HashiCorp Closes the Terraform-Ansible Gap With pyTFE and Collection 2.0

Terraform provisions infrastructure; Ansible configures what runs on it. In theory, they complement each other perfectly. In practice, integrating them has required custom API wrappers, brittle shell scripts, and a significant amount of glue code that no one wanted to maintain. HashiCorp just replaced that glue with official tooling.

What Happened

Three releases landed simultaneously. pyTFE 1.0 reaches general availability as the official Python SDK for HCP Terraform and Terraform Enterprise. It covers the full platform API surface — projects, workspaces, runs, tasks, teams, users, and state management — replacing the custom API clients that Python-based teams have been building and maintaining individually.

Terraform Ansible Collection 2.0 is built on top of pyTFE and provides an API-first way to manage Terraform workflows directly from Ansible playbooks. Teams can trigger workspace runs, manage variables, access outputs, and maintain role-based access controls — without needing to invoke the Terraform CLI or write custom API integration code. The design eliminates the common pattern of using ansible.builtin.command to shell out to Terraform.

The third piece is an experimental Dynamic Inventory Plugin (tfc_inv.py) that queries Terraform state from HCP Terraform and automatically generates Ansible inventory. Infrastructure provisioned by Terraform becomes directly consumable by Ansible without synchronization scripts or manual inventory files.

Why It Matters

The Day 0 / Day 1 / Day 2 problem is well-understood in platform engineering. Day 0 is provisioning — Terraform’s domain. Day 1 is initial configuration — historically where Ansible enters. Day 2 is ongoing operations: patching, credential rotation, compliance scanning. The gap between these phases has historically required custom automation to pass context from Terraform outputs into Ansible playbooks and vice versa.

Terraform’s MCP server GA earlier this year extended the same API surface toward AI agents. pyTFE 1.0 now extends it toward programmatic platform operations in Python — whether that’s human-authored Ansible playbooks or automated tooling. The underlying direction is consistent: Terraform as a platform API, not just a CLI workflow.

The Actions enhancement is operationally relevant for teams already using HCP Terraform. The new dedicated UI for discovering, invoking, and tracking actions — including Stacks lifecycle support — makes it practical to build automated responses to infrastructure events without dropping into the API directly.

The Pattern

Stack Archive has published five posts on Terraform and the HashiCorp platform in the last 90 days: Terraform 1.15 dynamic sources, OIDC dynamic credentials, MCP server GA, state drift detection, and the Vault workload identity federation post. Each release extends the platform’s automation surface. pyTFE + Collection 2.0 complete the picture for Python-native operations teams.

What This Means for Platform Engineers

Teams running Ansible alongside Terraform now have a supported, maintained path for integration that doesn’t accumulate its own technical debt. The Dynamic Inventory Plugin specifically addresses a workflow that’s been painful at scale: keeping Ansible’s view of the world synchronized with what Terraform has actually provisioned. With tfc_inv.py, the inventory is derived from Terraform state directly — eliminating the class of drift that comes from inventory files going stale.

For teams evaluating whether to adopt HCP Terraform or TFE in Python-heavy environments, pyTFE 1.0 GA removes a significant objection. The SDK covers 100% of the documented API, which means integrations built on it won’t hit coverage gaps as the platform evolves.

Source: HashiCorp Blog

Content created with AI assistance and reviewed for accuracy.