5 ms·

OpenTofu 1.7.0 is out with State Encryption, Dynamic Provider-defined Functions

118 points by cube2222 2y ago

cube2222 2y ago
Hello, technical lead of the project here! OpenTofu 1.7.0 is now officially out, with a couple of great features, including the first tofu-exclusives, which I know many have been asking for. Happy to answer any questions you may have!
- aeadio 2y ago
  With OpenTofu exclusive features making such an early debut, is the intention to remain a superset of upstream Terraform functionality and spec, or allow OpenTofu to diverge and move in its own direction? Will you aim to stick to compatibility with Terraform providers/modules? Is the potential impact of community fragmentation on your mind as many commercial users who don’t care about open source ideology stick to the tried-and-true Hashicorp Terraform? Is there any intention to try and supplement the tooling around the core product to provide an answer to features like Terraform Cloud dashboard, sentinel policies and other things companies may want out of the product outside of the command line tool itself?
  - cube2222 2y ago
    Hey! > With OpenTofu exclusive features making such an early debut, is the intention to remain a superset of upstream Terraform functionality and spec, or allow OpenTofu to diverge and move in its own direction? The intention is to let it diverge. There will surely be some amount of shared new features, but we're generally going our own way. > Will you aim to stick to compatibility with Terraform providers/modules? Yes. Regarding providers, we might introduce some kind of superset protocol for providers at some point, for tofu-exclusive functionality, but we'll make sure to design it in a way where providers keep working with both Terraform and OpenTofu. Regarding modules, this one will be more tricky, as there might be Terraform languages features that aren't supported in OpenTofu and vice-versa. We have a proposal[0] to tackle this, and enable module authors to easily create modules with support for both, even when using some exclusive features of any one of them. > Is the potential impact of community fragmentation on your mind as many commercial users who don’t care about open source ideology stick to the tried-and-true Hashicorp Terraform? We've talked to a lot of people, and we've met many who see the license changes as a risk for them, while OpenTofu, with its open-source nature, is the less-risky choice in their eyes. That includes large enterprises. > Is there any intention to try and supplement the tooling around the core product to provide an answer to features like Terraform Cloud dashboard, sentinel policies and other things companies may want out of the product outside of the command line tool itself? That's mostly covered by the companies sponsoring OpenTofu's development: Spacelift (I work here), env0, Scalr, Harness, Gruntworks. [0]: https://github.com/opentofu/opentofu/issues/1328 https://github.com/opentofu/opentofu/issues/1328
- levidos 2y ago
  Does OpenTofu have a Terrfaorm Enterprise type system?
  - cube2222 2y ago
    Yes, that's mostly covered by the companies sponsoring OpenTofu's development: Spacelift[0] (I work here), env0[1], Scalr[2], Harness[3], Gruntworks[4]. [0]: https://spacelift.io https://spacelift.io [1]: https://www.env0.com https://www.env0.com [2]: https://www.scalr.com https://www.scalr.com [3]: https://www.harness.io https://www.harness.io [4]: https://gruntwork.io https://gruntwork.io
    - nikolay 2y ago
      None of these are open-source, unfortunately.
      - janosdebugs 2y ago
        Atlantis has an issue open for OpenTofu support [1]. This might be something to look out for. [1] https://github.com/runatlantis/atlantis/issues/3741 https://github.com/runatlantis/atlantis/issues/3741
        nikolay 2y ago
        None of these are a replacement of Terraform Cloud (recently rebranded to HCP Terraform). For example, when you create a PR, it could affect multiple workspaces. The new experimental version of TFC/TFE (I refuse to call it HCP!) implements Stacks, which is something like a workflow, and links one workspace output to other workspace inputs. None of the open-source solutions, including the paid Digger [0], support this - only the paid one, such as Spacelift [1] (which is the closest to TFC if you ask me). Having a monorepo of Terraform is a common design pattern, so, if I change an embedded module, it could trigger changes it many workspaces. As far as I know, Atlantis [2] can't really help in this case. By the way, the reason I singled-out Spacelift is due to its quality, and the great Terraform provider it has. Scalr [3], for example, has a really low-quality Terraform provider. I extensively use the hashicorp/tfe provider to manage TFC itself. [0]: https://digger.dev/ https://digger.dev/ [1]: https://spacelift.io/ https://spacelift.io/ [2]: https://www.runatlantis.io/ https://www.runatlantis.io/ [3]: https://www.scalr.com/ https://www.scalr.com/
- maxloh 2y ago
  Now that HashiCorp is acquired by IBM, how will that impact OpenTofu? Will it be merged back into Terraform if IBM reverts the license change?
  - cube2222 2y ago
    We're definitely open to collaborating on a single project under the Linux Foundation's governance. However, I believe that it will still take some time until that acquisition is finalized, the announcement said "until end of 2024" iirc.
hamandcheese 2y ago
I admit I haven't tried it yet, but based on the description, provider-defined functions makes me nervous. It's easy to picture it as yet another tool for people with bad taste to create a horrible, impure monstrosity (people love to do this with terraform already by wrapping it). I'm very excited for state encryption though! Wondering how safe it is to check an encrypted state file into a public GitHub repo.
- janosdebugs 2y ago
  People have already done this by implementing functions as data sources, which also get recorded in the state unnecessarily.
  - hamandcheese 2y ago
    I see. Sounds like a reasonable inclusion then.
master_crab 2y ago
I’m curious to know if anyone has started migrating from a later version of TF (like over 1.0) to Tofu and what that looked like?
- cube2222 2y ago
  OpenTofu is a fork of the code past 1.5.0, so for anything below that, it's basically a drop-in replacement. For versions past 1.6.0 it's still easy[0]. There was also a cool blog post by Masterpoint about migrating over a pretty large setup, with a high degree of complexity, successfully[1]. [0]: https://opentofu.org/docs/intro/migration/ https://opentofu.org/docs/intro/migration/ [1]: https://masterpoint.io/updates/opentofu-early-adopters/ https://masterpoint.io/updates/opentofu-early-adopters/
liveoneggs 2y ago
OpenTofu is already diverging from upstream but is relying on upstream providers so I'm not sure how to feel about it.
- cube2222 2y ago
  No worries, it's very important for us to stay compatible with the provider ecosystem.
- lolinder 2y ago
  The technical lead has an answer here [0] about this concern. It may not answer all your worries, but it's definitely something they're aware of and planning for. [0] https://news.ycombinator.com/item?id=40213336 https://news.ycombinator.com/item?id=40213336
- Spivak 2y ago
  Yes, but these are two features that have been widely requested and the PR's languishing for years because they competed with Hashicorp's cloud offering.
deleted 2y ago
[deleted]

118 points by cube2222 2y ago

Hello, technical lead of the project here! OpenTofu 1.7.0 is now officially out, with a couple of great features, including the first tofu-exclusives, which I know many have been asking for. Happy to answer any questions you may have!

aeadio 2y ago
With OpenTofu exclusive features making such an early debut, is the intention to remain a superset of upstream Terraform functionality and spec, or allow OpenTofu to diverge and move in its own direction? Will you aim to stick to compatibility with Terraform providers/modules? Is the potential impact of community fragmentation on your mind as many commercial users who don’t care about open source ideology stick to the tried-and-true Hashicorp Terraform? Is there any intention to try and supplement the tooling around the core product to provide an answer to features like Terraform Cloud dashboard, sentinel policies and other things companies may want out of the product outside of the command line tool itself?
- cube2222 2y ago
  Hey! > With OpenTofu exclusive features making such an early debut, is the intention to remain a superset of upstream Terraform functionality and spec, or allow OpenTofu to diverge and move in its own direction? The intention is to let it diverge. There will surely be some amount of shared new features, but we're generally going our own way. > Will you aim to stick to compatibility with Terraform providers/modules? Yes. Regarding providers, we might introduce some kind of superset protocol for providers at some point, for tofu-exclusive functionality, but we'll make sure to design it in a way where providers keep working with both Terraform and OpenTofu. Regarding modules, this one will be more tricky, as there might be Terraform languages features that aren't supported in OpenTofu and vice-versa. We have a proposal[0] to tackle this, and enable module authors to easily create modules with support for both, even when using some exclusive features of any one of them. > Is the potential impact of community fragmentation on your mind as many commercial users who don’t care about open source ideology stick to the tried-and-true Hashicorp Terraform? We've talked to a lot of people, and we've met many who see the license changes as a risk for them, while OpenTofu, with its open-source nature, is the less-risky choice in their eyes. That includes large enterprises. > Is there any intention to try and supplement the tooling around the core product to provide an answer to features like Terraform Cloud dashboard, sentinel policies and other things companies may want out of the product outside of the command line tool itself? That's mostly covered by the companies sponsoring OpenTofu's development: Spacelift (I work here), env0, Scalr, Harness, Gruntworks. [0]: https://github.com/opentofu/opentofu/issues/1328 https://github.com/opentofu/opentofu/issues/1328
levidos 2y ago
Does OpenTofu have a Terrfaorm Enterprise type system?
- cube2222 2y ago
  Yes, that's mostly covered by the companies sponsoring OpenTofu's development: Spacelift[0] (I work here), env0[1], Scalr[2], Harness[3], Gruntworks[4]. [0]: https://spacelift.io https://spacelift.io [1]: https://www.env0.com https://www.env0.com [2]: https://www.scalr.com https://www.scalr.com [3]: https://www.harness.io https://www.harness.io [4]: https://gruntwork.io https://gruntwork.io
  - nikolay 2y ago
    None of these are open-source, unfortunately.
    - janosdebugs 2y ago
      Atlantis has an issue open for OpenTofu support [1]. This might be something to look out for. [1] https://github.com/runatlantis/atlantis/issues/3741 https://github.com/runatlantis/atlantis/issues/3741
      - nikolay 2y ago
        None of these are a replacement of Terraform Cloud (recently rebranded to HCP Terraform). For example, when you create a PR, it could affect multiple workspaces. The new experimental version of TFC/TFE (I refuse to call it HCP!) implements Stacks, which is something like a workflow, and links one workspace output to other workspace inputs. None of the open-source solutions, including the paid Digger [0], support this - only the paid one, such as Spacelift [1] (which is the closest to TFC if you ask me). Having a monorepo of Terraform is a common design pattern, so, if I change an embedded module, it could trigger changes it many workspaces. As far as I know, Atlantis [2] can't really help in this case. By the way, the reason I singled-out Spacelift is due to its quality, and the great Terraform provider it has. Scalr [3], for example, has a really low-quality Terraform provider. I extensively use the hashicorp/tfe provider to manage TFC itself. [0]: https://digger.dev/ https://digger.dev/ [1]: https://spacelift.io/ https://spacelift.io/ [2]: https://www.runatlantis.io/ https://www.runatlantis.io/ [3]: https://www.scalr.com/ https://www.scalr.com/
maxloh 2y ago
Now that HashiCorp is acquired by IBM, how will that impact OpenTofu? Will it be merged back into Terraform if IBM reverts the license change?
- cube2222 2y ago
  We're definitely open to collaborating on a single project under the Linux Foundation's governance. However, I believe that it will still take some time until that acquisition is finalized, the announcement said "until end of 2024" iirc.

hamandcheese 2y ago

I admit I haven't tried it yet, but based on the description, provider-defined functions makes me nervous. It's easy to picture it as yet another tool for people with bad taste to create a horrible, impure monstrosity (people love to do this with terraform already by wrapping it). I'm very excited for state encryption though! Wondering how safe it is to check an encrypted state file into a public GitHub repo.

janosdebugs 2y ago
People have already done this by implementing functions as data sources, which also get recorded in the state unnecessarily.
- hamandcheese 2y ago
  I see. Sounds like a reasonable inclusion then.

master_crab 2y ago

I’m curious to know if anyone has started migrating from a later version of TF (like over 1.0) to Tofu and what that looked like?

cube2222 2y ago
OpenTofu is a fork of the code past 1.5.0, so for anything below that, it's basically a drop-in replacement. For versions past 1.6.0 it's still easy[0]. There was also a cool blog post by Masterpoint about migrating over a pretty large setup, with a high degree of complexity, successfully[1]. [0]: https://opentofu.org/docs/intro/migration/ https://opentofu.org/docs/intro/migration/ [1]: https://masterpoint.io/updates/opentofu-early-adopters/ https://masterpoint.io/updates/opentofu-early-adopters/

liveoneggs 2y ago

OpenTofu is already diverging from upstream but is relying on upstream providers so I'm not sure how to feel about it.

cube2222 2y ago
No worries, it's very important for us to stay compatible with the provider ecosystem.
lolinder 2y ago
The technical lead has an answer here [0] about this concern. It may not answer all your worries, but it's definitely something they're aware of and planning for. [0] https://news.ycombinator.com/item?id=40213336 https://news.ycombinator.com/item?id=40213336
Spivak 2y ago
Yes, but these are two features that have been widely requested and the PR's languishing for years because they competed with Hashicorp's cloud offering.

deleted 2y ago

[deleted]