Terraform lost the community — OpenTofu and Pulumi are splitting the market
OpenTofu is three years old and running in production at Boeing, Capital One, and AMD. Pulumi is growing 45% year-over-year and just shipped an AI agent that provisions infrastructure from natural language.
August 2023: HashiCorp relicenses Terraform from MPL to BSL. February 2025: IBM acquires HashiCorp for $6.4 billion. July 2026: the OpenTofu fork, hosted by the Linux Foundation and governed under the CNCF, runs in production at Boeing, Capital One, and AMD — while Pulumi posts 45% year-over-year growth and unveils an AI agent that generates infrastructure from a one-sentence prompt. The Infrastructure as Code market now stands at $2.1 billion with 28% annual growth. Terraform still holds 76% market share, but that headline number masks the real story: the trust is gone, and the alternatives aren’t just catching up — they’re defining the next generation of IaC.
The license that broke the dam
On August 10, 2023, HashiCorp switched the license for its core products — Terraform, Vault, and Consul — from the permissive MPL 2.0 to the BSL 1.1 (Business Source License). Under BSL, using Terraform “in a competitive way” against HashiCorp’s own products is prohibited. End users running terraform apply in their CI pipelines are unaffected. But every platform vendor that had built a business around wrapping or orchestrating Terraform — Spacelift, env0, Scalr, Harness, Gruntwork — saw their model threatened overnight.
The response was immediate. Within weeks, a coalition of those same vendors forked Terraform 1.5, the last MPL release, and announced OpenTofu under the Linux Foundation. Backing companies included Spacelift, env0, Gruntwork, Harness, Scalr, and Cloud Posse, alongside dozens more. Individual contributors poured in — over 800 within six months on GitHub alone.
Fast-forward to July 2026. OpenTofu is at version 1.9, has joined the CNCF (the same foundation that houses Kubernetes), and counts Boeing, Capital One, and AMD among its named production users. The fork isn’t a protest anymore — it’s a top-tier IaC platform in its own right.
OpenTofu 1.9: what the fork shipped
OpenTofu maintains near-total syntactic compatibility with Terraform. Same HCL, same state file format, same CLI commands (init, plan, apply, destroy). For most existing configurations, migration is tofu init instead of terraform init and nothing else changes.
But the fork hasn’t been idling. Since the split, OpenTofu has shipped features Terraform still lacks:
- Native state encryption. OpenTofu 1.7 introduced configurable encryption for state files and plan files — a long-standing community ask, delivered without requiring an external KMS workflow. Supports PBKDF2, AWS KMS, GCP KMS, and OpenBao (the open-source Vault fork). A compliance gap closed in one release.
removedblocks. A declarative way to remove resources from state — no more fragileterraform state rmcommands in production runbooks.- Early evaluation of variables and locals. Backends can now be parameterized cleanly, solving a years-old Terraform pain point.
- A richer test framework.
tofu testoutpacesterraform testwith mock providers that let you run infrastructure unit tests without real cloud credentials. - Provider functions in provider configuration. OpenTofu 1.9 allows calling provider functions directly inside provider blocks — a capability Terraform’s HCL doesn’t support.
On the Terraform side, the exclusive features boil down to Stacks (a multi-environment abstraction layer), Sentinel (proprietary policy-as-code), and deep integration with HCP Terraform (formerly Terraform Cloud). These are useful for large organizations, but they come with a clear lock-in vector: Sentinel is unavailable on free plans, and Stacks have no OpenTofu equivalent.
Pulumi: real languages and an AI agent
Pulumi attacks the IaC problem from a different angle entirely. Instead of a domain-specific language like HCL, it lets you write infrastructure in TypeScript, Python, Go, C#, Java, or YAML — whatever your team already uses. Developers get full IDE support, type checking, package managers, and standard library constructs. Pulumi translates the result into cloud API calls.
This isn’t cosmetic. When a team needs to provision 200 security groups from a CSV file, they write a for loop in TypeScript — not a three-level-deep dynamic block in HCL that no one can read past the second nesting. When a deployment needs to call an external business API mid-provisioning, it happens in the same file, with the same stack.
Pulumi reports roughly 1,800 native providers compared to Terraform’s 4,800+, but that number understates real coverage: the pulumi-terraform-bridge lets Pulumi consume any Terraform provider. All three hyperscalers — AWS, Azure, GCP — are first-class citizens. The gap bites primarily on niche SaaS providers, where Terraform’s long tail of community-maintained integrations remains an advantage.
Pulumi’s real differentiator in 2026 is Pulumi Neo: an AI agent that generates infrastructure code from natural language. “Deploy a GPU-backed EKS cluster with three node groups on AWS” — Neo produces the full Pulumi configuration, enforces organizational policies automatically, and opens a pull request for human review. The agent operates within existing RBAC boundaries, and every change flows through standard CI/CD pipelines. This isn’t a demo — it’s repositioning the competition around AI-assisted orchestration rather than language syntax.
Benchmarks back the performance story. Pulumi handles incremental deployments up to 60% faster than Terraform on infrastructures exceeding 1,000 resources. Terraform still holds an edge on massive initial provisioning thanks to mature parallelization, but most production time is spent on updates, not first deploys.
The IBM variable
IBM’s acquisition of HashiCorp in February 2025 for $6.4 billion adds a layer of strategic uncertainty. IBM promises continuity — but the question isn’t whether Terraform will be maintained (it will), it’s whose interests the roadmap will serve. Will an IBM-owned vendor optimize for the open-source community or for IBM Cloud margins?
OpenTofu, hosted by the Linux Foundation and governed under the CNCF, answers that question clearly: community governance, diversified funding (Spacelift, env0, Gruntwork, and others fund development), and an irrevocable MPL 2.0 license. For CISOs presenting a continuity plan to an audit committee, that guarantee carries weight.
Pulumi, licensed under the permissive Apache 2.0, plays a different hand: product innovation. The company is betting on Neo and on Pulumi Cloud, whose free tier is notably generous — unlimited resources for individual use, versus Terraform Cloud’s 500-resource cap.
What to pick in July 2026: the verdict
The 2026 IaC landscape isn’t a podium — it’s three distinct trajectories serving different organizations.
Stay on Terraform if you’re already deployed on HCP Terraform with Sentinel policies, you hold an active HashiCorp/IBM support contract, and your use case clearly falls within BSL allowances. The migration cost isn’t justified if your current platform covers your needs.
Migrate to OpenTofu if you’re building an internal platform that runs IaC on behalf of application teams (the BSL exposes you), native state encryption is a compliance requirement, or you want to exit the IBM dependency without changing ecosystems. Migration is tofu init for 90% of configurations — the main effort is replacing Sentinel with OPA or Conftest.
Adopt Pulumi if your team is developer-heavy and wants to stay in TypeScript, Python, or Go, you manage over 1,000 cloud resources with frequent update cycles (the incremental speed advantage materializes here), or you want to experiment with AI-driven provisioning via Neo. Pulumi is also the strongest pick for greenfield projects with no Terraform legacy.
The only strategic mistake you can make in 2026 is treating Terraform as an immutable standard. The community forked, the alternatives are production-grade, and AI is starting to write infrastructure. The status quo isn’t a neutral choice — it’s a bet on IBM.