Terraform builds the stage, not the play
Infrastructure code should define durable boundaries without becoming the runtime operator for every changing thing.
Terraform can call an API, wait for a resource, write a value, and run a local command. That makes it tempting to use one apply as the universal control plane.
The result is often a state file that knows too much and a plan that tries to operate systems whose lifecycle no longer matches infrastructure review.
RS Platform draws the line at durable boundaries. Terraform builds the stage; runtime controllers perform the play.
Durable and dynamic state change at different speeds
Networks, KMS keys, IAM roles, security groups, instance profiles, storage envelopes, and budget alarms change through reviewed infrastructure plans. They define what the system is allowed to become.
Workload placement, peer membership, secret versions, node replacement, and failover change in response to users or failure. They need transactions, retries, fencing, health evidence, and idempotency on operational timescales.
Putting both categories in Terraform would not make the dynamic state declarative. It would make every runtime event impersonate an infrastructure release.
Give each controller a bounded object
The Talos provisioner may operate three named cluster slots. It can create a replacement using approved launch resources, verify membership, and repair one node while quorum is healthy. It cannot alter the gateway, IAM, networking, or the secret that gives the cluster its identity.
The console may decide which edge node owns a workload and coordinate a fenced evacuation. It cannot create arbitrary infrastructure.
Argo CD may reconcile workloads from Git. It does not provision the network underneath the cluster.
Each controller is powerful inside a small object model and useless outside it. That is a more reviewable boundary than one automation identity with permission to “make the platform match.”
State machines belong near evidence
Replacing a cluster node is not a create/destroy diff. The system should drain when possible, preserve etcd quorum, launch the approved slot, wait for Talos, Kubernetes, Cilium, and workloads, then record convergence. If quorum is lost, automation must stop and invoke recovery.
Edge evacuation is similar. It needs corroborated death, storage fencing, a durable saga, and acknowledgements from the participants.
These procedures consume live evidence and have unsafe intermediate states. Encoding them as explicit runtime state machines makes refusal a designed outcome.
Keep secrets out of infrastructure state
Terraform creates the encryption keys, access policies, and parameter namespaces. A separate operator path writes secret values without command-line arguments, environment variables, logs, Git, or Terraform state.
Owning the container for a value is not the same as owning the value.
Declarative systems still need jurisdiction
The useful question is not whether a tool is declarative. It is which facts that tool has authority to declare.
Once jurisdiction is explicit, infrastructure plans become smaller, runtime automation becomes safer, and recovery stops depending on a single tool being clever enough to operate every layer.