feat(tofu): Add support for deploying via OpenTofu

Very simple initial config by introducing a new Deployment `tofu`.
Simply uses an initialized Workspace to apply.

Since this needs an extension to 4beta11 schema introduces a new version
4beta12.

Author: abergmeier

integration/testdata/deploy-opentofu/skaffold.yaml

@@ -0,0 +1,7 @@
+apiVersion: skaffold/v4beta12
+kind: Config
+metadata:
+   name: tofu-test
+deploy:
+  tofu:
+    workspace: workspace

integration/testdata/deploy-opentofu/workspace/dns.tf

@@ -0,0 +1,7 @@
+data "dns_a_record_set" "google" {
+  host = "google.com"
+}
+
+output "google_addrs" {
+  value = join(",", data.dns_a_record_set.google.addrs)
+}

integration/testdata/deploy-opentofu/workspace/provider.tf

@@ -0,0 +1,11 @@
+terraform {
+  required_providers {
+    dns = {
+      source = "hashicorp/dns"
+      version = "3.4.2"
+    }
+  }
+}
+
+provider "dns" {
+}

integration/tofu_test.go

@@ -0,0 +1,45 @@
+/*
+Copyright 2024 The Skaffold Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package integration
+
+import (
+	"os/exec"
+	"strings"
+	"testing"
+
+	"github.com/GoogleContainerTools/skaffold/v2/integration/skaffold"
+)
+
+func init() {
+	initCmd := exec.Command("tofu", "init")
+	initCmd.Dir = "testdata/deploy-opentofu"
+	initCmd.Run()
+}
+
+func TestTofuDeploy(t *testing.T) {
+	MarkIntegrationTest(t, CanRunWithoutGcp)
+
+	output := string(skaffold.Deploy().InDir("testdata/deploy-opentofu").RunOrFailOutput(t))
+
+	if !strings.Contains(output, "Apply complete!") {
+		t.Fatal("Unexpectedly apply did not complete. Output was:", output)
+	}
+
+	if !strings.Contains(output, "google_addrs =") {
+		t.Fatal("Output variable missing. Output was:", output)
+	}
+}

pkg/skaffold/deploy/tofu/cli.go

@@ -0,0 +1,60 @@
+/*
+Copyright 2024 The Skaffold Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tofu
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	deploy "github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/deploy/types"
+	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/instrumentation"
+	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/tofu"
+)
+
+// CLI holds parameters to run tofu.
+type CLI struct {
+	*tofu.CLI
+}
+
+type Config interface {
+	tofu.Config
+	deploy.Config
+}
+
+func NewCLI(cfg Config) CLI {
+	return CLI{
+		CLI: tofu.NewCLI(cfg),
+	}
+}
+
+// Apply runs `tofu apply` on a Workspace.
+func (c *CLI) Apply(ctx context.Context, out io.Writer) error {
+	ctx, endTrace := instrumentation.StartTrace(ctx, "Apply", map[string]string{
+		"AppliedBy": "tofu",
+	})
+	defer endTrace()
+
+	r, w := io.Pipe()
+	w.Close()
+	if err := c.Run(ctx, r, out, "apply", "-auto-approve"); err != nil {
+		endTrace(instrumentation.TraceEndError(err))
+		return fmt.Errorf("tofu apply: %w", err)
+	}
+
+	return nil
+}

pkg/skaffold/deploy/tofu/tofu.go

@@ -0,0 +1,158 @@
+/*
+Copyright 2024 The Skaffold Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tofu
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"github.com/segmentio/textio"
+	"go.opentelemetry.io/otel/trace"
+
+	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/access"
+	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/debug"
+	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/deploy/label"
+	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/graph"
+	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/instrumentation"
+	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/kubernetes/manifest"
+	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/log"
+	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/schema/latest"
+	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/status"
+	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/sync"
+)
+
+// Deployer deploys Workspaces using tofu CLI.
+type Deployer struct {
+	configName string
+
+	*latest.TofuDeploy
+
+	tofu CLI
+}
+
+// NewDeployer returns a new Deployer for a DeployConfig filled
+// with the needed configuration for `tofu apply`
+func NewDeployer(cfg Config, labeller *label.DefaultLabeller, d *latest.TofuDeploy, artifacts []*latest.Artifact, configName string) (*Deployer, error) {
+
+	if d.Workspace == "" {
+		return nil, fmt.Errorf("tofu needs Workspace to deploy from: %s", d.Workspace)
+	}
+
+	tofu := NewCLI(cfg)
+
+	return &Deployer{
+		configName: configName,
+		TofuDeploy: d,
+		tofu:       tofu,
+	}, nil
+}
+
+func (k *Deployer) ConfigName() string {
+	return k.configName
+}
+
+// GetAccessor not supported
+func (k *Deployer) GetAccessor() access.Accessor {
+	return &access.NoopAccessor{}
+}
+
+// GetDebugger not supported.
+func (k *Deployer) GetDebugger() debug.Debugger {
+	return &debug.NoopDebugger{}
+}
+
+// GetLogger not supported.
+func (k *Deployer) GetLogger() log.Logger {
+	return &log.NoopLogger{}
+}
+
+// GetStatusMonitor not supported.
+func (k *Deployer) GetStatusMonitor() status.Monitor {
+	return &status.NoopMonitor{}
+}
+
+// GetSyncer not supported.
+func (k *Deployer) GetSyncer() sync.Syncer {
+	return &sync.NoopSyncer{}
+}
+
+// RegisterLocalImages not implemented
+func (k *Deployer) RegisterLocalImages(images []graph.Artifact) {
+}
+
+// TrackBuildArtifacts not implemented
+func (k *Deployer) TrackBuildArtifacts(builds, deployedImages []graph.Artifact) {
+}
+
+// Deploy runs `tofu apply` on Workspaces
+func (k *Deployer) Deploy(ctx context.Context, out io.Writer, builds []graph.Artifact, manifestsByConfig manifest.ManifestListByConfig) error {
+
+	var (
+		childCtx context.Context
+		endTrace func(...trace.SpanEndOption)
+	)
+	instrumentation.AddAttributesToCurrentSpanFromContext(ctx, map[string]string{
+		"DeployerType": "tofu",
+	})
+
+	childCtx, endTrace = instrumentation.StartTrace(ctx, "Deploy_TofuApply")
+	if err := k.tofu.Apply(childCtx, textio.NewPrefixWriter(out, " - ")); err != nil {
+		endTrace(instrumentation.TraceEndError(err))
+		return err
+	}
+	endTrace()
+	return nil
+}
+
+// HasRunnableHooks not supported
+func (k *Deployer) HasRunnableHooks() bool {
+	return false
+}
+
+// PreDeployHooks not supported
+func (k *Deployer) PreDeployHooks(ctx context.Context, out io.Writer) error {
+	_, endTrace := instrumentation.StartTrace(ctx, "Deploy_PreHooks")
+	endTrace()
+	return nil
+}
+
+// PostDeployHooks not supported
+func (k *Deployer) PostDeployHooks(ctx context.Context, out io.Writer) error {
+	_, endTrace := instrumentation.StartTrace(ctx, "Deploy_PostHooks")
+	endTrace()
+	return nil
+}
+
+// Cleanup deletes what was deployed by calling Deploy.
+func (k *Deployer) Cleanup(ctx context.Context, out io.Writer, dryRun bool, manifestsByConfig manifest.ManifestListByConfig) error {
+
+	instrumentation.AddAttributesToCurrentSpanFromContext(ctx, map[string]string{
+		"DeployerType": "tofu",
+	})
+	if dryRun {
+		return nil
+	}
+	// TODO: Implement delete
+
+	return nil
+}
+
+// Dependencies lists all the files that describe what needs to be deployed.
+func (k *Deployer) Dependencies() ([]string, error) {
+	return []string{}, nil
+}

pkg/skaffold/runner/deployer.go

@@ -32,6 +32,7 @@ import (
 	kptV2 "github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/deploy/kpt"
 	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/deploy/kubectl"
 	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/deploy/label"
+	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/deploy/tofu"
 	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/kubernetes/manifest"
 	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/kubernetes/status"
 	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/output/log"
@@ -41,12 +42,20 @@ import (
 	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/util/stringslice"
 )
 
+var (
+	_ tofu.Config = (*deployerCtx)(nil)
+)
+
 // deployerCtx encapsulates a given skaffold run context along with additional deployer constructs.
 type deployerCtx struct {
 	*runcontext.RunContext
 	deploy latest.DeployConfig
 }
 
+func (d *deployerCtx) GetWorkspace() string {
+	return d.deploy.TofuDeploy.Workspace
+}
+
 func (d *deployerCtx) GetKubeContext() string {
 	// if the kubeContext is not overridden by CLI flag or env. variable then use the value provided in config.
 	if d.RunContext.IsDefaultKubeContext() && d.deploy.KubeContext != "" {
@@ -205,6 +214,14 @@ func GetDeployer(ctx context.Context, runCtx *runcontext.RunContext, labeller *l
 			}
 			deployers = append(deployers, deployer)
 		}
+		if d.TofuDeploy != nil {
+			deployer, err := tofu.NewDeployer(dCtx, labeller, d.TofuDeploy, runCtx.Artifacts(), configName)
+			if err != nil {
+				return nil, err
+			}
+
+			deployers = append(deployers, deployer)
+		}
 	}
 
 	if localDeploy && remoteDeploy {

pkg/skaffold/schema/latest/config.go

@@ -26,7 +26,7 @@ import (
 )
 
 // This config version is not yet released, it is SAFE TO MODIFY the structs in this file.
-const Version string = "skaffold/v4beta12"
+const Version string = "skaffold/v4beta13"
 
 // NewSkaffoldConfig creates a SkaffoldConfig
 func NewSkaffoldConfig() util.VersionedConfig {
@@ -903,6 +903,9 @@ type DeployType struct {
 
 	// CloudRunDeploy *alpha* deploys to Google Cloud Run using the Cloud Run v1 API.
 	CloudRunDeploy *CloudRunDeploy `yaml:"cloudrun,omitempty"`
+
+	// OpenTofu *alpha* uses a client side `tofu` to deploy workspaces.
+	TofuDeploy *TofuDeploy `yaml:"tofu,omitempty"`
 }
 
 // CloudRunDeploy *alpha* deploys the container to Google Cloud Run.
@@ -1081,6 +1084,12 @@ type HelmPackaged struct {
 	AppVersion string `yaml:"appVersion,omitempty"`
 }
 
+// TofuDeploy describes a OpenTofu Workspace be deployed.
+type TofuDeploy struct {
+	// It accepts environment variables via the go template syntax.
+	Workspace string `yaml:"workspace,omitempty" yamltags:"required" skaffold:"template"`
+}
+
 // LogsConfig configures how container logs are printed as a result of a deployment.
 type LogsConfig struct {
 	// Prefix defines the prefix shown on each log line. Valid values are