Deploying both K8s Application Manifets + Terraform at same time using GitOps

[kriegster108]

Is there any guidance on being able to have both application manifests & IAC to be deployed together at the same time?

For example:

I have a hello-world web-server that depends on an AWS service that can only be provisioned in terraform.

Can I use FluxCD for deploying my application manifests for hello-world into k8s + open tofu controller to deploy my IAC in terraform all in the same deployment?

We are debating right now on whether to keep infra deployment process separate from application deployments.. my gut says that if an application depends on specific infra, wouldnt it make sense to tie those together? Are there any patterns prescribed from flux to orchestrate this usecase?

Traditionally I've only ever seen IAC being deployed as it's own thing, and applications having a separate deployment process, with some coordination between the infra team / application team to roll out changes if there are dependencies between app + infra for a release.

[darrylweaver]

There are 2 parts you need to consider. Deploying the controller and CRDs. That needs to be a one off process that installs tofu-controller itself. Assuming that has already been done and you have the Terraform CRDs available, then you can bundle an application with it's Terraform resources in a single flux kustomisation or helm release alongside your other application components, such as an S3 bucket or RDS database, for example. When you deploy it, tf-controller will see the Terraform resources and deploy the S3 bucket to be used by the application. You might need to make sure you tune any health checks to wait long enough for the S3 bucket to be deployed and accessed by your app, but this should work.
I am not aware of any specific guidance or demo code anywhere. But I can validate the pattern, it does work and can be useful to dev teams to include resources in their k8s deployment patterns, such as S3 buckets or other AWS service definitions. There are of course many issues to take into account, such as naming and multiple environment deployments, population of service data in pre-prod environments and so on, but the pattern works. Just don't also try and include the controller and CRDs install in the same step. These do need to be entirely separate steps.