← All episodes
EPISODE 193September 21, 2023 · 38:54

What's Up With Open Terraform?

Read the transcript

Matty: [00:00:00] So definitely GitHub is just, is just effed right now.

Cory: Cool.

Matty: Where’s Open GitHub? It’s time for Arrested DevOps, the podcast that helps you achieve understanding, develop good practices, and operate your team and organization for maximum DevOps awesomeness. I’m Matty Stratton. We are off to the races for kind of a hot topic today. I’m excited to get into it. But if you’re excited to get into it, first you’ll have to listen to these really good words from our sponsors. So Uffizzi is a platform for platform teams. You can stand up your developer platform in minutes, not months. What I like about Uffizzi is that it gives platform teams control and dev teams autonomy. It’s Kubernetes native and extensible, so you can customize it with tooling that meets your team’s evolving requirements. And these clusters, they spin up fast, like super fast. Out of the box, Uffizi combines a great dev experience, secure multi-tenancy, and cost efficiency. But try it out for yourself at uffizzi.com. Download their CLI and you can spin up your first sandbox cluster in under a minute on their free starter tier. That’s uffizzi.com, U-F-F-I-Z-Z-I dot com. Let’s talk about one of the most exciting events in the DevOps community. DevOps World 2023. If you’re someone who’s passionate about learning, networking, and staying up to date on the latest trends, then attending DevOps World is an absolute must. So what can you expect from DevOps World? The list is endless. First off, get ready to hear from some of the most inspiring and innovative speakers in the industry. The sessions will cover everything from AI automation, cloud-native architecture, security and risk management, to continuous delivery. And the best part is that DevOps World Tour 2023 is coming to 5 cities across the globe: New York City area, Chicago, Silicon Valley, Singapore, and London. Find a city near you and register today at arresteddevops.com/devopsworld. Today I am joined by Ohad Maislish, uh, and Cory Odaniel, and we’re going to be talking about what’s up with Open Terraform. If you’re involved in the DevOps and infrastructure space and haven’t been off on holiday living in a cabin with no internet connectivity for the last couple months, you maybe may have heard some inklings about some things going on with Terraform and the Open Terraform Project as well. And thought we’d have these 2 cats come on and let’s talk a little bit about what Open Terraform is all about, why it came to be, and what we can look forward to. But first, Ohad, can you tell us, introduce yourself to our listeners and Tell us a little about yourself.

Ohad: [00:02:56] Yeah, definitely. So I’m Ohad Maislish. I’m 41 years old, co-founder and CEO of env0. 2 very important things you need to know about me. One, I love cats and I have 2 cats. And the other one is that I play chess for a long time. So if you like chess, please reach out. And env0 is about infrastructure management. We manage Terraform, Pulumi, CloudFormation. And I’m sure we’re going to talk about what’s going on in infrastructure as code today. My background is technical engineer. So yeah, let’s talk tech.

Cory: Yeah.

Matty: Lots, lots to, lots to dig into. Do you play chess with the cats or do they just observe? That’s my question.

Ohad: They’re, they’re getting there.

Matty: Yeah. And Cory, tell us a little bit about yourself.

Cory: Yeah. I’m Cory Odaniel, CEO and co-founder of Massdriver. I’ll leave my age out of it. But I am probably younger than I look. Yeah, Massdriver is a visual development environment for managing cloud infrastructure and doing platform orchestration. Animal facts, I have a dog that is an Instagram celebrity, so we play a lot of posing. That’s our, that’s our game.

Matty: [00:04:11] I think we’re going to redirect this entire podcast episode because I need to know way more about this Instagram dog, and I’m actually excited to find out.

Cory: It’s Ziggy O’Doodle. I’ve been, uh, yeah, I’ve been, I’ve been stopped multiple times for people to take photos with Which is very weird.

Matty: So we will put a link in the show notes here. So Ziggy O’Doodle is an Australian Labradoodle. I have 2 Australian Shepherds and then my kids have an Australian Labradoodle over at their mom’s house. And then the fun fact is Australian Labradoodles have nothing to do with Australian Shepherds, but they are adorable. Okay. This dog is incredibly adorable and we will definitely put a link to this in the show notes. So go check that out. If you go to arresteddevops.com/openterraform, you can find out more about Ziggy O’Doodle, but That said, I, as much as I would love to have a podcast all about cute dogs on Instagram, and I am maybe about to go launch that starting tomorrow, we do, we did promise on the tin to talk about OpenTerraform. And I’ve been observing this. I’m, so for longtime listeners, or at least relatively short-time listeners, know that I’ve spent a fair amount of time in the infrastructure as code space. I was part of the Chef community for a long time, worked at Chef. Spent time working at Pulumi. And shortly after I left Pulumi, I was invited to come onto a Twitter Space to talk about infracode. And I remember distinctly saying I was really pleased that I no longer had a contractual obligation to have an opinion about infrastructure as code, which is still somewhat true. So that said, I’ve been observing, but I don’t necessarily have a dog in the hunt and it’s been more slightly relevant to my interests. So I don’t want to do a disservice about capturing kind of how we got here. But one way you want to kind of like tell us like, why are we even having this conversation today? Like some, some shit happened, right?

Cory: [00:05:54] Sure.

Ohad: So for those who don’t know, on August 10th, which is about a month and a half ago, HashiCorp decided to change the licenses of most of their projects, Vault, Nomad, Consul, and Terraform. I want to mention that not all of their projects changed its license. But Terraform changed its license. And Terraform, at least in my honest opinion, is something that integrates to so many things and makes sense to be open source. And we, a group of community, both vendors and individuals, decided to form together a manifest that we want to ensure that Terraform is going to be open source forever. And the natural thing happened and HashiCorp decided to stick with their own decision, which is totally legit. But we did our thing and we started working on the fork. And yeah, maybe Cory, you want to add some more?

Cory: [00:07:01] Yeah. Yeah. So I mean, you know, they obviously made the change and, you know, they published an FAQ about like who is going to be impacted by this, but you can kind of see like different parts of the open source community kind of reeling. Like you see multiple projects in CNCF that are starting to pull away from it. And so this is one of the big concerns for myself and Massdriver is like making sure that we’re using a tool that is going to be continuing to be invested in by the open source community and seeing some of these CNCF projects starting to pull away from it really, really made us want to be involved in OpenTF and making sure that it is a the new lingua franca of infrastructure as code.

Matty: So, if we kind of look at this a little bit, like we say, okay, they changed the license, kind of went into that, like what were the— I mean, people change licenses all the time, right? And sometimes it’s esoteric and fuel for arguing on Twitter about, or whatever place we argue about things about now. But, you know, there’s an impact, right? And, you know, no one’s doing this without— so, And I know there’s a big argument about, well, it’s still open source because it’s a BSL and the BSL means whatever it might be, which is, you know, whether it’s an open source license or not. But I would say like to me, when I kind of looked at it, again, not being somewhere that’s directly impacted, but, and not wanting to necessarily say this is a slippery slope, but you kind of could look at that. Maybe I think some of the initial reaction would be like, okay, well, this is like, targeting people like Pulumi or Env0 or Master, you know, like these third parties or whatever. And they’re like, oh, it doesn’t matter. You know, all your stuff is normally fine. But, you know, if you’re just a regular person writing code, but I think there’s a lot of like gaps in there that, you know, could be dangerous. Because I think we’ve seen it looks like, or at least potentially are perceived that way, right? Where depending upon, you know, we know lawyers, right? Depending upon your interpretation of the word the, It could be if I’m distributing my project using Terraform, am I in violation perhaps, right? You know, and everyone can say as much as, well, that’s not what we meant, it’s not what we meant. But all that has to be is now are you potentially, right? You can’t do it if you’re competitive with Hashi in some way. And how do you know who’s competitive with Hashi, right? And whatever, if they suddenly decide they want to be in a certain place. And I think it’s maybe that part of why I guess my question is, like you said, you know, these projects are thinking about pulling away from it. What are some of the reasons you’re seeing that people are concerned? You know, besides folks that— let’s be honest, you two have a pretty vested interest in, in an OpenTF, which is okay, by the way. Like, no one’s, you know, at least I’m not, I’m not trying to like question your motives here, but there also are plenty of us out there. I mean, there’s 30,000+ people started your repo, started the repo for OpenTF. So there’s clearly a lot of folks involved who are not in that place. So like, what’s the— what’s some of the things you’ve seen maybe, or the reasons that people are concerned and saying I have to rethink this?

Ohad: [00:09:57] Yeah, I think you’ve mentioned the fact that there are— there is some uncertainty regarding the future of the ecosystem, and the license is a bit vague in a way that it’s unclear some of the definitions there. I mentioned earlier that they changed the license on August 10th. Then 11 days later, on August 21st, they added more clarifications in a very unique way, by the way. They wrote a blog, uh, they wrote a blog and mentioned that this is a binding blog outside of the license, something in the hashicorp.com/blog. There is a binding blog from August 21st with additional clarifications. Then on August 24th, 3 days later, they also changed the terms and conditions of the Terraform Registry. So I think this in a way is trying to make things less vague or clearer, but it shows that there was a lot of reactions from the community that people didn’t really understand what are the implications. And I think although they gave more answers, it’s still not necessarily, uh, you know, fully clear about what’s the future of, uh, of the license. Is something competitive now, in the future? If I’m going to build something in the future, if HashiCorp is going to build something in the future, what’s going to happen then? And, and I can tell you, as, as a, as a founder myself, every time we do a fundraising, one of the things we need to do is to send the license to the vessels, and they need to make sure that we’re okay to minimize the risk. And if I’m going to send them a list that has this BSL license, and I’m going to point them to a binding blog, and then more updates and more updates, I— it’s, it’s something that I can imagine that people want to see a clearer, safer alternative in order to ensure the future of, of this, of this platform. So that’s my interpretation of of what really happened. It’s not like SSPL, for example. If you take Kafka or MongoDB and OpenSearch and things like that, it’s not like HashiCorp sells Vault as a service for $1 a minute or an hour, and then somebody else do that for $0.90. That’s why you have SSPL to prevent that. BSL is a very flexible license, and at least currently, in my opinion, it’s still pretty vague, the definitions of the license and all of the peripheral blogs and clarifications that have been added since then. And I think it adds to the confusion of the community, and the community always prefers to work with something more stable in the longer term.

Matty: [00:12:52] I was thinking about something else earlier today in a different conversation I was having with someone and kind of talking about concerns that people in enterprises, for example, this was the topic of the conversation, would have about open source and not like FUD stuff, but just in general, right? You’re saying that I was thinking about how we’ve evolved. Like, I remember it wasn’t so long ago that I might have, when I was at Chef, I might have customers who, you know, would push back against even using Chef because they’re like, every single line of open source code that ever enters our firewall, our CIO has to personally review it kind of thing. And You know, obviously, number one, that is not tenable. It wasn’t tenable how many years ago. It’s incredibly impossible today, but we aren’t quite there. But then you look at things like this and just like you said, you have the same, you know, need to sort of look and do a risk analysis with your investors, with your board, but large enterprise, you know, are looking at that and saying like, how are we keeping ourselves and having a complicated way to have this answer? Certainly does not make people who are interested in qualifying risk happier. And I think that becomes frustrating, right? If you’re someone who wants to use a product and then, you know, you’re already probably, you may already be in a situation where you’re fighting compliance or whatever inside your organization just to use anything open source in the first place. And now you say, cool, you were just barely getting your arms around understanding open source licenses. And now here’s one that’s super complicated. Probably makes it— I mean, this is to be quite frank— probably starts to make it— it’s going to make it kind of hard for Hashi to sell, I would think. You know, I can imagine bumping my arms a little bit. Cory, what are your takes on some of the things on what’s made this a bigger deal than maybe it might normally?

Cory: [00:14:36] Yeah, so like when we first saw the change, like we were affected and then we weren’t because we technically compete more with like Waypoint. We are heavily dependent on Terraform. So like we’re like one of these like adjacent library competitors, right? Like we use Terraform, but we compete with Waypoint, which they’ve now cut out in the FAQs. But this is one of those things where it’s like, you know, it’s— it was like a week before they added that exclusion. Right. And so like that just shows like the kind of the dynamic nature of the, of the license. And I think that’s what worries a lot of people, especially like looking through CNCF, like, you know, You know, the Dapr project, for example, uses Consul. And so if it’s built on Consul and somebody uses that project internally at an organization and they compete with Terraform, like there’s like a transitive dependency that you are now required to pay for to compete with, you know, a HashiCorp product. Right. And I think that’s what people are really concerned with is like the fluidness of this license and the fact that it can kind of be changed on a whim. By updating this blog post of these FAQs. And, you know, looking through some of the other CNCF changes, you know, there are, you know, pulling a lot of Vagrant out of projects for Lima, for example, just to avoid this confusion where an end user might not want to use a CNCF project because they don’t know if it’s going to be a problem for them in the future. And, you know, it’s going so far that even Jaeger is considering removing Go plugin. Which is still MPL, right? Just because they’re worried of the potential impacts of continual license change here. So I think that’s like what continues to be the biggest concern for a lot of people is that it is very much email us to figure out if you owe us money, which isn’t very explicit compared to, you know, how some of these other BUSL changes have happened in the past with Cockroach and some of the other databases.

Matty: [00:16:36] So this is sort of what got us to Open Terraform, OpenTF, whatever. You know, I work in marketing. What’s the, what’s the right word? What’s the right term?

Ohad: It’s OpenTF. And starting tomorrow, we’re going to slightly change it. Cory, what do you think about—

Cory: Is this where we’re going to break? I mean, I guess we’re not breaking the news. I mean, this is where we’re kind of breaking the news, but it’s going to be delayed.

Matty: You’re breaking the news to me. The listeners will get it the day after. So I won’t tell anybody. I won’t even tell my dogs. I have headphones on. They can’t even hear you.

Cory: The Linux Foundation has recommended that we rebrand the project because of the letters TF could be confusing with Terraform. So based on some feedback from the community, we’ve decided to move forward with OpenTofu as the project name. And the binary will just be tofu. All right.

Matty: OpenTofu. Okay.

Ohad: You’ll stick a fork.

Cory: That’s the end of the show.

Matty: Put a fork in your tofu.

Cory: Okay.

Matty: Got it. There we go. Done. Done and done. You know, there’s, there’s a lot of stuff and I’ve got some links in the show notes to the manifesto, kind of the history of of where you got. And, you know, we see the, the wonderful graphic of how quickly achieving the 33,000 stars on GitHub versus, you know, how long it took Terraform to get there and everything. And all these companies pledging their support. So as I’m fond of saying, I’ve spent most of my life as a system administrator, so I’m inherently cynical about everything pledging. So it’s easy to pledge, right? So like, what, what are the reasons to think about like what’s I, I think about there have been forks of things. There have been, okay, I’m gonna go to this, and some of them are incredibly successful, right? And some of them are cool. But like, when it comes down to the, okay, and I’m looking at, for example, I’m looking at the repo, I’m looking at all this, and obviously there’s a ton of just like getting things ready to be able to do anything kind of work that has to be done. What is the expectation or belief or kind of what, what, what, what makes you think that there will be market— markable, like, improvement. Because I would say one of the things that I look at as really powerful is, like, if you’ve got Hashi, you know, and you’re looking at Terraform, you know, if I have an improvement I want to make to core Terraform that is contradictory to Hashi’s business goals, that’s probably not something that they’re going to want to, to take, to accept. Which is, they’re right, right? So I’m imagining there’s a decent amount of like things that people are excited to say, cool, this is something we wanted to do, we wanted Terraform to do, and for reasons that wouldn’t, are we expecting to— I mean, I imagine we expect to see a big flurry of that all at once, but then like, how, how are, how are y’all thinking about managing that? Like, cool, lots of attention, lots of interest or whatever, and like 8 months from now, a year from now, And people have moved on with their lives.

Ohad: [00:19:24] You know, that’s, that’s a great question. And, and what Cory mentioned earlier, not just the, the new name, but the big announcement that is happening tomorrow, or when this episode is released yesterday, is the fact that OpenTofu is no longer just a project of several vendors and individuals. It belongs to the Linux Foundation. And that’s the natural process in order to get into CNCF. And that’s the next phase as planned. So first of all, making sure it’s open source forever, that’s already a big advantage for the user. It is going to be compatible. So it means that you don’t need to change any lines of code and just use a different binary and a different registry. But already we have received A lot of great reactions and support, both in capabilities and in companies supporting us. I want to mention Grantwork, the creators of Terragrunt and Terratest, supporting OpenTofu. I want to mention Harness supporting OpenTofu, and more to come. But I think more importantly is what you can do with OpenTofu. And thanks to the fact that it’s going to be built together with the community under the guidelines and process of the CNCF, We are already starting to see some interesting additional capabilities that can be added to OpenTofu. It’s both compatible but also potentially larger or wider and includes some interesting capabilities. Yevgeny Jim from Grantwork released a sneak peek into the early release of state encryption, which is something that Terraform users have been waiting for a long time because one of the main concerns about using Terraform is that somewhere you’re going to have a file, e.g., the state file, that is plain text with a lot of secrets, and it sits somewhere, and you need to make sure that only relevant people have access to this location. And that’s a headache for security folks. So just being able to properly encrypt on the fly the usage to the state file is a big thing. And that’s one example of something that is being implemented.

Matty: [00:21:52] My ears perked up because I remember when I was at Pulumi, that was— that’s actually a big differentiator between Pulumi and Terraform was literally just that, is that Pulumi state file is encrypted. And how many times I would have conversations and people didn’t realize that. You know, like that would come up and be like, you do know that your Terraform state file, and you’re like, what? Because it’s one of those things that quite frankly, you’re just like, I just sort of would assume that, you know, if we’re putting that in. So that’s pretty powerful. And I think having that connection to, like you said, being a part of Linux Foundation, joining Linux Foundation, connecting into that unlocks a lot of capability where that happens to be. You kind of mentioned saying having to use a different registry, and it sounds like there was some— in one of the several updates, the clarifying updates, there were some changes to how the Terraform registry would work. So tell us a little bit about that. And then for me, as someone who is writing or using modules, using things like that, like how does this impact my life if I want to be able to be supporting of people who are using Tofu or using Terraform, et cetera. Could you walk us through a little bit about the change from the registry perspective and how that might impact me either as a consumer or as a publisher?

Cory: [00:23:11] So that one gets a bit, a bit interesting. I mean, one of the opportunities this creates for us is, you know, to start looking towards using, being able to support OCI compliant registries, right? But as far as the existing modules, the goal is to effectively the initial registry we’ll be releasing is to just kind of proxy those requests off to GitHub to fulfill those modules. So you’ll be able to resolve the module name to a GitHub repo. So we should be able to just do some, some pretty basic pass-through there. Now going forward, I think that we’ll have to load that up with all the existing modules somehow. And I think that’s something that’s still in the works exactly how we’re going to be doing that. I’m not sure if I’ve got outdated information there though.

Ohad: I can mention, at least regarding providers, there is a convention, naming convention, that if you name some provider in a certain way, then it means that it sits in a matching URL within GitHub. So basically the registry is a very simple index that redirects your names according to the naming standards. To a GitHub repo. So basically, that’s all we need to do in order to implement our own OpenTOEFL registry.

Matty: [00:24:31] So as a publisher, I don’t have to actually worry about that. It’s just sort of—

Ohad: Exactly.

Matty: Yeah. I don’t have to submit to you or anything like that. It’s just going to just be put out there.

Ohad: Correct.

Matty: That seems super helpful, especially again, thinking about as a as someone who’s offering up these providers in order to support your other project, right? We say we want to have a simple way. We don’t want to get in the middle of that. And we don’t know and don’t want to have to— again, if I’m having the Ivan Terraform provider where I’m at to be able to say like, okay, here’s our instructions on how to use this, but also it’s slightly different if you do this. And then that’s just nobody— no one’s got time for that, which connects into that sort of open drop-in. Are there any— so you talked about the, the encryption, the state file encryption thing. Is there anything else that you’ve seen people sort of champing at the bit to be like, oh, finally we’re going to be able to, to, to go into this? Like, what, what— again, none of this is me saying like, what is the roadmap of the improvements, you know, but you know, you know what, what kind of people are, you know, fussing about. Like, what, what, what do you think people are going to be excited about, you know? And again, if I look at this from the perspective of I’m just, you know, people listening to this are like, I don’t care about open source drama. I don’t care about whatever. I just have, you know, I just have work to do. So I’m Joe or Jill Schmo. That’s an SRE over at, you know, a bank.

Cory: [00:25:54] Cool.

Matty: How is this going to make my life better?

Ohad: For those who are not aware, Terraform Core, although it was open source and back to your introduction in the beginning, it’s now not open source. It’s source available. Which means the source is still available, but according to the license, it’s not open source anymore. So that alone is already, as we mentioned, a great risk, a totally different approach for risk management for engineers. And also what I want to mention is that Terraform Core itself, although it was open source for 2 years technically, it didn’t really accept any community pull requests. HashiCorp announced 2 years ago in September 2021 that due to their own limitations, which is again totally fine, they decided to focus on their own requests and prioritize those and basically stop handling the community pull requests. So basically it means that everything can be done. Back to your question, exactly what is the technical steering committee? We now have, because we are in Linux Foundation and soon in CNCF. We already started working with an official steering committee, currently with 5 members. And those types of decisions are being done there under the guidelines of the Linux Foundation and CNCF. I can tell you that I’ve already seen, and I don’t remember exactly what was that, but I’ve already seen a change coming from the community. And we decided not to accept that to version 1.6 because it’s a new capability. And we decided that this should be a potential enhancement for one of the next versions of OpenTofu. And then it leads us to the discussion, okay, now how we define clear guidelines on what is being done, when, how we vote on things, how we get the voice of the community properly. Honestly, this is work in progress. We are just adjusting and implementing the best practices of CNCF. But because we’re there, because we’re in Linux Foundation, those guidelines are something that we have and we want to implement. So again, it’s not an exact answer to what you’re going to see in the next version that is going to be released next week. But I think it’s a more generic question on how the process looks like, We want to do RFCs together with the community on how to implement that, those things. So there is no specific answer here. It’s more about the process and having OpenTofu as an impartial platform.

Matty: [00:28:47] I think that’s an overall thing as we see we’re trying to sort of all do this balance about how do we enable the innovation that needs to happen, but also understand that people need to make money, right? You know, because nothing, nothing comes, comes for free. But then we start to see, like you said, some of these things that unchecked or just cross incentives, you know, it happens in a lot of open core type of setups as well, right? Where you sit there and say like, okay, this is contradictory to the thing that we’re trying to do. And even if you wanted to say, hey, the company that’s doing that, you should be altruistic and everything. It’s like, do we really expect that? Any thoughts on kind of as we look at this evolution of— let’s be honest, money ain’t as cheap as it was a couple years ago when we’re looking at this. So a lot of organizations, almost everyone is trying to sort of refactor, if you will, the business model into the where’s the revenue and where is this. So some of it is, I’m not saying that Hashi is grasping at straws here, but there’s a lot of trying to figure out the different models and different things that would that wouldn’t, could work. Do you think we’re going to see more of this type of a situation of like, hey, it was, you know, when money is cheap, it was easy to say, of course, we’re— but even that, you know, like you said, you know, even just accepting community contributions is a huge— that adds— that’s cost at what benefit, right? To a certain point, yes, the, the overall benefit is the product is improved, but As, as I don’t know that, that she is the one who, who created the statement, but the one who popularized it to me was Jesse Frazell saying, as a maintainer, no is temporary. Yes is forever. Right? So if we’re going to take that on, it’s now, now part of that. And we don’t have that overhead. And certainly you both are, you know, deal with boards and things like that. And, you know, sitting and saying we have to have all this money of overhead to maintain community stuff is probably, is, is a hard sell when, when money is tight. But that said, like, what are, what are some of your thoughts around ways to, to continue this? Because again, this is all, it’s great. We have things like the Linux Foundation and the CNCF and that can help support that. But you also have, let’s, let’s be honest, if, if, if OpenTofu came out of nowhere, you know, you, you, you have a lot that comes from the momentum and the inertia of a large existing community, you know, so, but not every, you know, new, new things are not going to come that way. So how do, How do we sort of reconcile that? This is, this is the million or billion dollar question, right? You know, you’re like, Matty, if I knew this, then we’d be doing something else.

Cory: [00:31:31] But yeah, I mean, I think, I think kind of the, the gravity of contributions is going to be important, right? So, you know, like Terraform hasn’t really been taking a ton of community contributions over the past 2 years. And with all the companies that, and organizations that are kind of pulling away from Terraform and HashiCorp products and like the CNCF, like they’re going to be looking for tooling to replace any Consul, Vault, Terraform tooling that they’re using. Right. And as far as OpenTF is concerned, like being able to have that drop-in replacement gives them a really easy path to not having to refactor a bunch of code. And now as they start to use OpenTF, you know, hopefully those people will be contributing to OpenTF. So, you know, my hope is kind of that we have an accelerated velocity of features getting released where, Terraform really has been bogged down for the past couple of years, and I’m hoping that that will bring the attention to this project that we need to really have a good path forward as far as maintaining and making sure there’s continual contributions to it so it doesn’t just kind of turn into vapor.

Matty: [00:32:35] So if people want to be a part of this, like, what’s— where’s the, you know, pull requests wanted, except in the nice way, not the dismissive way that we sometimes use? Like, how could people get involved? What’s the best way? Where’s the help wanted that’s not maybe as apparent help wanted, do you think?

Ohad: Awesome. Yeah, I think definitely we want to see more and more collaboration from the community. The amount of support we’ve received so far is amazing, and I’m humbled to see all of that in action. I think it depends on what kind of support you want to give. If you are a developer, I think the best thing for you is to star not just the manifest, but now we have the repo for a couple of weeks already at like 7,000 GitHub stars, the actual repo pledge. And I think the most interesting thing is to join our community Slack. It already has several hundreds of participants and the discussions there are very, very interesting. So that’s the first thing that you can do that is not too active, just, you know, for you to listen and contribute to the discussions. Obviously, submitting issues, voting on issues, and if you can contribute code with a pull request, that’s ideal. For the bigger organizations, I think now there is a big opportunity that didn’t exist up until a month ago. And that’s to influence the future of infrastructure within a CNCF license-ensured future. And so I think for the big vendors, the big cloud providers, I believe they will gradually consider to take a closer look on how they can participate in the future, in the future of OpenTofu, because it makes sense. Makes sense for them. Up until now, it was a different situation for them that they couldn’t really control the future of this project. But now they have a well-defined way on how to work with CNCF projects. And I think that will make it easier for them to be more involved in such an important project similar to Kubernetes.

Cory: [00:34:53] Yeah, I think one of the other things that could be pretty beneficial is, right, we’re trying to make sure that we have this backwards compatibility with Terraform and being able to run the test suite and tests is great. But, you know, once the registry, the alpha version of the registry is available, I think it could be really great to have people start to maybe put OpenTofu into their CI pipelines if you’re running Terratest or something like that, just so we can kind of exercise the library and make sure that we are loading all the providers, we’re able to load the modules correctly, and then provide any feedback there for any edge cases that we’re missing, I think would be phenomenal.

Matty: Fantastic. As we kind of bring ourselves to an end here, I would love to kind of get each of you, your parting words. Like, what’s the thing you want people, if you’re gonna take anything else away, we’ve talked about a bunch of things, but if you’re a listener to this show, like what is maybe the most key thing you want people to remember about Open Tofu when they go about their day? For the rest of today as they listen, whenever that day might be? Ohad, we’ll let you go first.

Ohad: [00:35:57] I want to echo what Cory just said. You know, we, we have a new project, CNCF, and it’s going to be available with an alpha version next week. I think the best way you can, as the developers who are excited about tech, just use it, use it, test it, give us feedback. It’s a community project, so you can influence that. And so that’s what we want people to, to see, to be more involved.

Cory: Yeah, I mean, I think that, you know, I, I’ve said this like plenty of times in our, in our private Slack channel, and I think I mentioned a few times on Twitter, but like, you know, we are a consortium of competitors and we all get along very well. I think we all came together around the language that we all love, right? I mean, it’s the way that we do our jobs. I was looking through some of my GitHub commits stats the other day, and it’s the language that I’ve written the most in the past 7 years. And so, I mean, it is really a community effort. And this is something that we’re all very much dedicated to, not just because it’s important for our businesses, but because we love the language, and we want to see it prosper. So, just getting other people involved that truly want to see this start to grow again, like we saw, you know, think about Terraform like 4 or 5 years ago, all these minor versions that were coming out with all this really awesome functionality and it just kind of ground to a halt. And so getting people that are excited about the way that Terraform used to grow and the feature cadence that was there is really who I want to see kind of coming to the project and helping us figure out what is, what is, what does 2.0 of OpenTofu look like?

Matty: [00:37:37] Fantastic. I think the first pull request that I’m going to put in on the project is to nominate Ziggy Odoodle as the official mascot of OpenTofu. So everybody go upvote that one. But on that note, uh, if you head on over to arresteddevops.com/openterraform, also you could go to arresteddevops.com/opentofu, I’ll make them both work, you will find this episode’s show notes. Uh, if you go to arresteddevops.com/itunes, leave us a review in the iTunes Store. Yes, it hasn’t been called the iTunes Store in many, many years, but I still call it that. But leaving us a review there, that can help other people find the podcast. You can also, if you’re hearing this for the first time somewhere else, you can subscribe to us on Spotify, iHeartRadio, Audible, everywhere that fine and less fine podcasts are sold and given away for free. Ohad and Cory, thank you so much for joining me today for this conversation and breaking news in the past. But you know, maybe someone’s hearing about it for the first time listening here. If you first heard on this show about OpenTofu, let us know on, I don’t know, whatever social media you can find us on would be great. And yeah, this is Arrested DevOps. And remember, there is always DevOps in the bananas.

BROUGHT TO YOU BY

Matty is joined by Ohad Maislish and Cory O'Daniel for some updates on the Open Terraform project.

Matty talks with Ohad Maislish, co-founder and CEO of env0, which manages Terraform, Pulumi and CloudFormation, and Cory O’Daniel, CEO and co-founder of Massdriver, a visual environment for cloud infrastructure that depends heavily on Terraform, about the community fork then called Open Terraform. Both guests run companies with a stake in the outcome, which Matty says up front while insisting it’s not a criticism of their motives. Matty’s own history is with Chef and Pulumi, and Matty says there is no dog in this hunt. The episode’s URL and title predate a rebrand announced partway through. The cold open is Matty: “definitely GitHub is just effed right now.”

What Happened

Ohad’s account, as a participant: on August 10th HashiCorp changed the licenses of several projects, including Terraform, and a group of vendors and individuals wrote a manifesto asking that Terraform stay open source forever. When HashiCorp kept its decision, which Ohad calls “totally legit,” the group started working on a fork. Cory adds that some CNCF projects began pulling away from HashiCorp tools, and that Massdriver wants to bet on a tool that the open source community keeps investing in, the “new lingua franca of infrastructure as code.”

Matty asks why a license change matters to an ordinary engineer. Matty’s concern is vagueness: depending on how a lawyer reads the license, distributing a project that uses Terraform could be a violation, and you can’t always know who is competitive with HashiCorp. Ohad says the license was followed by a binding blog post of clarifications on August 21st and changes to the Terraform Registry terms on August 24th, which shows the community didn’t understand the implications. Every fundraising round, Ohad says, means sending the license to investors, and a BSL license with a binding blog post and more updates is harder to explain than a clear alternative. Ohad contrasts it with SSPL, which exists to stop others from reselling a vendor’s product as a service, and calls BSL flexible and, in Ohad’s opinion, still vague.

Matty adds that enterprises already fight compliance just to use open source at all, and a complicated license makes that harder. Cory says Massdriver was affected and then wasn’t, since it competes with Waypoint, which was carved out of the FAQ a week later, and that dynamism is what worries people. Cory gives examples of transitive dependencies: a CNCF project that uses Consul, projects pulling out Vagrant, and Jaeger considering removing a Go plugin, which is still MPL. “It is very much email us to figure out if you owe us money,” Cory says, compared with how other projects handled BUSL changes.

OpenTofu

Asked what to call it, Ohad says OpenTF, and Cory breaks the news that will go public the day after recording: the Linux Foundation recommended a rebrand because TF could be confused with Terraform, so the project becomes OpenTofu and the binary is tofu. Ohad and Matty make the fork and tofu jokes. The project now belongs to the Linux Foundation, the natural step toward CNCF, and Ohad says it is meant to be a drop-in replacement: no code changes, just a different binary and registry. Gruntwork, the creators of Terragrunt and Terratest, and Harness are among the supporters, and Gruntwork has released a sneak peek of state encryption, which Matty recalls as a Pulumi differentiator since a Terraform state file can hold secrets in plain text.

Matty asks what makes the fork more than a burst of pledges, recalling a maintainer maxim: “as a maintainer, no is temporary. Yes is forever.” Ohad points out that Terraform core was open source but stopped accepting community pull requests about two years ago, while OpenTofu has a five-member steering committee under Linux Foundation and CNCF guidelines, and has already deferred a community change to a later version as a new capability. Ohad says RFCs and voting rules are a work in progress. Cory hopes that teams replacing HashiCorp tooling will contribute and speed up a project that “really has been bogged down for the past couple of years.”

The Registry

For modules and providers, Cory says the first registry will proxy requests to GitHub and resolve module names to repositories, and Ohad adds that provider naming conventions map to GitHub URLs. So publishers won’t have to submit anything. Cory sees an opportunity to support OCI-compliant registries later.

How to Help

Ohad suggests starring the repo, joining the community Slack, filing and voting on issues, and sending pull requests, and sees an opening for large vendors and cloud providers to shape the project under CNCF. Cory suggests putting OpenTofu into CI pipelines, for example with Terratest, once the alpha registry is out, to surface edge cases in loading providers and modules. Cory’s closing point is that the group is “a consortium of competitors” that get along well because they love the language. Matty promises to file a first pull request to nominate Cory’s Instagram-famous Australian Labradoodle, Ziggy O’Doodle, as mascot.


DevOps World is back for 2023, and you won’t want to miss out on this one-of-a-kind event! This year’s program is packed with exclusive insights, immersive workshops, and unparalleled networking opportunities taking place across multiple cities in the US, UK, and Asia. Elevate your DevOps game and register using the following links: NYC area, Chicago, Silicon Valley, Singapore, and London.

This episode's guests