OpenTofu
OpenTofu
Infrastructure as code for modern cloud and on-premises environments. This book starts from what a configuration means and ends at a production change pipeline.
The command is tofu. Examples target OpenTofu 1.13.2 (the 1.13 series, supported until 1 August 2027). The block that declares versions is still named terraform, so existing modules keep loading. Worked commands assume Linux. Chapter 3 also gives the macOS, Windows, and container installs.
OpenTofu is a community fork of Terraform, published under the Mozilla Public License 2.0 and hosted by the Linux Foundation. It is not a HashiCorp product. Where the two tools have diverged, this book says so.
What you will be able to do
- Explain why OpenTofu exists, and when a Terraform 1.6+ feature will not load
- Write HCL that plans the same way twice: variables, locals, outputs, and modules
- Configure providers, remote state, locking, and client-side state encryption
- Import an existing resource and test a module with
tofu test - Keep credentials out of state reviews, and run plan/apply from a pipeline with a human gate
How the parts are organized
| Part | Chapters | You leave able to |
|---|---|---|
| 01 First principles | 1–3 | Install 1.13.2 and explain plan, apply, state, and providers |
| 02 Language | 4–5 | Read and write HCL, variables, locals, and outputs |
| 03 Providers and state | 6–7 | Pin providers and store state somewhere other than a laptop |
| 04 Composition | 8–10 | Build modules, choose workspaces honestly, and import what already exists |
| 05 Confidence | 11–12 | Format, test, scan, and stop secrets landing in git |
| 06 Enterprise | 13–14 and the close | Run a pipeline and a multi-environment layout |
The running example
Chapters that need a real apply use the hashicorp/random provider and a random_pet resource. That needs no cloud account. AWS, Azure, and GCP snippets are configuration sketches: they show the arguments, and they are not a substitute for a credentials setup you have tested.
What this book leaves out
- A certification workbook
- Click-paths in a vendor console
- HashiCorp’s commercial Terraform Cloud / HCP Terraform product surface. Sentinel, in particular, does not run on OpenTofu. Chapter 11 uses Open Policy Agent instead