Provision with Terraform, Configure with Ansible, Deploy with Argo CD

Run the full provision, configure, and deploy chain as one audited flow. This blueprint stitches Terraform infrastructure provisioning, Ansible host configuration, and an Argo CD application sync into a single Kestra execution, then verifies application health and reports the outcome to Slack. Each tool keeps doing what it does best while Kestra handles ordering, retries, secrets, and lineage across the whole pipeline. It is the GitOps end to end story without glue scripts or brittle CI YAML chained across three systems.

How it works

1. provision runs io.kestra.plugin.terraform.cli.TerraformCLI in a hashicorp/terraform:latest Docker container, executes terraform init and terraform apply -auto-approve against an inline main.tf, and authenticates to AWS using AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.
2. configure runs io.kestra.plugin.ansible.cli.AnsibleCLI on the Process runner, executing ansible-playbook -i inventory.ini site.yml against the freshly provisioned hosts.
3. deploy calls io.kestra.plugin.argocd.apps.Sync to sync the target Argo CD application at HEAD with prune: true.
4. verify calls io.kestra.plugin.argocd.apps.Status to confirm the application is healthy after the sync.
5. notify posts a summary to Slack via io.kestra.plugin.slack.notifications.SlackIncomingWebhook using the current execution.id.
6. A disabled Schedule trigger (0 10 * * 1-5) is provided for a weekday release cadence; enable or replace it with a webhook or Git push trigger.

What you get

• One execution that provisions, configures, deploys, and verifies.
• Fail fast behavior: a broken Terraform plan never reaches Ansible or Argo CD.
• Centralized secrets through Kestra's secret backend, no plaintext credentials in repos.
• Full execution lineage, logs, and outputs per task for audits and incident review.
• Slack notification with the Kestra execution ID for traceability.

Who it's for

• Platform and DevOps engineers running GitOps with Argo CD.
• SREs who need provision plus configure plus deploy as one auditable unit.
• Infrastructure teams replacing fragile multi tool CI pipelines with declarative orchestration.

Why orchestrate this with Kestra

Terraform, Ansible, and Argo CD each ship with their own runners, but none of them coordinate the other two. Argo CD will not wait for Terraform, Terraform will not call Ansible, and Ansible will not verify the deployment. Kestra fills that gap with event driven triggers (schedule, webhook, Git, Kafka), per task retries and timeouts, declarative YAML stored in Git, structured outputs passed between tasks, and a unified execution graph across all three tools. You get GitOps deployment plus infrastructure lifecycle plus configuration drift control in one place.

Prerequisites

• A Kestra instance with Docker available for the Terraform task and Ansible installed on the worker for the Process runner.
• An existing Argo CD application and a reachable Argo CD API endpoint.
• A Slack incoming webhook URL.

Secrets

• AWS_ACCESS_KEY_ID: AWS access key for the Terraform provider.
• AWS_SECRET_ACCESS_KEY: AWS secret key for the Terraform provider.
• ARGOCD_SERVER: Argo CD API endpoint (used via pluginDefaults).
• ARGOCD_TOKEN: Argo CD API token (used via pluginDefaults).
• SLACK_WEBHOOK_URL: Slack incoming webhook URL for the final notification.

Quick start

1. Add the five secrets above to your Kestra namespace.
2. Replace the stub main.tf, inventory.ini, and site.yml with your real Terraform module, inventory, and playbook.
3. Set application on the deploy and verify tasks to your Argo CD application name.
4. Enable the on_release schedule trigger or swap it for a webhook, Git, or Kafka trigger to fit your release process.
5. Run the flow once manually and review outputs on the provision, configure, deploy, and verify tasks.

How to extend

• Replace the inline Terraform with a Git clone step that pulls a real module repository.
• Add a manual approval step between configure and deploy for production environments.
• Branch on verify output to trigger a rollback (io.kestra.plugin.argocd.apps.Sync at a previous revision) when health checks fail.
• Fan out across multiple Argo CD applications using ForEach for multi service releases.
• Swap the AWS credentials for GCP or Azure provider variables to target a different cloud.

Links

• Plugin docs: https://kestra.io/plugins/plugin-terraform
• Orchestrate Terraform with Kestra: https://kestra.io/orchestration/terraform
• Orchestrate Ansible with Kestra: https://kestra.io/orchestration/ansible
• Orchestrate Argo CD with Kestra: https://kestra.io/orchestration/argocd