinsonsre/terrapod
cd terrapod
pip install -e .
# 验证安装
python -c "import terrapod; print('安装成功')"
- 访问 GitHub 仓库页面
- 按照 README 文档完成依赖安装
- 根据系统环境完成初始化配置
- 参考官方示例或文档开始使用
- 遇到问题可在 GitHub Issues 中查找解答
# 命令行使用
terrapod --help
# 基本用法
terrapod input_file -o output_file
# Python 代码中调用
import terrapod
# 示例
result = terrapod.process("input")
print(result)
# terrapod 配置文件示例（config.yml） app: name: "terrapod" debug: false log_level: "INFO" # 运行时指定配置文件 terrapod --config config.yml # 或通过环境变量配置 export TERRAPOD_API_KEY="your-key" export TERRAPOD_OUTPUT_DIR="./output"
Terrapod
Open-source platform replacement for Terraform Enterprise.
Terrapod provides the collaboration, governance, state management, and UI layer that wraps around terraform or tofu as pluggable execution backends. It targets API compatibility with the HCP Terraform / TFE V2 API so that existing tooling -- the terraform CLI with cloud block, the go-tfe client, CI/CD integrations -- can point at a Terrapod instance with minimal reconfiguration.
Terrapod is not a fork of Terraform or OpenTofu. It orchestrates them.
Drop-in replacement for HCP Terraform. Point your existingcloudblocks,go-tfeclients, and CI/CD pipelines at Terrapod — zero code changes required.
AI-augmented plans. Every plan can carry an LLM-generated change description, risk assessment, and (on failure) suggested fixes — provider-agnostic via LiteLLM. Wire AWS Bedrock (Claude, Nova, gpt-oss) with native IAM auth, or point at OpenAI, Anthropic, Gemini, Azure OpenAI, or any OpenAI-compatible endpoint. See docs/ai-plan-summary.md.
Policy-as-code with OPA. Block applies on policy violations using Open Policy Agent and the Rego language — the open-source equivalent of TFE's proprietary Sentinel. Policy sets are scoped to workspaces with the same label-based model as roles, evaluated on the runner against the plan JSON, and gated asadvisory(warn) ormandatory(block). See docs/policies.md.
---
Key Features
| Feature | Status | Description |
|---|---|---|
| Workspaces | Implemented | Isolate state, variables, and runs per workspace |
| Remote State Management | Implemented | Versioned state storage with locking, rollback, encryption at rest via CSP services |
| Agent Execution | Implemented | Plan/apply runs on the server via K8s Job-based runner infrastructure |
| VCS Integration | Implemented | GitHub (App) and GitLab (access token); polling-first with optional webhooks |
| Variables & Secrets | Implemented | Per-workspace env and Terraform variables; sensitive values protected by database encryption-at-rest; variable sets |
| RBAC | Implemented | Label-based role system with hierarchical workspace permissions (read/plan/write/admin) |
| Private Module Registry | Implemented | Publish, version, and share modules internally |
| Private Provider Registry | Implemented | Publish, version, and share providers with GPG signing and network mirror caching |
| Binary Caching | Implemented | Pull-through cache for terraform/tofu CLI binaries |
| Agent Pools | Implemented | Named groups of runner listeners; join token → certificate exchange for auth |
| CLI-Driven Runs | Implemented | terraform plan / apply via cloud backend (both terraform and tofu verified) |
| TFE V2 API | Implemented | JSON:API surface compatible with go-tfe / terraform login |
| Audit Logging | Implemented | Immutable event log with configurable retention |
| SSO (OIDC / SAML) | Implemented | Pluggable identity providers (Auth0, Okta, Azure AD, etc.) |
| Drift Detection | Implemented | Scheduled plan-only runs to detect out-of-band changes |
| Run Triggers | Implemented | Cross-workspace dependency chains — source apply triggers downstream runs |
| **AI Plan Summary** | **Implemented** | **LLM-generated change summary + risk assessment on every plan; failure analysis on errored plans. Provider-agnostic via LiteLLM — AWS Bedrock (Claude, Nova, gpt-oss…), OpenAI, Anthropic direct, Google Gemini, Azure OpenAI, vLLM. IAM-native auth for Bedrock (IRSA + optional cross-account sts:AssumeRole).** |
| **Policy-as-Code (OPA)** | **Implemented** | **Rego-based policy enforcement on plan output — the open-source equivalent of Sentinel. Advisory or mandatory sets, label-scoped to workspaces, evaluated on the runner against plan JSON, with admin-override on mandatory blocks. Author Rego, attach to workspaces by label, see pass/fail per policy on every run.** |
| Notifications | Implemented | Webhook (HMAC-SHA512), Slack (Block Kit), and email alerts on run events |
| Run Tasks | Implemented | Pre/post-plan webhook hooks for external validation |
| Workspace Health | Implemented | Per-workspace health conditions, VCS polling status, drift detection indicators |
| Workspace Autodiscovery | Implemented | Atlantis-style monorepo autodiscovery — pattern-matched rules auto-create workspaces on PRs to new directories |
| Cloud Credentials | Implemented | Dynamic provider credentials via K8s workload identity (AWS IRSA, GCP WIF, Azure WI) |
Prerequisites
Setup
```zsh
Install mkcert and create local CA
brew install mkcert && mkcert -install
Production Deployment
Terrapod is deployed via Helm chart on Kubernetes. Images and chart are published to GHCR.
helm install terrapod oci://ghcr.io/mattrobinsonsre/terrapod \
--namespace terrapod \
--create-namespace \
--set ingress.enabled=true \
--set ingress.hostname=terrapod.example.com \
--set postgresql.url="postgresql+asyncpg://user:pass@db:5432/terrapod" \
--set redis.url="redis://redis:6379"Required infrastructure: - PostgreSQL (v14+) for relational data - Redis (v7+) for sessions, locks, and listener heartbeats - Object storage (S3, Azure Blob, GCS, or PVC-backed filesystem)
See docs/deployment.md for the full production deployment guide.
---
Quick Start
Screenshots
<details> <summary>Workspace overview with VCS integration, drift detection, and labels</summary>
</details>
<details> <summary>Run detail with plan output and VCS metadata</summary>
</details>
<details> <summary>Variables with sensitive masking and HCL support</summary>
</details>
<details> <summary>Agent pools with listener health monitoring</summary>
</details>
---
Configure OpenTofu (or Terraform)
```hcl
Comparison with Alternatives
| Project | What it does | Gap vs full TFE replacement |
|---|---|---|
| [OpenTofu](https://opentofu.org/) | Open-source Terraform fork (CLI) | CLI only -- no collaboration platform |
| [Atlantis](https://www.runatlantis.io/) | PR-based plan/apply automation | No UI, no state management, no registry, no RBAC |
| [Digger](https://digger.dev/) | CI-native Terraform orchestration | Runs inside CI; no standalone platform |
| [Terrateam](https://terrateam.io/) | GitHub-integrated TF automation | GitHub-coupled; limited community edition |
| [Spacelift](https://spacelift.io/) | Commercial TF management platform | Not open source |
Terrapod is the only open-source project that covers the full TFE surface: state management, agent execution, private registry, RBAC, VCS integration, drift detection, OPA policy enforcement, and a production-grade UI -- all in a single self-hosted Kubernetes deployment.
Terrapod is a single, self-hosted platform covering the full TFE surface (state + runs + registry + governance + UI + API) under a copyleft (GPLv3) license.
---
高质量的自动化部署工具
- 需要 terrapod 解决具体问题的开发者与运营人员
- 生产部署优先使用 Docker Compose 隔离依赖，并挂载 volume 持久化数据
- API key 直接提交到 git 仓库（请用 .env 并加入 .gitignore）
- 容器内无法访问宿主机 localhost — 使用 host.docker.internal
- Python 依赖冲突：建议用 venv / uv 隔离环境
- Docker：terrapod 提供官方镜像，docker compose up 一键启动
- 云端托管：可放在 Vercel / Railway / Fly.io 等 PaaS 平台
⚡ 核心功能
- 开源免费，支持本地部署，数据完全自主可控
- 活跃的 GitHub 开源社区，持续迭代更新
- 提供详细文档和使用示例，新手友好
- 支持自定义配置，灵活适配不同使用环境
- 可作为基础组件集成进现有技术栈或进行二次开发
- 需要 terrapod 解决具体问题的开发者与运营人员
- 生产部署优先使用 Docker Compose 隔离依赖，并挂载 volume 持久化数据
- API key 直接提交到 git 仓库（请用 .env 并加入 .gitignore）
- 容器内无法访问宿主机 localhost — 使用 host.docker.internal
- Python 依赖冲突：建议用 venv / uv 隔离环境
👥 适合人群
🎯 使用场景
- 本地部署运行，保护数据隐私，满足合规要求
- 自定义集成到现有系统，扩展技术栈能力
- 作为开源基础组件进行商业化二次开发
⚖️ 优点与不足
- +GPL-3.0 协议，可免费商用
- +完全开源免费，无授权费用
- +本地部署，数据完全自主可控
- +开发者社区支持，遇问题可查可问
- −安装和初始配置可能需要一定技术基础
- −功能完整性通常不如成熟商业产品
- −技术支持主要依赖开源社区，响应速度不稳定
AI Skill Hub 为第三方内容聚合平台，本页面信息基于公开数据整理，不对工具功能和质量作任何法律背书。
建议在沙箱或测试环境中充分验证后，再部署至生产环境，并做好必要的安全评估。
⚠️ GPL 3.0 — 强 Copyleft，衍生作品须开源，含专利保护条款，不可闭源使用。
🔗 相关工具推荐
❓ 常见问题 FAQ
总体来看，TerraPod 是一款质量良好的AI工具，在同类工具中具备一定竞争力。AI Skill Hub 将持续追踪其更新动态，建议收藏备用，结合自身场景选择合适时机引入使用。
| 原始名称 | terrapod |
| 原始描述 | 开源AI工具：Open-source Terraform Enterprise replacement。⭐219 · Python |
| Topics | aidevopsdockerfastapipython |
| GitHub | https://github.com/mattrobinsonsre/terrapod |
| License | GPL-3.0 |
| 语言 | Python |
收录时间：2026-06-01 · 更新时间：2026-06-02 · License：GPL-3.0 · AI Skill Hub 不对第三方内容的准确性作法律背书。