Skip to content
OpenDepot logo OpenDepot logo

Self-hosted registry for OpenTofu & Terraform

A Kubernetes-native module and provider registry with no external database to manage. Kubernetes RBAC governs every write, self-healing controllers keep everything in sync, and SSO ships bundled via Dex — deployed from the same Helm chart, with no separate identity infrastructure to stand up.

Get Started  â†’ View on GitHub
No Database Self-Healing Multi-Cloud Storage Tamper-Resistant Kubernetes-Native OIDC SSO Fine-Grained Access Policies Trivy Scanning Pre-signed Redirects

Home

Why OpenDepot?

Managing Terraform and OpenTofu modules and providers often means operating a separate registry, authentication flow, storage layer, and security workflow. OpenDepot brings those concerns into the Kubernetes operating model you already use: it's free, open source, and Kubernetes-native, with vulnerability scanning, automatic version discovery, a comprehensive User Interface, and OIDC-based SSO included out of the box.

The server and UI is read-only by design, and Kubernetes RBAC remains the authorization layer for create, update, and delete operations. Deployment requires nothing beyond a Helm chart and a storage backend.

  •  OpenDepot Workshop

    Browse and search modules, providers, versions, READMEs, vulnerability findings, depot relationships, and download statistics from one interface. See the OpenDepot Workshop guide or walk through the UI, Dex SSO, and GroupBinding access control.

  •  Assembly Line

    Compose onboarded modules and providers into a validated, downloadable OpenTofu root module with the Assembly Line.

  •  Security Policies

    Define scan thresholds and finding exemptions for matched resources through OpenDepot Workshop Security Policies.

  •  OIDC Single Sign-On (SSO)

    First-class support for the OpenTofu login flow via the bundled Dex subchart. Connect any OIDC-compatible identity provider — GitHub, Entra ID, Okta, or static passwords — and let tofu login handle credential acquisition automatically.

  •  Automatic Discovery & Provider Mirroring

    The Depot controller discovers module releases and provider versions from their configured upstream registries. Use the Provider Network Mirror Protocol to install mirrored providers through OpenDepot while keeping canonical provider source addresses unchanged in module configurations and lockfiles.

  •  Security First

    OIDC is the preferred authentication path (via Dex and your upstream IdP), while the server stays read-only by design. Kubernetes RBAC authorizes create, update, and delete operations — no proprietary tokens, no user database, no extra identity store.

  •  No External Database

    Declarative controllers continuously reconcile toward desired state. Transient errors retry with exponential backoff. Applying the same manifest twice is a no-op.

  •  Multi-Cloud Storage

    S3, Azure Blob, Google Cloud Storage, and local filesystem — all supported out of the box with SDK-native authentication chains.

  •  Self-Healing & Tamper Resistance

    Declarative controllers continuously reconcile toward desired state and retry transient failures. For immutable versions, RBAC-protected checksums are verified on every reconciliation to detect artifact replacement.

  •  Built-In Vulnerability Scanning

    The Version controller runs Trivy automatically on every provider binary, provider source (go.mod), and module archive. Findings are stored on the Kubernetes resource and can optionally block promotion of critical or high severity artifacts.

  •  Zero-Egress Provider Downloads

    Enable pre-signed URL redirects so OpenTofu and Terraform fetch provider binaries directly from S3, GCS, or Azure Blob — no bandwidth through the server, no extra hops, no infrastructure bottleneck.

Tip

If you're already running Kubernetes, OpenDepot gives you automatic version discovery, built-in vulnerability scanning, and Kubernetes-native auth without adding a license fee or a new piece of infrastructure to operate.

Next Steps

  •  Install with Helm

    Deploy OpenDepot to your cluster in minutes.

  •  Local Quickstart

    Run a fully functional registry locally with kind — no cloud account needed.

  •  Architecture

    Understand how the four services interact and reconcile.

  •  Configuration

    Configure authentication, storage, TLS, scanning, and other deployment options.

  •  Guides

    GitOps, CI/CD, Depot, provider consumption, migration, and upgrade workflows.

  •  Reference

    APIs, version constraints, Helm values, and Kubernetes RBAC reference material.