Skip to content

ADR-0003: OpenTofu and Ansible responsibility split

Date: 2026-08-29 Status: Accepted

Context

Proxmox resources and Ubuntu configuration have different lifecycles. Using one tool for both would either weaken infrastructure state management or rely on fragile remote provisioners.

Decision

  • OpenTofu owns Proxmox resources through its HTTPS API.
  • cloud-init owns only the first-boot identity, network, and SSH bootstrap.
  • Ansible owns the Ubuntu baseline, NAT gateway, and RKE2 configuration.
  • Argo CD owns Kubernetes add-ons and workloads after the cluster exists.
  • SSH access to Proxmox hypervisors is not required for the selected resource operations.

Consequences

  • OpenTofu plans and records virtual infrastructure lifecycle.
  • Ansible can repeatedly converge guest configuration without changing VM identity or placement.
  • No secrets are embedded in HCL or committed inventory.
  • Disaster recovery can reconstruct both infrastructure and guest state from separate, explicit sources of truth.