Can ops0 work with brownfield infrastructure?

Yes. ops0 is designed to scan existing cloud accounts and help teams bring unmanaged resources under code safely.

Does ops0 force teams to replace their Git workflow?

No. ops0 connects generated IaC to GitHub or GitLab so teams can keep branches, pull requests, review, and history.

Do we have to codify our whole estate before ops0 is useful?

No. ops0 starts from live discovery of your brownfield estate and lets you codify the first reviewable fix from reality, then adopt gradually. There is no clean-room rewrite before you get value.

How does ops0 keep early IaC adoption safe?

Policy, cost, and approval apply from day one, and generated code opens as a pull request. Even your first codified change moves through review and evidence, not straight to production.

Where does ops0 get the code it generates during adoption?

The first fix is codified from reality: ops0 reads the live resource and generates IaC that reflects what is actually running, so the code matches production instead of a template you then have to reconcile. Teams can also import an existing GitHub repository, choose the branch and folder, and keep it in sync.

IaC Adoption

Turn unmanaged cloud into reviewed code.

Name: ops0
Author: ops0

Discover what exists, create the first reviewable code from reality, and move into policy, review, and deployment without waiting for a perfect greenfield reset.

No blank repo to start

First fix from live state

Policy and approval from day one

Git review, not a rewrite

ops0.ai/use-cases/iac-adoption

ops0 reviewed IaC: generated Terraform for a discovered resource with policy checks, cost change, and a plan summary before apply

Most estates were built by hand, one console click at a time. You can bring them under code without starting over.

Brownfield firstOne service at a timeReviewed pull requestsTerraform, OpenTofu, Oxid

The adoption journey

01 / 04 · Unmanaged

Start with what exists.

The estate is discovered as it is: services, databases, networks, none of it in code.

0/6

services under code

resource coverage

pull requests

Ask Kiwi

What should we bring under code next?

auth-svc is next. It sits in the request path for every other service and is still unmanaged. reporting-api is read-only, so it can wait. (0 of 25 resources covered so far.)

auth-svcshared by 4 servicesreporting-api: read-only

0%under code

Going deeper

From discovered to governed, one service at a time.

Start from reality

Adoption begins with what is already running.

Discovery-first beats writing code against guesses.

Works for brownfield infrastructure and undocumented estates.

Resources

248

discovered

Unmanaged

181

not in any state file

Engine

OpenTofu

selected target

First fix

ready to generate

Codify toTerraformOpenTofuOxid

Codify

Turn existing infrastructure into reviewable code.

Live resources are codified into Terraform, OpenTofu, or Oxid.

The first version reflects what is actually deployed.

main.tfGenerated

import {
  to = aws_db_instance.payments_ledger
  id = "rds-payments-ledger-prod"
}

resource "aws_db_instance" "payments_ledger" {
  publicly_accessible     = false
  deletion_protection     = true
  backup_retention_period = 14
}

→ Codified from discovered state, not a guess

Under the hood

No blank repo. Just the estate you already run.

Brownfield first

Start from what is running, not a template.

Discovered

rds-payments-ledger-prodRDSunmanaged

billing-serviceECSunmanaged

notifications-workerLambdaunmanaged

checkout-albALBin Terraform

248 resources discovered, 181 not yet in any state file. Adoption starts from that list, not a clean-room rewrite.

Codified

Generated from live state, not a guess.

resource "aws_db_instance" {
  publicly_accessible = false
}

Reviewed

Every step is a pull request.

PR #851in review

Git review is the handoff, not a rewrite to reconcile.

Move at your pace

No big-bang cutover.

3 of 12 services25%

One PR at a time. Cutover required: none.

Ask Kiwi

Describe it, get reviewed code back.

@ops0 codify the billing-service database

Generated from its live config and opened as PR #851. Policy and cost checks are attached.

Common questions

ops0 discovers existing resources first, then helps generate reviewable IaC that reflects live infrastructure instead of starting from blank templates. Engineers can also describe what they need to Kiwi and get reviewed code back.

Start from the estate.
End with reviewed code.

IaC adoption does not need a blank repository. The first reviewed pull request comes from the infrastructure you already run.

Explore IaC

Turn unmanaged cloud into reviewed code.

Start with what exists.

One service at a time.

Every step is a pull request.

Under code, no big-bang cutover.

From discovered to governed, one service at a time.

Adoption begins with what is already running.

Turn existing infrastructure into reviewable code.

Move at your own pace.

No blank repo. Just the estate you already run.

Common questions

Start from the estate.
End with reviewed code.

Turn unmanaged cloud into reviewed code.

Start with what exists.

From discovered to governed, one service at a time.

Adoption begins with what is already running.

No blank repo. Just the estate you already run.

Common questions

Start from the estate.End with reviewed code.

Start from the estate.
End with reviewed code.