Terraform Cloud Agents vs. Spacelift Workers

In the realm of Infrastructure as Code (IaC), both Terraform Cloud agents and Spacelift private workers are instrumental. Understanding their functionalities, differences, and similarities is key to efficient infrastructure management. They accomplish the same functionality, helping you achieve a hybrid model by having a SaaS product and a worker that resides in your infrastructure.

1. What is a Terraform Cloud agent?
2. Using Terraform Cloud Agents
3. What is a Spacelift worker?
4. Using Spacelift workers
5. Terraform Cloud agents vs Spacelift workers comparison

Terraform Cloud Agents facilitate communication between Terraform Cloud and isolated, private, or on-premises infrastructure. Deployed within specific network segments, these agents enable provisioning operations and management, particularly useful for infrastructures like vSphere, and OpenStack, but not limited to these — you may have a use case in which you need an agent to communicate with your AWS infrastructure, and that can be easily achieved. Their pull-based architecture negates the need for inbound connectivity.

Terraform Cloud Agents on Terraform Cloud (TFC) vs Terraform Enterprise (TFE)

Terraform Cloud Agents on both TFC and TFE behave similarly, with a few exceptions. TFE has no limitations on agent count and offers support for custom Terraform bundles. Additionally, Terraform Enterprise has specific requirements for hostname registration and network access that Terraform Cloud does not.

To use a Terraform Cloud Agent, we have to first create an agent pool. To do that, go to your TFC account, select Settings → Agents, and then click on Create agent pool:

Select a name for your agent pool and click on Continue:

You will also need to create a token, so add a description to it and click on Create Token:

Copy the token, as you will only see it once, and refer to the instructions on how to create your agent:

You will need to save your token to an environment variable called TFC_AGENT_TOKEN on your Docker host and also add a name to your agent in the TFC_AGENT_NAME. Then you can run the docker command shown above.

After performing these steps, this is what you’ll see in your cli:

In the Terraform Cloud console, you will see your agent in the idle state:

Let’s assign this agent to a workspace. To do that, you will need to select one of your Terraform Cloud workspaces, go to Settings → General Settings and select the appropriate agent pool:

Now, let’s trigger a run on the workspace as we would normally do. The agent will receive the plan and do the run itself. It considers an init and a plan a single job:

And this is what you’ll see in the console:

After you confirm the run, you will see that a new job is triggered:

You will see the apply in the console that ran on the agent:

Spacelift workers are designed to execute Spacelift workflows. Anyone with a Spacelift account has access to a public worker pool that can be leveraged for all of the workflows, but if your security compliance requires the use of private infrastructure, Spacelift offers the ability to configure private workers that will leverage the user’s own infrastructure. These workers process one run at a time, ensuring maximum concurrency equals the number of workers. They can be hosted on virtual servers like AWS EC2 or containerized.

Asymmetric encryption is utilized to ensure that only workers within a specific worker pool can access any temporary run state. To facilitate this, you must generate a private key, which is then used to create a certificate signing request (CSR) for Spacelift. Spacelift will use this CSR to generate a certificate, enabling workers to authenticate with the Spacelift backend.

The process begins with running the following command to generate the key and CSR:

To create a private worker pool, we need to log in to our Spacelift account, go to Worker pools, and click on Create Worker Pools.

You need to specify a name for your worker pool, attach the csr file you have created before, and — if you want — add a description and some labels to the worker pool.

Clicking on Create will automatically download a file that contains your worker pool token. Keep it handy, as we will use it in an environment variable.

The most straightforward way to set up a worker is to download our amd or arm launchers (depending on your platform) and export the following variables:

For the launcher to work, the SPACELIFT_POOL_PRIVATE_KEY should be base64 encoded. Now we can start our worker:

If you go to your Spacelift console, you will now see that your worker pool has a worker inside it:

Let’s assign the worker pool to one of our stacks. To do that, you will need to go to your stack, select Settings, then go to Behavior and use the drop-down list for the Work Pool option:

Now, we are ready to run a job using our worker pool. As soon as a run is triggered, the worker picks it up and the information is visible inside the cli:

And this is what you will see in the console:

Similarities

Both Terraform Cloud Agents and Spacelift Private Workers are designed to manage isolated, private, or on-premises infrastructure. They enable Terraform operations within specific network segments, facilitating provisioning operations and management in protected environments. 

In addition, both systems encompass security – they use encryption and other secure methods to ensure that only authorized entities have access to manage the infrastructure. Both are built to work seamlessly with Terraform, allowing for efficient management of IaC. 

Differences

Since Terraform Cloud supports only Terraform, their agents are designed for their Terraform workflows. With Spacelift, however, private workers can be used to work with all the tools supported, such as Terraform, OpenTofu, Ansible, Kubernetes, CloudFormation, Terragrunt, and more.

Terraform Cloud agents support hooks only in two run types: plan and apply. You can run hooks before init and after plan or before init and after apply. Spacelift supports hooks in between all runner phases: Initialization, Planning, Applying, Destroying, Performing, and Finally.

With Spacelift, you can also see the queued runs on private workers, and you also enable the ability to prioritize runs:

While public workers are secure, both Terraform Cloud agents and Spacelift private workers are key to satisfying your organization’s rules and ensuring compliance. Both are designed to work with your infrastructure, use different encryption methods, and integrate seamlessly with Terraform (in Spacelift’s case, with other IaC tools as well).

Spacelift gives you the flexibility to set priorities inside your running queue and also enables you to control what happens before and after every runner phase for all the supported IaC tools.

If you are interested in a secure IaC management solution that offers all the flexibility your organization needs, create a free account with Spacelift or book a demo with one of our engineers.