The cache
Every run keeps an ordinary state file as a cache, and three rules govern it: it is never consulted for ownership; when it and the live system disagree, live wins; losing it costs a slower run and nothing else. Stale is the expected condition. The project is named after fermented tofu.
The file is a stock-format state file on purpose. Copy it into place, remove
the live block, and stock OpenTofu plans, converges and destroys with it.
A cache you may lose without cost is also a state file you may keep without
ceremony.
| Platform | What the state file is |
|---|---|
| AWS | choudoufu-cache.tfstate under the data dir. Never consulted for ownership; when it and the live system disagree, live wins; losing it costs a read. |
| Kubernetes | The same file and the same three rules. |
The two other per-platform answers that follow from the marker, the gate and the inventory command, are on each platform’s own pages; the table below is the same data.
| Platform | What fences a write |
|---|---|
| AWS | IAM conditions on aws:ResourceTag/tofu-estate and aws:RequestTag/tofu-estate. They fence reads and writes, per resource, and bind the credential rather than the binary. |
| Kubernetes | One ValidatingAdmissionPolicy (live/kubernetes/estate-boundary.yaml) whose CEL reads the label off oldObject and object and asks the authorizer whether the caller holds use on estates.choudoufu.intentius.io/<estate>; the grant is a ClusterRole. It fences create, update and delete only, never list or get, not subresources, and it is a cluster-wide object a cluster admin installs. Until it is installed the label is advisory. |
| Platform | How anyone lists an estate without the tool |
|---|---|
| AWS | aws resourcegroupstaggingapi get-resources --tag-filters Key=tofu-estate,Values=<estate> |
| Kubernetes | kubectl get <kind> -A -l tofu-estate=<estate>, one kind at a time; /apis lists every kind the cluster serves, CRDs included. |