Ship infrastructure
with guardrails intact.
Plans, policy checks, cost estimation, approval, apply, drift, and deployment telemetry belong in one governed workflow, not across separate tools and laptop scripts.
EKS worker-node update with one add, two changes, no destroys, and budget review required before apply.
Every change takes the same guarded route.
ops0 does not let infrastructure jump straight from request to apply. Every deployment moves through plan, policy, cost, approval, and apply in a fixed sequence.
- Structured output streamed at every stage
- Add, change, and destroy counts captured before execution
- Targeted deploys supported without bypassing the workflow
Risk and spend are visible before anyone approves.
Deployments are evaluated for compliance and monthly cost before they can move forward. Bad changes get blocked earlier, and expensive ones stop before they surprise a team later.
- OPA/Rego checks classify warnings and blocking violations
- Infracost or OCI estimators show resource-level impact
- Budget rules support warn or hard-block modes
Human review stays in the loop.
ops0 is built for governed change, not silent automation. Production-impacting or high-cost deploys pause for approval, with clear context about what changed and why review is required.
- Approval required by policy, environment, or budget threshold
- Authorized approvers, expiry, and instructions are configurable
- Nothing reaches production without explicit signoff
Code and reality stop drifting apart in silence.
Manual console changes happen. Drift detection compares live infrastructure against Terraform state, surfaces severity, and gives teams a path to reconcile what changed.
- Scheduled scans catch drift between deploys
- Before and after values make changes easier to understand
- Useful for review, reconciliation, or bringing code back in sync
Git stays part of the audit trail, not a separate ritual.
Push generated code to GitHub or GitLab, attach deployment plans to review, and connect every apply back to the commit, pull request, and approver behind it.
- GitHub and GitLab both supported
- Auto-generated PRs and MRs include deployment context
- Useful for teams that want Git as the review surface without losing platform control
A deployment is more than apply complete.
Every deployment event is forwarded as structured telemetry so infrastructure changes show up in the same observability system as the rest of the stack.
- Plan, policy, approval, apply, and cancel events captured
- Durations tracked for plan, approval wait, and apply
- OpenObserve integration turns deploy history into something teams can actually analyze
The same policy engine
keeps running after deploy.
Once the change ships, the next surface is compliance: state-based scans, drift audits, executive dashboards, and shareable evidence from the same rule engine.
