Coding
devops ai
iac ai
kubernetes ai

Infrastructure Automation

AI-driven Terraform, Ansible, Kubernetes manifest generation. Specialized + tool-use heavy.

Capability notes

AI infrastructure automation in 2026 covers Terraform module generation, Ansible playbook authoring, Dockerfile and docker-compose construction, Kubernetes manifest creation, and CI/CD pipeline (GitHub Actions, GitLab CI, Jenkins) debugging. [DeepSeek V4](/models/deepseek-v4) and [Llama 3.3 70B](/models/llama-3-3-70b) can generate valid Terraform for common patterns (VPC + subnets + EC2 + RDS, EKS cluster with node groups) with 70-80% first-pass correctness — meaning the `terraform plan` passes but may require minor fixups (provider version constraints, IAM policy ARN formatting). Infrastructure-as-code (IaC) generation is harder than application-code generation for three reasons: (1) **Provider API drift** — AWS/Azure/GCP APIs change faster than training data cutoff; a Terraform resource argument valid in January 2025 may be deprecated by June 2025. The model generates stale arguments that plan/apply rejects. (2) **State dependency blindness** — the model generates a resource referencing a Terraform output from another module without knowing whether that module exists or outputs that variable. (3) **Security-critical surface** — an incorrect IAM policy or security group rule is not a "bug" that fails a test; it's a silently deployed vulnerability. [Qwen 3 235B-A22B](/models/qwen-3-235b-a22b) MoE leads on Kubernetes manifest generation and multi-service Docker Compose orchestration. [DeepSeek Coder V3](/models/deepseek-coder-v3) performs well on CI/CD pipeline YAML (GitHub Actions workflows) given its code-generation optimization. A critical operational insight: AI IaC generation works best when the target is a **known pattern** — a standard three-tier web app, a typical data pipeline, a common microservice deployment. For novel architectures (multi-cloud DR with cross-region replication and custom networking), AI accuracy drops to 30-50% because the pattern isn't in training data.

If you just want to try this

Lowest-friction path to a working setup.

Start with [Ollama](/tools/ollama) running [Llama 3.3 70B](/models/llama-3-3-70b) for Terraform and Docker Compose generation. Describe your infrastructure in natural language and get valid HCL/YAML back: ```bash ollama pull llama3.3:70b ollama run llama3.3:70b "Generate a Terraform configuration for: AWS us-east-1, VPC with public/private subnets across 2 AZs, an ECS Fargate cluster, an RDS PostgreSQL instance in private subnets, and necessary security groups. Use terraform-aws-modules where appropriate." ``` Paste the output into `main.tf`, run `terraform init && terraform plan`. Expect plan errors — the model often uses deprecated argument names or wrong provider version constraints. Iterate: feed the `terraform plan` error output back to the model and ask for corrections. Usually 2-3 iterations produce a passing plan. For Docker: "Generate a Dockerfile for a Python 3.12 FastAPI app with PostgreSQL dependency, using multi-stage builds to minimize image size. Include health check." For CI/CD: "Generate a GitHub Actions workflow that runs lint, type-check, and tests on PR, builds a Docker image on merge to main, and pushes to ECR." Always validate generated IaC with: `terraform validate`, `docker build --dry-run` (or review), `ansible-playbook --syntax-check`, `yamllint`. Never apply AI-generated IaC without validation — the security blast radius from a misconfigured security group or IAM policy is enormous. Hardware: 24GB+ VRAM for 70B Q4 on [RTX 4090](/hardware/rtx-4090) or [RTX 3090](/hardware/rtx-3090). [MacBook Pro 16" M4 Max](/hardware/macbook-pro-16-m4-max) 64GB runs 70B Q4 on SoC at 20-30 tok/s. If you don't have the hardware, cloud APIs (OpenRouter with [DeepSeek V3](/models/deepseek-v3)) cost $0.01-0.05 per Terraform generation — negligible for the value.

For production deployment

Operator-grade recommendation.

Production AI IaC operates as a pipeline: specification → generation → validation → human review → apply. **Specification format.** Input is structured, not free-form. A TOML/YAML spec describes: provider, region, resources with typed arguments, constraints (cost, availability, compliance). The model generates IaC from spec, not from natural language, because spec eliminates ambiguity that causes generation drift. Example: `vpc.cidr = "10.0.0.0/16"` generates consistent output; "a VPC with room for growth" generates different CIDRs on each run. **Validation layer.** Before a human sees generated IaC: (1) HCL/YAML syntax validation (`terraform validate`, `yamllint`), (2) policy-as-code check (Open Policy Agent rules: "no security group with 0.0.0.0/0 ingress on port 22," "all S3 buckets must have encryption enabled"), (3) cost estimation (Infracost) to flag unexpectedly expensive resources (an `r5.24xlarge` instead of `t3.medium`), (4) diff against existing infrastructure state to catch destructive changes. Only after passing all four gates does the IaC reach human review. **Model routing by complexity.** Simple patterns (single EC2 + RDS, basic ECS service): [Qwen 3 32B](/models/qwen-3-32b) via [vLLM](/tools/vllm) — 2-5 second generation, 85-90% first-pass correctness. Medium patterns (EKS cluster, multi-region VPC peering, CI/CD pipeline with deployment gates): [Llama 3.3 70B](/models/llama-3-3-70b) — 5-10 second generation, 75-85% correctness. Complex patterns (multi-cloud DR, service mesh with mTLS, zero-trust networking): [DeepSeek V4](/models/deepseek-v4) — 10-25 second generation, 60-75% correctness. Route by spec complexity (resource count, provider count, and custom module references). **Iterative correction loop.** `terraform plan` failures feed back to model with the error + relevant resource block — not the full plan output. The model fixes the specific resource and regenerates only the affected block. Average iterations to passing plan: 1.5 for simple, 3 for medium, 5+ for complex. Auto-cap at 5 iterations; escalate to human if plan still fails. **CI/CD pipeline integration.** A GitHub Actions workflow triggered by `/generate-iac` PR comment: spec parser → model inference → validation → human review comment (not direct commit). The workflow never commits or applies — it posts generated IaC as a PR comment. A human merges (or not). This preserves the principle that IaC changes are always human-gated.

What breaks

Failure modes operators see in the wild.

- **Deprecated resource arguments.** Symptom: "terraform plan" fails with "argument X is deprecated, use Y instead." Cause: provider API changes outpace model training cutoffs. AWS introduces 50-100 new or changed Terraform arguments per quarter. Mitigation: inject current provider schema into prompt via "terraform providers schema -json"; maintain a deprecation map that flags known-stale arguments before generation. - **Overly permissive IAM / security groups.** Symptom: model generates an IAM policy with wildcard Action and Resource, or a security group with 0.0.0.0/0 ingress on all ports. The Terraform is valid; the security posture is catastrophic. Cause: training data includes examples from tutorials that prioritize "working" over "secure." Mitigation: OPA policy gate blocks permissive patterns; run tfsec or checkov as automated validation. - **Hardcoded secrets in generated config.** Symptom: model embeds placeholder passwords or generates secret values inline in Terraform that get committed to git. Cause: training data includes examples with placeholder secrets. Mitigation: scan generated IaC for secret patterns (regex for password, secret, key, token); reject or redact before display; enforce all secrets to use sensitive variables or Secrets Manager references. - **State file blindness.** Symptom: generated Terraform references a remote state data source for a module the organization does not have, or duplicates resources already managed by another state. Plan fails or creates duplicate resources. Mitigation: inject "terraform state list" output as context; warn if generated resources already exist in state. - **Cross-module reference hallucination.** Symptom: generated Terraform references a module output like module.vpc.vpc_id that does not exist because the model invented a module it did not generate. Mitigation: post-generation static analysis of all module references — verify each referenced module exists in the output; strip unresolved references and flag for human completion.

Hardware guidance

**Hobbyist ($300-$1,500).** [RTX 3060 12GB](/hardware/rtx-3060-12gb) runs [Qwen 3 32B](/models/qwen-3-32b) Q4 for simple IaC generation (single resource, Dockerfile, CI pipeline YAML) at 5-10 seconds per generation. [RTX 4060 Ti 16GB](/hardware/rtx-4060-ti-16gb) handles 32B at Q5 with headroom. [MacBook Pro 16" M4 Max](/hardware/macbook-pro-16-m4-max) 64GB runs [Llama 3.3 70B](/models/llama-3-3-70b) Q4 on SoC at 20-30 tok/s for medium-complexity IaC. **SMB ($2,000-$4,000).** [RTX 4090](/hardware/rtx-4090) 24GB runs [Llama 3.3 70B](/models/llama-3-3-70b) Q4 at 25-35 tok/s — handles multi-resource Terraform and complex Docker Compose in 5-15 seconds. [RTX 5090](/hardware/rtx-5090) 32GB runs 70B Q4 fully in VRAM at 40-55 tok/s with 16K context — adequate for complete microservice IaC bundles. **Team serving ($6,000-$15,000).** [NVIDIA L40S](/hardware/nvidia-l40s) 48GB or [RTX 6000 Ada](/hardware/rtx-6000-ada) 48GB serves a DevOps team of 10-30 via [vLLM](/tools/vllm). Runs [Llama 3.3 70B](/models/llama-3-3-70b) FP8 at 80-100 tok/s with 32K context — enough for full EKS cluster + service mesh generation. 48GB supports concurrent IaC generation for multiple team members via continuous batching. **Enterprise ($25,000+).** [NVIDIA H100 PCIe](/hardware/nvidia-h100-pcie) 80GB runs [DeepSeek V4](/models/deepseek-v4) for multi-cloud, multi-region architecture generation. 64K+ context needed for large architectures with 100+ resources. [NVIDIA H200](/hardware/nvidia-h200) 141GB fits DeepSeek V4 at FP8 with 128K context — capable of generating entire landing zone IaC (networking, security, compute, storage, monitoring) in a single generation. IaC generation is bursty (triggered by architecture design sessions, not continuous). GPU utilization averages 5-15% — the hardware is idle 85-95% of the time. Best deployed on shared infrastructure (CI/CD runner GPU) rather than dedicated hardware. Cost-justify by cycle-time reduction, not GPU utilization.

Runtime guidance

**If generating Terraform** → [Ollama](/tools/ollama) with [Llama 3.3 70B](/models/llama-3-3-70b) for ad-hoc generation. Production: [vLLM](/tools/vllm) with structured output (JSON mode) — the model outputs a JSON with `resource_type`, `resource_name`, `arguments` keys that a post-processor renders into HCL. This is more reliable than free-form HCL generation because it avoids syntax errors from unbalanced braces. **If generating Ansible playbooks** → [Qwen 3 32B](/models/qwen-3-32b) via [Ollama](/tools/ollama). Ansible YAML is less syntax-demanding than HCL — free-form generation works. Include the target OS and Ansible version in the prompt. Always pipe output through `ansible-playbook --syntax-check` before running. **If generating Kubernetes manifests** → [DeepSeek V4](/models/deepseek-v4) via [vLLM](/tools/vllm) with YAML-structured output. K8s manifests have deep nesting and strict API versioning — the model must know the exact `apiVersion` for each resource. Inject `kubectl api-resources` output into context. **If generating Dockerfiles** → [Qwen 3 32B](/models/qwen-3-32b) via local [Ollama](/tools/ollama). Dockerfile generation is the highest-accuracy IaC task — 90% first-pass correctness because Dockerfiles are short, well-structured, and abundantly represented in training data. Multi-stage builds with specific base image tags: include "use python:3.12-slim as base" for reproducibility. **If generating CI/CD pipelines** → [DeepSeek Coder V3](/models/deepseek-coder-v3) via [vLLM](/tools/vllm). CI YAML (GitHub Actions, GitLab CI) is code-like — the coding model outperforms general models. Inject the CI platform name + available runners + secret names (not values) as context. **If integrating IaC generation into developer workflow** → [Cline](/tools/cline) with [Llama 3.3 70B](/models/llama-3-3-70b). Prompt: "Generate Terraform for [specification]. Validate with terraform plan. Fix errors iteratively until plan passes." Cline's agentic loop handles the generation → validation → fix cycle automatically. **If using AI for CI/CD debugging** → [Aider](/tools/aider) with [DeepSeek V4](/models/deepseek-v4). Feed the failing workflow YAML + error logs; Aider proposes edits. Works for the 80% of CI failures caused by misconfiguration (wrong runner, missing secret, syntax error, version mismatch). Fails on the 20% caused by environmental issues (network flakiness, resource exhaustion, race conditions).

Setup walkthrough

  1. Install Ollama → ollama pull qwen2.5-coder:14b (~9 GB — strong at IaC languages: Terraform, Ansible, Kubernetes YAML).
  2. For Terraform generation:
ollama run qwen2.5-coder:14b "Generate a Terraform configuration for an AWS EKS cluster with 2 t3.medium worker nodes in us-east-1, VPC with public+private subnets, and an ALB ingress controller."
  1. First Terraform config in 10-30 seconds. Review and validate with terraform validate before applying.
  2. For Kubernetes manifest generation: prompt for a Deployment + Service + Ingress for a Node.js app.
  3. For Ansible playbook generation: prompt for a playbook that sets up Docker + NVIDIA Container Toolkit on Ubuntu 22.04.
  4. For CI/CD pipeline generation: prompt for a GitHub Actions workflow that builds, tests, and deploys to EKS.
  5. The model generates IaC code — always validate (terraform validate, kubectl --dry-run, ansible-playbook --check) before deploying. Models hallucinate resource names and IAM policies.

The cheap setup

Infrastructure automation is text-generation only. Qwen 2.5 Coder 7B runs on CPU on any $300 laptop at 20-40 tok/s. For Teams using Terraform/Kubernetes daily: a used GTX 1060 6 GB (~$60) runs 14B models at 40-60 tok/s — near-instant manifest generation. The compute is trivial. The value is in the quality of the generated IaC, not the speed of generation. $400 total (laptop + GPU) handles all local IaC AI needs. Infrastructure automation with AI is accessible to anyone who can run a 7B model — which is anyone with a laptop from 2020+.

The serious setup

Used RTX 3060 12 GB (~$200-250, see /hardware/rtx-3060-12gb) handles Qwen 2.5 Coder 32B at 35-50 tok/s — the 32B model generates production-quality Terraform modules with proper variable structures, outputs, and provider versioning. For DevOps teams managing complex multi-cloud infrastructure: the 32B model reduces IaC boilerplate by 70-80%. Total workstation: ~$900-1,200. Infrastructure automation AI doesn't need "serious" GPU — the models that generate the best IaC (Qwen Coder 32B, DeepSeek Coder V3) run on consumer GPUs. The $2,000 tier buys speed, not a fundamentally different capability.

Common beginner mistake

The mistake: Generating a Terraform config with the AI, running terraform apply, and discovering the next day a $5,000 AWS bill because the model generated 50 r5.8xlarge instances instead of 2 t3.medium. Why it fails: LLMs generate code — they see instance types as text tokens, not billing implications. The model has no concept of cost. It might generate an expensive GPU instance because it saw more examples of GPU instance configurations in its training data. The fix: Always review IaC generated by AI for: (1) instance types/counts — check for unreasonable scale, (2) IAM policies — models often generate overly permissive policies ("Action": "*"), (3) network configuration — verify security groups aren't open to 0.0.0.0/0, (4) cost — run infracost or terraform plan before applying. AI generates a draft. You audit it for production safety. Never apply AI-generated IaC without human review — the cost and security implications are too severe.

Recommended setup for infrastructure automation

Recommended runtimes

Browse all tools for runtimes that fit this workload.

Budget build
AI PC under $1,000 →
Best GPU for this task
Best GPU for Ollama (coding workflows) →

Reality check

Code models are LLM workloads — same VRAM math applies. 16 GB runs 13-32B Q4 (Qwen 2.5 Coder, DeepSeek Coder); 24 GB unlocks 70B-class code models. The killer detail is context window — code review wants 32K+, which pushes KV cache beyond 16 GB on 70B.

Common mistakes

  • Skipping context-window math (KV cache eats VRAM at scale)
  • Using base instruct models for code (specialized code models 30-50% better)
  • Running coding agent loops on 8 GB (works for 7B but agent loops compound)
  • Forgetting flash-attention impacts code workflows more than chat

What breaks first

The errors most operators hit when running infrastructure automation locally. Each links to a diagnose+fix walkthrough.

Before you buy

Verify your specific hardware can handle infrastructure automation before committing money.

Buyer guides
Compare hardware
Troubleshooting
Specialized buyer guides
Updated 2026 roundup