Terraform vs OpenTofu: Migration Guide and Feature Comparison (2026)

The BSL Fork

In August 2023, HashiCorp switched Terraform from MPL 2.0 to BSL (Business Source License). The community responded by forking it as OpenTofu under the Linux Foundation.

Timeline

• 2023-08: HashiCorp announces BSL license
• 2023-09: OpenTofu manifesto (10,000+ signatures)
• 2023-12: OpenTofu 1.6 GA (first stable release)
• 2024-06: OpenTofu 1.7 (state encryption, removed blocks)
• 2025-01: OpenTofu 1.8 (provider-defined functions)
• 2026-01: OpenTofu 1.9 (module testing, stack orchestration)

Feature Comparison (2026)

Migration Steps

1. Check Compatibility

# Most configurations work without changes
# Check for HashiCorp-specific features
grep -r "terraform {" . | grep -v ".terraform"
grep -r "cloud {" .  # Terraform Cloud blocks need removal

2. Install OpenTofu

# macOS
brew install opentofu

# Linux
curl -fsSL https://get.opentofu.org/install-opentofu.sh | sh

# Verify
tofu --version

3. Initialize

# Replace 'terraform' with 'tofu' in all commands
tofu init
tofu plan
tofu apply

4. State Migration

# State files are compatible — no migration needed!
# Just point OpenTofu at your existing state
tofu init -backend-config="bucket=my-state-bucket"

5. CI/CD Updates

# GitHub Actions
- uses: opentofu/setup-opentofu@v1
  with:
    tofu_version: "1.9.0"

- run: tofu init
- run: tofu plan -out=plan.tfplan
- run: tofu apply plan.tfplan

State Encryption (OpenTofu Exclusive)

terraform {
  encryption {
    key_provider "pbkdf2" "main" {
      passphrase = var.state_passphrase
    }

    method "aes_gcm" "main" {
      keys = key_provider.pbkdf2.main
    }

    state {
      method = method.aes_gcm.main
    }

    plan {
      method = method.aes_gcm.main
    }
  }
}

State files are encrypted at rest — no more secrets in plaintext state.

When to Stay with Terraform

• ✅ Heavy Terraform Cloud/Enterprise investment
• ✅ Team training is all Terraform-branded
• ✅ Using HCP-exclusive features (Sentinel, cost estimation)
• ✅ IBM support contract required

When to Switch to OpenTofu

• ✅ Want truly open-source (no license risk)
• ✅ Need state encryption natively
• ✅ Avoid IBM/HashiCorp vendor lock-in
• ✅ Open-source company (BSL may affect your distribution)
• ✅ Using third-party CI/CD (Spacelift, env0, Atlantis)

Related Articles

• Crossplane: Cloud Infrastructure from Kubernetes
• Argo CD: GitOps Deployment
• Platform Engineering Best Practices