Valerio Uberti

Many teams use Terraform to provision AWS and then keep going: Helm charts, namespaces, add-ons, even application manifests inside EKS.

That looks efficient. It is actually the fastest way to blur the boundary between infrastructure and platform.

The better model is less convenient at first:

  • application repo for source code and builds;
  • ops repo for Terraform and GitOps manifests;
  • Terraform limited to AWS and the EKS perimeter;
  • ArgoCD responsible for everything inside the cluster.

The real issue is lifecycle mismatch. VPCs, IAM roles, and node groups change slowly. Kubernetes manifests, platform add-ons, and image tags change constantly. Forcing both layers through Terraform turns infrastructure provisioning into a release engine.

That is where things break:

  • application deploys inherit infrastructure risk;
  • rollback becomes heavier than it should be;
  • Terraform and ArgoCD can end up fighting over the same cluster state;
  • CI pipelines need cluster credentials they should never have.

I wrote the full breakdown here, with repository structure, Terraform examples, ArgoCD manifests, and the exact deployment flow:

👉 Read the full article