Drift checks · tfv · Marcus Chukwuoma

Drift checks run read-only plans on a schedule and tell your team when what's deployed no longer matches the code.

Set up a schedule

channels:                                # in repos.yaml; secrets stay in env vars
  infra-alerts: { type: slack, channel: "#infra-drift", token_env: TFV_SLACK_TOKEN }
  ops-teams:    { type: teams, webhook_url_env: TFV_TEAMS_WEBHOOK }
people:                                  # optional: git/GitHub → chat identity
  - { name: Bob Martins, github: bob-m, slack: U04BOBM, teams: bob@acme.onmicrosoft.com }

repos:
  - id: github.com/acme/infra
    drift:                               # or under `drift:` in the repo's tfv.yaml
      - name: prod-nightly
        projects: ["envs/prod", "live/prod/**"]
        branch: main
        schedule: "0 6 * * 1-5"
        timezone: Europe/Berlin
        notify: [infra-alerts, ops-teams]

Alerts go to Slack, Teams, Discord, Google Chat or any webhook. Keep tokens and webhook URLs in env vars and name them with token_env or webhook_url_env.

With Helm, put the same config under repos and load the tokens with extraEnvFrom:

repos:
  channels:
    infra-alerts: { type: slack, channel: "#infra-drift", token_env: TFV_SLACK_TOKEN }
  repos:
    - id: github.com/acme/infra
      drift:
        - { name: prod-nightly, projects: ["prod/**"], schedule: "0 6 * * 1-5", timezone: Europe/Berlin, notify: [infra-alerts] }
extraEnvFrom:
  - secretRef: { name: tfv-chat-tokens }   # holds TFV_SLACK_TOKEN

What a check reports

Each run checks the branch with read-only plans (-refresh-only -lock=false) and reports:

changes made outside Terraform;
changes that were merged but never applied.

Each drifted resource tags the last person who changed its code, found from the git history of its block, plus the last person who applied that project. Matching to chat users uses people, or Slack's lookup by email.

When it notifies

A message goes out only when the findings change. Set notify_when: always to send one every run. Failed checks always notify.

Turn all schedules off with TFV_DRIFT=false. Admins can also start a check from the dashboard or with POST /api/drift/run.