OpenDepot GitHub

Registry · Security · Assembly

Your registry. Your rules.

OpenDepot is a self-hosted, Kubernetes-native registry for OpenTofu and Terraform. Depots reconcile modules and providers, Security Policies gate what ships, and Assembly Line composes clean configurations from trusted versions.

Open source. Kubernetes-native. Ready for OpenTofu and Terraform.

The Depot control loop

From source change to ready-to-use infrastructure.

Depots pull from the sources you trust, reconcile what changed, and publish a verified registry that OpenTofu and Terraform can consume.

UPSTREAM SOURCES
GitHub Releases APIModule releases from public or private repositories
OpenTofuTerraformProvider registriesOpenTofu or Terraform binaries
POLL
DEPOT CONTROLLER Discover
and reconcile Constraints · polling · status POLLING UPSTREAM
CREATE
KUBERNETES RESOURCES
MODULE CONTROLLERGenerate UUIDs · Assign unique filenamesCreates Version resources for each module release
PROVIDER CONTROLLERGenerate UUIDs · Assign unique filenamesCreates Version resources for each provider release and platform
VERSION CONTROLLER Fetch · Scan · Checksum Validates checksums and blocks vulnerable packages before publishing.
STORAGE BACKEND
AWSAzureGoogle Cloud S3 · Azure · GCS · Filesystem Immutable, verified artifact content
CONSUME
OpenTofuTerraform OpenTofu / Terraform Requests modules and providers through the registry protocol.
SERVER Registry Protocol API Reads Kubernetes metadata and serves or redirects artifacts.
READ
Versions your teams can consumeAvailable to users with the right permissions through Dex-backed SSO or another OIDC provider.

Fine-grained scan policy

Waive one finding. Keep every other gate.

Global thresholds block everything or nothing. ScanPolicy sets severity and exact, expiring exemptions per namespace, module, provider, or version range, and the Registry Explorer lets the right people manage them.

  1. 01
    Target precisely

    Pin a policy to named Modules or Providers and a version constraint, or cover a group with a label selector.

  2. 02
    Highest priority wins

    Policies never merge. The winner applies in full, and every other match reports who superseded it.

  3. 03
    Exemptions expire

    Exempted findings stay visible on the Version. When an exemption expires, blocking resumes on its own.

  4. 04
    Scoped administration

    SecurityGroupBindings map OIDC groups to namespaces and resources. The server re-authorizes every preview, save, and delete, and fails closed.

scanpolicy.yaml 
kind: ScanPolicy
metadata:
  name: ecr-modules
  namespace: platform
spec:
  priority: 200
  severityThreshold: HIGH
  targetRefs:
  - kind: Module
    name: terraform-aws-ecr
    versions: ">= 1.0.0"
  exemptions:
  - reason: CMK handles encryption at rest
    vulnerabilityIDs: [aws-0057]
    expires: "2027-03-31T00:00:00Z"
Preview before saving. Conflicting edits never overwrite each other.

Assembly Line

Compose root modules from parts you already trust.

Wire module outputs to inputs on a visual canvas built from your onboarded, scanned versions. OpenDepot validates the result against your own registry and hands back clean OpenTofu.

Opt-in. OpenTofu providers only.
  1. 01Select

    Modules and OpenTofu providers pinned to exact versions with extracted contracts.

  2. 02Wire

    Connect variables and outputs to inputs, alias providers, and repeat modules with count or for_each.

  3. 03Validate

    The server re-authorizes every node and runs tofu init through OpenDepot's provider mirror. No public fallback.

  4. 04Export

    Download main.tf and variables.tf. No state, lock files, or credentials.

Choose your control plane

A registry that fits the way you build infrastructure.

OpenDepot brings registry distribution, resource-scoped security, and visual module composition into the Kubernetes operating model you already trust.

The platform suite

Artifactory

Authentication
SSO, API keys, or service accounts
Deployment
Self-managed platform deployment
Control plane
Repository and pipeline workflows
Storage
Filestore and configured object storage
Version discovery
Publish through repository clients and pipelines
Scanning
JFrog Xray or another integrated security product
Security Policies
Xray policies can gate repositories, builds, and projects
Assembly Line
No native visual module composition workflow
GitOps
CI/CD and API-driven
Air-gapped
Self-managed deployment can support isolated environments

The Kubernetes-native registry

OpenDepot

Authentication
Kubernetes tokens, kubeconfig, or OIDC
Deployment
Helm chart on any Kubernetes cluster
Control plane
Controllers continuously reconcile resources
Storage
S3, Azure Blob, GCS, or filesystem
Version discovery
Automatic GitHub and upstream release discovery
Scanning
Trivy scanning built into the sync flow
Security Policies
Scoped, expiring exemptions for exact resources and findings
Assembly Line
Visually compose trusted modules and export clean OpenTofu
GitOps
Native manifests for Argo CD or Flux
Air-gapped
Filesystem backend and PVC support

The hosted workflow

Terraform Cloud

Authentication
SSO, API tokens, or dynamic credentials
Deployment
HashiCorp-hosted service or HCP Terraform
Control plane
Workspace run workflows
Storage
HashiCorp-managed storage
Version discovery
Publish through VCS and workspace workflows
Scanning
Policy checks and integrations
Security Policies
Sentinel, OPA, and run-task policy workflows
Assembly Line
No equivalent visual, contract-aware module composer
GitOps
VCS-driven workspace runs
Air-gapped
Not designed for fully air-gapped operation