Home

Why OpenDepot?¶

Most self-hosted Terraform/OpenTofu registries ask you to run and maintain more than the registry itself — an external database, a separate identity provider, or both. OpenDepot is built to avoid that: it's free, open source, and Kubernetes-native, with vulnerability scanning, automatic version discovery, and OIDC-based SSO included out of the box.

The server is read-only by design, and Kubernetes RBAC remains the authorization layer for create, update, and delete operations. Deployment requires nothing beyond a Helm chart and a storage backend.

OIDC Single Sign-On (SSO)

First-class support for the OpenTofu login flow via the bundled Dex subchart. Connect any OIDC-compatible identity provider — GitHub, Entra ID, Okta, or static passwords — and let tofu login handle credential acquisition automatically.
Security First

OIDC is the preferred authentication path (via Dex and your upstream IdP), while the server stays read-only by design. Kubernetes RBAC authorizes create, update, and delete operations — no proprietary tokens, no user database, no extra identity store.
Self-Healing

Declarative controllers continuously reconcile toward desired state. Transient errors retry with exponential backoff. Applying the same manifest twice is a no-op.
No Database Required

The Kubernetes API is the datastore. No PostgreSQL, no Redis, no external dependencies — just a Helm chart and a storage backend.
Multi-Cloud Storage

S3, Azure Blob, Google Cloud Storage, and local filesystem — all supported out of the box with SDK-native authentication chains.
Automatic Version Discovery

The Depot controller queries the GitHub Releases API for modules and the HashiCorp Releases API for providers, resolves your version constraints, and creates resources automatically.
Tamper-Resistant Checksums

Checksums are written to Kubernetes status subresources (protected by RBAC) and verified on every reconciliation — not just at upload time.
Built-In Vulnerability Scanning

The Version controller runs Trivy automatically on every provider binary, provider source (go.mod), and module archive. Findings are stored on the Kubernetes resource and can optionally block promotion of critical or high severity artifacts.
Zero-Egress Provider Downloads

Enable pre-signed URL redirects so OpenTofu fetches provider binaries directly from S3, GCS, or Azure Blob — no bandwidth through the server, no extra hops, no infrastructure bottleneck.

How OpenDepot Compares¶

Feature	OpenDepot (OSS)	HCP Terraform Registry	JFrog Artifactory	GitLab Terraform Registry	Harbor / OCI Registry	Terrarium / Tapir / Hermit (OSS)
License	Apache 2.0 (Free, OSS)	Commercial SaaS/Enterprise	Commercial (Paid)	GitLab EE/CE (Mixed)	Apache 2.0 (OSS)	OSS (varies)
Auth	K8s RBAC + OIDC (Dex)	HCP tokens, SSO	Artifactory tokens, SSO	GitLab users	Registry users/OIDC	API keys, basic auth
Database Required	No (K8s API)	SaaS-managed/PostgreSQL	Yes (external DB)	Yes	Yes	Yes
Deployment	Helm chart, K8s-native	SaaS / Enterprise on-prem	Docker/K8s/VM	SaaS or self-hosted	Docker/K8s	Docker/K8s
Self-healing	Yes (controller loop)	Partial (SaaS-managed)	No	No	No	No
Multi-cloud Storage	S3, Azure, GCS, FS	SaaS-managed	S3, Azure, GCS	S3, GCS, Filesystem	S3, GCS, Azure, Filesystem	S3, GCS, Filesystem
Version Discovery	Automatic (GitHub/HC)	VCS-connected/manual	Manual upload/API	Manual/CI	Manual/CI	Manual upload
Immutability	Checksum every reconcile	At upload only	Repo-level flag	At upload only	At upload only	At upload only
Air-gapped Support	Yes (FS + PVC)	Enterprise only	Yes	Yes	Yes	Yes
Vuln Scanning	Built-in (Trivy)	No	Paid add-on (Xray)	No	No	No
Pre-signed URLs	Yes (S3, GCS, Azure)	No	Yes (CDN)	No	No	No
Provider Support	Yes	Yes	Yes	No	No	No (modules only)
`tofu login` Flow	Yes (Dex, `login.v1`)	Yes	Yes	No	No	No
Open Source	Yes	No	No	Partial	Yes	Yes

Tip

If you're already running Kubernetes, OpenDepot gives you automatic version discovery, built-in vulnerability scanning, and Kubernetes-native auth without adding a license fee or a new piece of infrastructure to operate.

How It Works¶

%%{init: {'flowchart': {'defaultRenderer': 'elk'}} }%%
graph TD
    CLI["OpenTofu / Terraform CLI"]

    Server["Server — Registry Protocol API\nService Discovery · List Versions\nDownload Redirect · GPG-signed SHA256SUMS"]

    Dex["Dex\nOIDC Identity Broker"]
    IdP["Upstream IdP\nGitHub · Entra ID · Okta"]

    Depot["Depot\nController"]
    SyncBus[" "]:::hidden
    Module["Module\nController"]
    Provider["Provider\nController"]
    Version["Version\nController"]

    Storage[("Storage Backend\nS3 · Azure · GCS · Filesystem")]

    GitHub["GitHub\nReleases API"]
    HashiCorp["HashiCorp\nReleases API"]

    CLI -->|"tofu login (authz / device code)"| Dex
    Dex -->|"federates auth"| IdP
    Server -.->|"JWKS fetch at startup"| Dex

    CLI -->|"HTTP requests (JWT bearer)"| Server
    Server -->|"reads Module + Provider"| Module & Provider

    Depot -->|queries| GitHub
    Depot -->|queries| HashiCorp
    Depot -->|creates / updates| SyncBus
    SyncBus --> Module
    SyncBus --> Provider

    Module -->|creates Version resources| Version
    Provider -->|creates Version resources| Version

    Version -->|fetches archives| GitHub
    Version -->|fetches binaries| HashiCorp
    Version -->|uploads to| Storage

    classDef hidden fill:none,stroke:none,color:transparent;

See Architecture for a detailed description of each controller and the full reconciliation event flow.

Next Steps¶

Install with Helm

Deploy OpenDepot to your cluster in minutes.
Local Quickstart

Run a fully functional registry locally with kind — no cloud account needed.
Architecture

Understand how the four services interact and reconcile.
Guides

GitOps, CI/CD, Depot, provider consumption, and migration workflows.

Self-hosted registry for OpenTofu & Terraform