OpenTofu Blog

I think there's many counter examples to this: Jenkins & Hudson, Illumos & Solaris, LibreSSL & OpenSSL & BoringSSL, LibreOffice & OpenOffice, Spongy Castle & Bouncy Castle, and Webkit & KHTML to name a few.

A fork need not necessarily be 1:1, bug for bug, compatible.

We discussed this here: https://github.com/orgs/openbao/discussions/55 and here: https://github.com/orgs/openbao/discussions/64 -- you're welcome to give feedback there and contribute to the success of the project. :-)

But as noted here: https://developer.hashicorp.com/vault/docs/configuration/storage#integrated-storage-vs-external-storage -- upstream only supports the Raft backend. The other backends may have issues and don't see many commits as upstream has not delegated maintenance to external community members. Frequently, commentators (both employees and community members) suggest moving away from custom storage backends to Raft.

A storage migration only impacts one small category of users -- the operator -- but remains transparent to the consumers of secrets (whether humans or applications). This only occurs once. Yes, it requires planning. Yes, it is a lot of work to execute successfully. But it is also an approach upstream uses e.g., in FIPS 140-2 migrations: https://developer.hashicorp.com/vault/docs/enterprise/fips/fips1402#migration-restrictions -- as we get time, we'd like to make this type of cross-instance migration more automated if we can.

But our goal is to remain API compatible, so the…

env0/OpenTofu | Remote | Europe/Americas | Full-time | Open Source Software Engineer

We’re a funded startup, building a platform that helps you automate and manage your IaC operations across different IaC frameworks. env0 helps you rolling out developer self-service, enhancing security and reliability of your IaC runs, all while accelerating deployments and lowering costs

We are also one of the companies behind the OpenTofu[0] initiative, and are now hiring engineers to the OpenTofu core team. We’re looking for self-sufficient mid-to-senior software engineers, ideally with experience maintaining open-source projects. Your work will be 100% OpenTofu-related.

You can apply here[1], if that sounds interesting to you!

[0]: https://opentofu.org [1]: https://www.comeet.com/jobs/env0/B6.005/open-source-engineer---remote/09.045

Look, I don't know what else to tell 'ya, but in 2026 if you're getting "mysterious" charges from AWS after "deleting everything", you're simply not competent.

With a plethora of free billing tips from places like Duckbill https://www.duckbillhq.com/, to full-on repos like AWS-Nuke, https://github.com/ekristen/aws-nuke , down to AWS's own account monitoring and management services like Control Tower https://aws.amazon.com/controltower/, and Config https://aws.amazon.com/config/ , and full IAC ecosystems like Terraform https://developer.hashicorp.com/terraform or OpenTofu https://opentofu.org/ , you are not leveraging all the cost-management capabilities of the modern cloud.

I think they replied to that on some occasions already [0], that projects in future will diverge, especially if the community will raise issues that require that.

BUT... 1.6 was a drop-in replacement for terraform. I can see 1.7/1.8 has some new things going on, but they made effort to handle that. For instance, some new features will be available if you use .tofu extension, but not when using .tf file extension. Tofu uses .tofu one and ignores .tf if both are present.

There seems to be a clear effort to keep our code compatible with both tools (with cosmetic changes at best) for as long as possible.

[0] https://opentofu.org/faq/#opentofu-terraform-differences

CloudFlare pricing is indeed positively ridiculous.

At OpenTofu[0] we’re using CloudFlare R2 to host the providers and modules registry[1]. Bandwidth is free, you only pay for requests.

This already would be great, but there’s more - you only pay for requests that actually hit R2. So with an almost 100% cache hit ratio, we barely register any billable requests.

Recently someone decided to load test us and generated ~1TB of traffic over 1-3 days. All but a few of these requests were cached, so the whole situation probably cost us less than a cent.

[0]: https://opentofu.org

[1]: https://github.com/opentofu/registry

Their two most prominent project Terraform and Vault (as listed in first position on their won website) were recently forked:

https://opentofu.org/

https://www.techtarget.com/searchitoperations/news/366563095/IBM-engineers-hatch-Linux-Foundation-HashiCorp-Vault-fork

Their other offerings have very strong alternatives.

I use Terraform and will certainly consider going with OpenTofu in the next upgrade.