Your cluster is humming along in k3s, but the infrastructure code that built it feels like it belongs to another century. You change one variable, run a plan, and everything shakes. Enter OpenTofu k3s: the lean, open-source pair that gives you declarative infrastructure and Kubernetes simplicity without the noise.
OpenTofu provides Terraform-compatible infrastructure as code. k3s gives you a compact, production-grade Kubernetes that installs faster than your coffee brews. Together, they hit the sweet spot between control and velocity. You can version declarative configs for compute, storage, and the control plane, then apply them repeatedly with zero manual fuss.
Setting up OpenTofu k3s starts with aligning state and context. OpenTofu handles provisioning—nodes, networking, secrets—while k3s uses that foundation to run workloads with minimal overhead. In practice, you define your cluster specs in OpenTofu, let it talk to your cloud or edge provider through its providers, then bootstrap k3s onto those instances. The result is a repeatable, immutable environment that can scale or rebuild without surprise drift.
You win even bigger when you tie in identity management. Use your OIDC provider, such as Okta or AWS IAM roles, to bind users and service accounts across both layers. That means one permissions model end-to-end. No forgotten RBAC patching. No mystery keys floating in CI logs.
If you hit common pain points—state drift, orphaned resources, or inconsistent secrets—tighten your state backend (S3 with versioning helps) and run OpenTofu with explicit dependency ordering. For cluster credentials, rotate certificates automatically through your cloud KMS. Simplicity here pays off when your pager buzzes at 2 a.m.