env0 Team for env0

Posted on Apr 11 • Originally published at env0.com

OpenTofu: The Open Source Terraform Alternative

#terraform #opensource #infrastructureascode #devops

What is OpenTofu

‍OpenTofu is an open-source Terraform fork, a drop-in replacement for Terraform v1.6.x that is fully backward compatible with all prior versions.

OpenTofu emerged as a community-driven response to Hashicorp's August 2023 license changes and became an official Linux Foundation project in September of that same year, on track to join the Cloud Native Computing Foundation (CNCF).

Just like Terraform, OpenTofu is an Infrastructure-as-Code (IaC) framework that enables DevOps, SREs, platform engineers, and others to use code to provision and manage cloud resources in an automated and declarative manner.

To do that, OpenTofu employs a declarative syntax known as the OpenTofu language. This language shares the same structure and functionality as the Hashicorp Configuration Language (HCL), offering an easy way to define your infrastructure via Terraform, for instance, the write -> plan -> apply workflow.

To demonstrate the similarities between Terraform and OpenTofu, let’s take a simple example of an S3 bucket:

resource "aws_s3_bucket" "env0-bucket" {
  bucket = "env0-tofu-bucket"
  tags = {
  Name  = "env0 bucket"
  }
}

Here’s how OpenTofu and Terraform plan commands behave on this S3 bucket.

Terraform:

$ terraform plan
…
Terraform will perform the following actions:
# aws_s3_bucket.env0-bucket will be created
  + resource "aws_s3_bucket" "env0-bucket" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "env0-tofu-bucket"
   …

OpenTofu:

$ tofu plan
…
OpenTofu will perform the following actions:
  # aws_s3_bucket.env0-bucket will be created
  + resource "aws_s3_bucket" "env0-bucket" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "env0-tofu-bucket
…

As you can see, both terraform plan and tofu plan share the same syntax (simply replace 'terraform' with 'tofu' in the command when using OpenTofu). Moreover, the commands generate similar outputs, detailing all the actions that will be executed on the infrastructure (env0-tofu-bucket’).

Like Terraform, OpenTofu enables these configuration files to be versioned, reused, and shared. Moreover, it can also be used to manage fundamental components such as computing, network, and storage features, as well as advanced components like DNS entries and SaaS features.

Terraform BSL License Change

The story of OpenTofu (originally OpenTF) starts on August 10th, 2023, with HashiCorp's announcements of shifting the license for all its products from Mozilla Public License (MPL) to the Business Source License (BSL).

The license change redefined how Terraform can be used, stating that production use is allowed only as long as it “does not include offering the Licensed Work to third parties on a hosted or embedded basis, which is competitive with HashiCorp’s products.”

The change was met with community concerns, as it effectively (and suddenly) signaled the end of Terraform as an open-source project.

Just a few days later, on August 15th, the OpenTofu initiative (at the time named OpenTF) was formed with the agenda to keep Terraform open source forever. In its manifesto, the initiative outlined the following principles for Terraform’s open source future:

Truly open source, under a well-known license‍
Community-driven and impartial
Layered and modular
Backwards-compatible

OpenTofu: MPL Licensed Alternative

Built upon these principles, OpenTofu is published under the MPL license and donated to the Linux Foundation, which makes it immune to any future rug pulls or any other unwanted single-vendor influences.

As with all other Linux Foundation and CNCF projects, OpenTofu is guided by the Technical Steering Committee(TSC), which works in open collaboration with the community on the development of new features, upgrades, bug fixes, etc. The current TSC consists of representatives from Harness, Spacelift, Scalr, Gruntworks, and env0.

The OpenTofu project team utilizes Github Milestones as the Roadmap, to ensure complete transparency. Furthermore, the team also shares weekly updates with the public about the latest changes in the project.

All of these mechanisms, from the choice of license to the adoption of Linux Foundation governance principles, are there to ensure that the future of OpenTofu will rest with the community.

As of January 2024, OpenTofu boasts a track record of over 100,000+ total downloads. OpenTofu's main repository has earned over 17,900+ stars, 637 forks, 71 active contributors, and currently has 24 pull requests and 135 issues.

The repository hosting the project’s manifesto has over 36,200 stars, as a strong indication of the community's broad support for the project.

OpenTofu: Frequently Asked Questions

To help you quickly dive into what OpenTofu is and what conversations it steers, here is a curated list of some of the most frequently asked questions about OpenTofu:

Q: What is the difference between Terraform and OpenTofu?

OpenTofu is a drop-in replacement for Terraform. Terraform and OpenTofu are both IaC tools used to provision infrastructure. Both use declarative HCL syntax. The real difference is that Terraform has shifted to a Business Source License (BSL), and OpenTofu is published under the open-source Mozilla Public License (MPL).

Q: Is OpenTofu suitable for production use?

Yes, OpenTofu is suitable for production use. After four months of work in completing all the development stages, the first stable version of OpenTofu (v1.6) has been successfully released as a General Availability (GA) stable release product.

Q: How can I migrate from Terraform to OpenTofu?

Migrating from Terraform to OpenTofu is simple, as OpenTofu v1.6 is fully compatible with Terraform v1.6. To make the switch, just follow the step-by-step migration process. If you are an env0 customer, you can make the switch in a few clicks, as shown in this video tutorial.

Q: Is OpenTofu using the same registry as Terraform?

Due to the changes introduced by HashiCorrp's team in its registry’s Terms of Service a dedicated OpenTofu registry had to be established for the project. As a result, the OpenTofu initiative operated its own OpenTofu registry, which uses the same providers and modules.

Q: Is OpenTofu compatible with Terraform providers and modules?

Yes, OpenTofu is compatible with all Terraform providers. If you are aware of any compatibility issues or feel that a feature is missing from OpenTofu but available in Terraform, you should let the maintainers know by creating an issue in the official OpenTofu GitHub and also notify the maintainers of the relevant module/provider.

Q: How does OpenTofu work with cloud providers like AWS, Azure, or GCP?

Like Terraform, OpenTofu uses provider plugins to interact with the APIs of various cloud providers. These plugins are extensions that are specifically designed to understand and manage the resources of a particular cloud provider. Whether you're dealing with AWS EC2 instances, Azure Virtual Machines, or GCP Cloud Storage, OpenTofu has a provider plugin to manage those resources effectively.

Q: How can I join the OpenTofu community?

You can follow OpenTofu on GitHub and join OpenTofu Slack community you should also follow the projects social media channels as well as the social media channels of CNCF and of the Linux Foundation, for news about community events and other updates and community-driven activities.

Q: Who owns OpenTofu?

OpenTofu is a part of the Linux Foundation and as such is managed just like any other Linux Foundation project. The OpenTofu team officially submitted it's CNCF application in early 2024. If accepted the project and the trademarks will be donated to CNCF.

Q: Who maintains OpenTofu?

The OpenTofu project (and the OpenTofu registry) is maintained by the core members of the OpenTofu initiative, currently those are Harness, Gruntwork, Scalr, Spacelift and env0. OpenTofu's steering committee includes representatives from these companies. Beyond that the initiative is supported by 172 organizations and projects.

Q: Why is it named OpenTofu?

Due to potential trademark issues with the original project name ‘OpenTF’, the maintainers had to find an alternative. After several rounds of voting, ‘OpenTofu’ was chosen by the majority, with other leading options including:

Archo - Like “architecture” but with an “o”
EchoSphere - A self-sustaining ecosystem
Kepler - Kepler-452b (a.k.a. “Earth 2”), a strong candidate for terraforming
AgriPlot - Inspired by Ascendancy, a space colonization game
Ergo - A logical conclusion (“therefore”)

Dozens of other options were raised, but these were either downvoted by the team or rejected by the legal counsel.

Q: Why should you use OpenTofu?

Without a doubt, this is the most common, and perhaps the most important question about the project. While individual motivations to use OpenTofu may vary, there are four distinct reasons I believe to be relevant to the vast majority of users.

No vendor lock-in - OpenTofu maintains organizational flexibility, allowing for the combination of diverse tools. Conversely, Terraform v1.6+ commitment risks locking into the HashiCorp ecosystem, constraining tool integration in Infrastructure-as-Code workflows, and escalating future migration costs. OpenTofu ensures interoperability and data portability, safeguarding against costly vendor transitions and supporting adaptable infrastructure management.
‍Broad community support - OpenTofu fosters open collaboration, inviting transparent discussions and diverse perspectives over a single organizational approach. Terraform, however, saw a decline in community engagement, with HashiCorp team dominating contributions. Post-license change, community contributions to Terraform were cut by more than half, accounting for less than 10% of total contributions.
Easy to switch over - OpenTofu offers a seamless transition from Terraform, ensuring 100% backward compatibility and a straightforward migration process with a simple binary change. This compatibility is essential for maintaining continuity and minimizing the effort needed to switch to a more open-source-friendly alternative.

Tutorial: How to Get Started With OpenTofu

To learn how to install OpenTofu on different operating systems (Linux Distros, MacOS, Windows), you can reference the official installation docs here.

To demonstrate how this works, let’s take a quick look at how to install OpenTofu on the Debian-based Linux operating system.

Start with using OpenTofu installer script:

wget --secure-protocol=TLSv1_2 --https-only https://get.opentofu.org/install-opentofu.sh -O install-opentofu.sh
# Give it execution permissions:
chmod +x install-opentofu.sh
# Run the installer:
./install-opentofu.sh --install-method deb
# Remove the installer:
rm install-opentofu.sh

Add repositories:

sudo apt-get update
sudo apt-get install -y apt-transport-https ca-certificates curl gnupg

Ensure that you have a copy of the OpenTofu GPG key:

sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://get.opentofu.org/opentofu.gpg | sudo tee /etc/apt/keyrings/opentofu.gpg >/dev/null
curl -fsSL https://packages.opentofu.org/opentofu/tofu/gpgkey | sudo gpg --no-tty --batch --dearmor -o /etc/apt/keyrings/opentofu-repo.gpg >/dev/null
sudo chmod a+r /etc/apt/keyrings/opentofu.gpg

Create the OpenTofu source list:

echo \
  "deb [signed-by=/etc/apt/keyrings/opentofu.gpg,/etc/apt/keyrings/opentofu-repo.gpg] https://packages.opentofu.org/opentofu/tofu/any/ any main
deb-src [signed-by=/etc/apt/keyrings/opentofu.gpg,/etc/apt/keyrings/opentofu-repo.gpg] https://packages.opentofu.org/opentofu/tofu/any/ any main" | \
  sudo tee /etc/apt/sources.list.d/opentofu.list > /dev/null

Install OpenTofu:

sudo apt-get update

sudo apt-get install -y tofu

Basic Commands

Next, let’s talk about some of the basic commands for OpenTofu. If you are familiar with Terrafrom, these will be instantly familiar.

tofu init - Initiates your OpenTofu project by running tofu init, which downloads cloud provider plugins (commonly AWS, Azure, GCP), and modules, and configures the backend as specified in your setup. (same as terraform init)

tofu plan - Analyzes your configuration, assesses existing infrastructure, and details changes that would be taking place in your infrastructure. (same as terraform plan)

tofu apply - Starts the process of infrastructure provisioning. Before creating infrastructure, OpenTofu generates a 'terraform.tfstate' file, which has metadata regarding the provisioned infrastructure. (same as terraform apply)

OpenTofu State Management

Let’s end this piece by talking about state management. Like Terraform, OpenTofu maintains a record of the status of the managed infrastructure, guaranteeing that modifications are implemented progressively and uniformly. This state management is crucial for comprehending existing and previous configurations, as well as for strategizing upcoming alterations.

By default, this state information is kept in a local ‘terraform.tfstate’ file. However, it's recommended that the state file be stored in remote backends like an S3 bucket or in platforms like env0, which comes with additional benefits like remote state, state consistency, etc.

For advanced state management capabilities, infrastructure engineers can use the tofu state command for use cases where they may need to modify the OpenTofu state file.

‍OpenTofu and env0

env0 seamlessly integrates with OpenTofu, facilitating advanced management, governance, and automation of your cloud environments.

The company’s team of experts, some of whom are also part of the OpenTofu core dev team, offer free support for anyone looking to learn about the project or in need of help with migration planning.

Visit here to book time with the team, or use your env0 account (or open a new free one) to take OpenTofu for a spin, as shown in the video below:

‍

DEV Community