OpenTofu, OpenBao reach milestones post-HashiCorp BSL
OpenTofu capped a year since launch with a new registry UI and API while OpenBao reached GA, but open source forks didn't keep HashiCorp from beating growth estimates.
In the year since HashiCorp's move to a Business Source License for all of its products, open source forks of its Terraform and Vault tools have gained traction, although without any discernible effect on HashiCorp's growth.
OpenTofu, a fork of HashiCorp's Terraform infrastructure-as-code tool, was proposed nearly immediately after HashiCorp revealed its plan to transition to a BSL in August 2023, and officially launched as a Linux Foundation project a month later. It became generally available or production-ready with version 1.6 in January, and in April defied a HashiCorp cease-and-desist letter with an update that refined the refactoring process for configuration code. That release, version 1.7, also contained client-side state encryption, a feature unavailable in Terraform.
OpenTofu maintainers did not say how many IT organizations have put their software into production, but according to GitHub, OpenTofu has more than 100 contributors and 22,400 stars, corresponding to the number of GitHub users that have marked its repository as a favorite. Its maintainers are primarily from Spacelift and env0, two of the commercial competitors targeted by HashiCorp's BSL terms.
On Sept. 5, Wojciech Barczynski, vice president of engineering at Spacelift, publicized a preview of a new search feature for a web-based OpenTofu registry UI and API released last month with version 1.8. The OpenTofu registry addresses another sore spot between HashiCorp post-BSL and the open source community -- changes to HashiCorp's terms of service for the Terraform Registry that blocked the fledgling fork from using it. OpenTofu launched with its own registry, a repository of software artifacts that integrate infrastructure as code with third-party software and services. It recorded just under 1.8 million peak daily requests in July, but it previously was accessible only via a command-line interface (CLI). Now, the OpenTofu registry UI and API bring it closer to matching the public Terraform Registry.
"Having a registry UI is not only more convenient, but it also offers engineers a centralized hub where they can learn the best practices for using resources and discover ways to make their code more effective," Barczynski wrote. "With the UI, they can quickly access documentation, examples, and guidance, thus streamlining the development process and reducing the learning curve."
OpenBao, an open source fork of HashiCorp's Vault secrets management software created by IBM engineers, got a later start than OpenTofu in December 2023. But by July, it had released version 2.0, which OpenBao maintainer Alexander Scheel said in a project mailing list discussion "is intended to be GA and production ready," though Kubernetes support remains in progress. OpenBao also has more than 100 contributors listed on GitHub and 2,800 stars; the project's website now lists supporters outside IBM that include EdgeX Foundry, NS1, IOTech Systems, Viaccess-Orca and Wallix.
'A sense of betrayal': OpenTofu user speaks out
Infrastructure-as-code consulting firm Masterpoint.io began to switch from Terraform to OpenTofu for most of its clients in January, and all but one of the company's approximately eight client engagements this year have used the open source fork, according to founder and CEO Matt Gowie, in an interview with TechTarget Editorial this month.
Masterpoint has also used Spacelift to support client projects in the past, but Gowie said the impetus for the change was his objection to HashiCorp's BSL as a member of the Terraform community and a past contributor to Terraform modules.
"If you start as an open source project and then you change your license after the fact, there's a sense of betrayal, and I feel that about what happened with HashiCorp," he said. "We've all put work and effort into this community, into this ecosystem, and now only you can make money off of it. There's other people who should be able to do so, because this was open source. That was what you originally intended."
Gowie wrote in a blog post in April that the transition from Terraform to OpenTofu had been a smooth one, in part because of an existing homegrown automation framework Masterpoint had put together that combines tools from the Aqua open source CLI project, Atmos Terraform management framework and Spacelift for infrastructure-as-code continuous delivery. That framework made Masterpoint a heavy user of Terraform, with more than 90 workspaces and state files, more than 39,000 lines of Terraform code and more than 2,300 resources in multiple cloud providers.
OpenTofu and its registry have worked well so far. Gowie said he hasn't yet tried out the newer features such as client-side state encryption and provider-defined functions, although he plans to evaluate them and is especially interested in the registry UI update.
"As OpenTofu and Terraform create more space from one another, where there are separate feature sets across the two, maybe we're going to have providers that have OpenTofu-specific functionality that you can't get in Terraform, and you'll want to be able to call that out in your provider documentation," he said.
However, Terraform did add one feature last October that OpenTofu doesn't have yet, and that Gowie said he hopes it can eventually match -- Terraform Stacks, which allows multiple Terraform modules and workspaces to be updated at the same time from a centralized interface.
"I would love to see a 2.0 OpenTofu that that tries to crack that problem, because I think it's one of the biggest things that we deal with when running … at scale," he said. "You have too many resources in your state, and then you have a monolith of resources, and things slow down. You have operational, organizational issues [with] too many changes going in at once. ... There's a bunch of things that can go wrong there."
One analyst who was initially skeptical of OpenTofu said it has proven itself a credible alternative so far.
"OpenTofu [maintainers have] shown they can pull together an open Terraform community in very significant ways and have been executing on their product roadmap with gusto, releasing multiple enhancements and versions with both catch-up and new features for the platform," said Andi Mann, global CTO and founder of Sageable, a tech advisory and consulting firm in Boulder, Colo. "They have also reacted to and negotiated some of the more difficult business issues very well, like legal and copyright, albeit after some initial hiccups."
HashiCorp beats the Street as IBM deal looms
Despite OpenTofu's quick development and demonstrated community momentum, however, Mann noted he has yet to see evidence that the open source fork has taken any significant toll on HashiCorp's business post-BSL.
"I do see a decent adoption rate in smaller, tech-focused, open source first/only shops -- perhaps not surprisingly," Mann said "But I have not seen any of the predicted tsunami of large businesses dumping HashiCorp Terraform for OpenTofu."
Quite the contrary. The publicly traded HashiCorp, which struggled with disappointing growth and Wall Street scrutiny in the 18 months following its December 2021 IPO, capped off four quarters of beating Wall Street estimates of its earnings per share growth last month. Its revenue for its fiscal second quarter of 2025 was $165.1 million, representing an increase of 15% year-over-year, and 10% growth in customers that spent more than $100,000 year-over-year. It ended the quarter with 4,709 customers, up from 4,558 customers at the end of the previous fiscal quarter, and up from 4,217 customers at the end of the second quarter of fiscal 2024.
"Many larger shops especially are not particularly concerned with … the BSL; not interested in contributing or maintaining open source tools and projects themselves; and looking for more functionality, global support, broader integrations, available skills and talent, and especially [products] that are easy to adopt and easy to integrate," Mann said. "Moreover, I see large enterprises shifting requirements from infrastructure as code to platform engineering, and HashiCorp simply has a longer lead time in working on and promoting that approach."
The biggest variable ahead for HashiCorp is not open source forks but its pending $6.5 billion acquisition by IBM, according to analysts, in part because HashiCorp still reported operating losses last quarter despite its revenue and customer growth. The deal is still expected to close by the end of calendar 2024, but the companies received a request for additional information from the Federal Trade Commission in July that has held up regulatory approvals.
"[The OpenTofu registry UI] shows the momentum of the open-source resources applied to OpenTofu," said Larry Carvalho, an independent analyst at RobustCloud. "While a useful feature, it may not move the needle away from HashiCorp now that IBM is acquiring HashiCorp. However [if the acquisition does not] go through due to regulator inquiries, customers may move away from HashiCorp due to … the lack of IBM funding."
Beth Pariseau, senior news writer for TechTarget Editorial, is an award-winning veteran of IT journalism covering DevOps. Have a tip? Email her or reach out @PariseauTT.
