OpenTofu 1.7.0 is out with State Encryption, Dynamic Provider-defined Functions

[cube2222]

Hello, technical lead of the project here!

OpenTofu 1.7.0 is now officially out, with a couple of great features, including the first tofu-exclusives, which I know many have been asking for.

Happy to answer any questions you may have!

[aeadio]

With OpenTofu exclusive features making such an early debut, is the intention to remain a superset of upstream Terraform functionality and spec, or allow OpenTofu to diverge and move in its own direction? Will you aim to stick to compatibility with Terraform providers/modules?

Is the potential impact of community fragmentation on your mind as many commercial users who don’t care about open source ideology stick to the tried-and-true Hashicorp Terraform?

Is there any intention to try and supplement the tooling around the core product to provide an answer to features like Terraform Cloud dashboard, sentinel policies and other things companies may want out of the product outside of the command line tool itself?

[maxloh]

Now that HashiCorp is acquired by IBM, how will that impact OpenTofu? Will it be merged back into Terraform if IBM reverts the license change?

[levidos]

Does OpenTofu have a Terrfaorm Enterprise type system?

[hamandcheese]

I admit I haven't tried it yet, but based on the description, provider-defined functions makes me nervous. It's easy to picture it as yet another tool for people with bad taste to create a horrible, impure monstrosity (people love to do this with terraform already by wrapping it).

I'm very excited for state encryption though! Wondering how safe it is to check an encrypted state file into a public GitHub repo.

[janosdebugs]

People have already done this by implementing functions as data sources, which also get recorded in the state unnecessarily.

[master_crab]

I’m curious to know if anyone has started migrating from a later version of TF (like over 1.0) to Tofu and what that looked like?

[cube2222]

OpenTofu is a fork of the code past 1.5.0, so for anything below that, it's basically a drop-in replacement. For versions past 1.6.0 it's still easy[0].

There was also a cool blog post by Masterpoint about migrating over a pretty large setup, with a high degree of complexity, successfully[1].

[0]: https://opentofu.org/docs/intro/migration/

[1]: https://masterpoint.io/updates/opentofu-early-adopters/

[liveoneggs]

OpenTofu is already diverging from upstream but is relying on upstream providers so I'm not sure how to feel about it.

[lolinder]

The technical lead has an answer here [0] about this concern. It may not answer all your worries, but it's definitely something they're aware of and planning for.

[0] https://news.ycombinator.com/item?id=40213336

[cube2222]

No worries, it's very important for us to stay compatible with the provider ecosystem.

[Spivak]

Yes, but these are two features that have been widely requested and the PR's languishing for years because they competed with Hashicorp's cloud offering.