Terraform, Kubernetes, vCenter and Proxmox — one governed workflow
Most orchestration platforms assume everything you run is in a public cloud. Realm9 treats the racks you already own as first-class infrastructure, with the same policy, state and audit model.
The on-prem estate nobody else covers properly
vCenter, Proxmox, site-to-site VPN, CIS benchmark scanning and Zabbix integration. If a meaningful share of your infrastructure lives in your own building, this is the difference between a tool that fits and one that does not.
- Provision and reclaim VMs on vCenter and Proxmox from the same catalogue
- CIS benchmark scanning with exportable evidence
- Site-to-site VPN and private connectivity for hybrid estates
- Monitoring integration so bookings and alerts share one view
| Provider | Status | Managed | Last sync |
|---|---|---|---|
| aws/prod | 🟢 Connected | 412 | 14s ago |
| azure/eu | 🟢 Connected | 88 | 22s ago |
| gcp/analytics | 🟢 Connected | 31 | 18s ago |
| vcenter/ldn-1 | 🟢 Connected | 240 | 9s ago |
| proxmox/build | 🟢 Connected | 96 | 11s ago |
| baremetal/gpu | 🟢 Connected | 32 | 30s ago |
Projects, workspaces and runs, connected to Git
Each project points at a repository, branch and path in Git. Workspaces hold the variables for each deployment, and every plan, apply, destroy or refresh is recorded as a run with its logs and plan summary.
- Runs started manually, through the API, or from repository webhooks
- Each run executes as an isolated Kubernetes job with its own streamed logs
- Remote state with locking so two runs cannot change the same workspace at once
- Templates expose selected variables as simple forms, so teams can create workspaces without editing code
Policy checks with the enforcement level you set
Attach a policy profile to a project to scan each run for misconfiguration, exposed secrets, vulnerabilities and cost. You decide whether findings are advisory or whether they block the run.
- Scanners include Checkov, Trivy, TruffleHog, Infracost and OPA, plus your own scanner image
- Advisory, soft-mandatory and hard-mandatory enforcement modes
- Block thresholds and exclusions tuned per profile
- Policy results reviewed on the run, and overrides recorded in the audit log
Approval gates for changes that matter
Projects can require approval before apply. Named approvers and a minimum approval count keep production changes with the people responsible for them.
- Approve or reject from the run page, with notes kept on the run
- Approver lists and minimum approvals configured per project
- Role-based permissions separate viewing, running and managing Terraform
- Run creation, approvals and overrides captured in the Terraform audit trail
Know when code, permissions and reality diverge
When a repository changes, Realm9 re-analyses the project and raises drift alerts — new or removed resources, changed variables or modules, and permission gaps in the cloud role used to deploy.
- Drift alerts graded by severity, with acknowledge, ignore and resolve actions
- Missing and excess cloud-role permissions identified for each project
- Runs blocked while a project has unresolved drift or pending variables
- Credentials kept in AWS Secrets Manager, Azure Key Vault or HashiCorp Vault
| Workspace | Diverged | Since | Severity |
|---|---|---|---|
| production-network | 2 | 09-11 | 🟠 Medium |
| payments-prod | 0 | — | 🟢 Clean |
| data-lake | 5 | 09-08 | 🔴 High |
Changed out of band. Run blocked until drift is resolved.
The Realm9 edge
Infrastructure Management is a governed Terraform/IaC orchestration layer built for hybrid estates. Here is where it goes further than the leading dedicated IaC platforms.
| Capability | Realm9 | Spacelift | env0 | HCP Terraform |
|---|---|---|---|---|
| Native vCenter & Proxmox providers | First-class, alongside AWS, Azure and GCP | On-prem only via self-hosted workers | Only via custom Terraform providers | Cloud-focused, community providers only |
| Security & cost scanning built in | Checkov, TruffleHog, Trivy and Infracost, all native | External scanners need custom integration | Requires separate add-ons | Cost built in, security needs 3rd-party |
| Configurable enforcement per profile | Advisory, soft- or hard-mandatory, per profile | Stage-based, not level-based | Guardrails, less granular tuning | Policy sets gated by workspace |
| Drift + permission-gap analysis | Severity-graded, permission gaps flagged automatically | Scheduled, not continuous | No permission-gap analysis | Limited to Enterprise plans |
| One governed workflow | Shared project/workspace/run model across Realm9 | Each tool runs its own workflow | Per-tool workflows, no shared model | No shared governance layer |
Competitor capabilities summarized from public product docs; subject to change.
Put a review step between Terraform plan and apply
Infrastructure Management shares users, approvals and audit with the rest of Realm9, so infrastructure changes and the environments they serve are governed together.