Context

When managing a large number of stacks in Spacelift, enabling drift detection across all of them can create significant worker queue pressure. This article addresses how drift detection interacts with workers, key requirements, and best practices for rolling it out at scale.

Answer

Here are the key things to know when planning drift detection across many stacks:

Drift detection requires private workers. Drift detection runs cannot be executed on public worker pools — you must have a private worker pool configured before enabling this feature.

Drift detection runs consume workers like regular runs. Each drift detection run occupies a worker slot the same way a standard plan or apply does. With a large number of stacks, enabling drift detection on all of them simultaneously can result in very long queues.

To manage this effectively, consider the following approaches:

1. Spread runs using scheduling. Use Spacelift's drift detection scheduling to distribute runs across time (e.g., spread them across an hour) rather than triggering them all at once.

2. Prioritize the most important stacks. Rather than enabling drift detection on every stack, focus on the ones where it matters most:

   • Stacks that are security- or compliance-sensitive (e.g., those managing IAM roles, encryption, or access controls)

   • Stacks where drift could cause an outage or unexpected costs

   • Stacks that are rarely applied, since drift can accumulate quickly on them (frequently applied stacks are reconciled regularly by Terraform/OpenTofu itself)

3. Tune detection frequency by stack type.

   • Production and compliance-sensitive stacks may warrant hourly checks

   • Stable or development stacks can typically be checked daily or even less frequently

For more details, refer to the official Spacelift documentation on Drift Detection.