Can ops0 work with brownfield infrastructure?

Yes. ops0 is designed to scan existing cloud accounts and help teams bring unmanaged resources under code safely.

Does ops0 force teams to replace their Git workflow?

No. ops0 connects generated IaC to GitHub or GitLab so teams can keep branches, pull requests, review, and history.

Do we have to codify our whole estate before ops0 is useful?

No. ops0 starts from live discovery of your brownfield estate and lets you codify the first reviewable fix from reality, then adopt gradually. There is no clean-room rewrite before you get value.

How does ops0 keep early IaC adoption safe?

Policy, cost, and approval apply from day one, and generated code opens as a pull request. Even your first codified change moves through review and evidence, not straight to production.

Where does ops0 get the code it generates during adoption?

The first fix is codified from reality: ops0 reads the live resource and generates IaC that reflects what is actually running, so the code matches production instead of a template you then have to reconcile.

IaC Adoption

Turn unmanaged cloud into reviewed fixes.

Name: ops0
Author: ops0

Discover what exists, create the first reviewable fix from reality, and move into policy, review, and deployment without waiting for a perfect greenfield reset.

No blank repo to start

First fix from live state

Policy and approval from day one

Git review, not a rewrite

ops0.ai/use-cases/iac-adoption

ops0 reviewed IaC: generated Terraform for a discovered resource with policy checks, cost change, and a plan summary before apply

How it works

The adoption journey, start to handoff.

Discover the estate

Start from live cloud, not a blank repository. Every resource already running is the starting point.

Codify the first fix

The first version reflects what is actually deployed, not a guess written against documentation.

Add policy, cost, approval

Policy checks, cost estimates, and required approval are present from day one, not bolted on later.

Hand off as a PR

Git review is the handoff. The generated code opens as a pull request, not a rewrite to reconcile.

Resources

248

discovered

Unmanaged

181

not in any state file

Engine

OpenTofu

selected target

First fix

ready to generate

Codify toTerraformOpenTofuOxid

Start from reality

Adoption begins with what is already running.

Discovery-first beats writing code against guesses.

Works for brownfield infrastructure and undocumented estates.

Teams adopt gradually, with no clean-room rewrite required.

main.tfGenerated

import {
  to = aws_db_instance.payments_ledger
  id = "rds-payments-ledger-prod"
}

resource "aws_db_instance" "payments_ledger" {
  publicly_accessible     = false
  deletion_protection     = true
  backup_retention_period = 14
}

→ Codified from discovered state, not a guess

Codify

Turn existing infrastructure into reviewable code.

Live resources are codified into Terraform, OpenTofu, or Oxid.

The first version reflects what is actually deployed.

Policy and cost estimates are present from the start, not added later.

Rollout progressPhased

payments-ledgerPR #842 mergedGoverned

billing-servicePR #851 openIn review

notificationsPR #856 draftCodified

reporting-apiStill unmanagedNot started

Services under code

3 of 12

Cadence

One PR at a time

Cutover required

None

Phased rollout

Move at your own pace.

Bring services under code one at a time, not all at once.

Each step is a reviewed pull request, not a bulk migration.

The estate becomes governed without a big-bang cutover.

Common questions

ops0 discovers existing resources first, then helps generate reviewable IaC that reflects live infrastructure instead of starting from blank templates.

Start from the estate.
End with governed code.

IaC adoption does not need a blank repository. The first reviewed fix comes from the infrastructure you already run.

Explore IaC