Many teams use Terraform to provision AWS and then keep going: Helm charts, namespaces, add-ons, even application manifests inside EKS.
That looks efficient. It is actually the fastest way to blur the boundary between infrastructure and platform.
The better model is less convenient at first:
- application repo for source code and builds;
- ops repo for Terraform and GitOps manifests;
- Terraform limited to AWS and the EKS perimeter;
- ArgoCD responsible for everything inside the cluster.
The real issue is lifecycle mismatch. VPCs, IAM roles, and node groups change slowly. Kubernetes manifests, platform add-ons, and image tags change constantly. Forcing both layers through Terraform turns infrastructure provisioning into a release engine.
That is where things break:
- application deploys inherit infrastructure risk;
- rollback becomes heavier than it should be;
- Terraform and ArgoCD can end up fighting over the same cluster state;
- CI pipelines need cluster credentials they should never have.
I wrote the full breakdown here, with repository structure, Terraform examples, ArgoCD manifests, and the exact deployment flow:
Top comments (0)