opentofu-guide by josiahsiegel/claude-plugin-marketplace
npx skills add https://github.com/josiahsiegel/claude-plugin-marketplace --skill opentofu-guide强制要求:在 Windows 上始终对文件路径使用反斜杠
在 Windows 上使用编辑或写入工具时,必须在文件路径中使用反斜杠(\),而不是正斜杠(/)。
示例:
D:/repos/project/file.tsxD:\repos\project\file.tsx这适用于:
除非用户明确要求,否则切勿创建新的文档文件。
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
OpenTofu 是 Terraform 的开源分支,于 2023 年 HashiCorp 将 Terraform 的许可证从 MPL 2.0 更改为 BSL(商业源代码许可证)后创建。OpenTofu 由 Linux 基金会管理,并保持与 Terraform 1.5.x 的完全兼容性,同时增加了社区驱动的功能。
Terraform (HashiCorp):
OpenTofu:
OpenTofu 1.7 功能:
OpenTofu 1.8 功能(最新):
Terraform 优势:
100% 兼容:
迁移路径:
开源要求:
需要状态加密:
成本优化:
社区驱动:
需要企业功能:
企业支持:
高级功能:
成熟的生态系统:
# 检查 Terraform 版本
terraform version
# 必须是 1.5.x 或兼容版本
# 检查提供者版本
terraform providers
# 所有提供者都兼容(相同的注册表)
Windows:
# Chocolatey
choco install opentofu
# Scoop
scoop install opentofu
# 手动安装
# 从 https://github.com/opentofu/opentofu/releases 下载
macOS:
# Homebrew
brew install opentofu
# 手动安装
curl -L https://github.com/opentofu/opentofu/releases/download/v1.8.0/tofu_1.8.0_darwin_amd64.tar.gz | tar xz
sudo mv tofu /usr/local/bin/
Linux:
# Snap
snap install opentofu --classic
# Debian/Ubuntu
curl -fsSL https://get.opentofu.org/install-opentofu.sh | sh
# 手动安装
wget https://github.com/opentofu/opentofu/releases/download/v1.8.0/tofu_1.8.0_linux_amd64.tar.gz
tar -xzf tofu_1.8.0_linux_amd64.tar.gz
sudo mv tofu /usr/local/bin/
# 导航到 Terraform 目录
cd /path/to/terraform/project
# 使用 OpenTofu 初始化(非破坏性)
tofu init
# 验证配置
tofu validate
# 生成计划(与 Terraform plan 比较)
tofu plan
如果不使用状态加密:
# 状态兼容 - 无需迁移
# 只需将命令从 'terraform' 切换到 'tofu'
# 验证状态
tofu show
如果启用状态加密:
# 在 .tofu 文件中配置加密
cat > .tofu <<EOF
encryption {
state {
method = "aes_gcm"
keys {
name = "my_key"
passphrase = env.TOFU_ENCRYPTION_KEY
}
}
plan {
method = "aes_gcm"
keys {
name = "my_key"
passphrase = env.TOFU_ENCRYPTION_KEY
}
}
}
EOF
# 设置加密密钥
export TOFU_ENCRYPTION_KEY="your-secure-passphrase"
# 迁移状态(自动加密)
tofu init -migrate-state
GitHub Actions:
# 之前(Terraform)
- uses: hashicorp/setup-terraform@v3
with:
terraform_version: 1.5.0
# 之后(OpenTofu)
- uses: opentofu/setup-opentofu@v1
with:
tofu_version: 1.8.0
# 或手动安装
- name: 安装 OpenTofu
run: |
curl -fsSL https://get.opentofu.org/install-opentofu.sh | sh
tofu version
Azure DevOps:
# 之前
- task: TerraformInstaller@0
inputs:
terraformVersion: '1.5.0'
# 之后
- task: Bash@3
displayName: '安装 OpenTofu'
inputs:
targetType: 'inline'
script: |
curl -fsSL https://get.opentofu.org/install-opentofu.sh | sh
tofu version
GitLab CI:
# 之前
image: hashicorp/terraform:1.5.0
# 之后
image: ghcr.io/opentofu/opentofu:1.8.0
基本加密:
# .tofu 或 terraform.tf
encryption {
state {
method = "aes_gcm"
keys {
name = "primary_key"
passphrase = env.TOFU_STATE_ENCRYPTION_KEY
}
}
}
密钥轮换:
encryption {
state {
method = "aes_gcm"
keys {
# 新密钥
name = "key_v2"
passphrase = env.TOFU_KEY_V2
# 旧密钥(用于解密)
fallback {
name = "key_v1"
passphrase = env.TOFU_KEY_V1
}
}
}
}
云 KMS 集成:
# AWS KMS
encryption {
state {
method = "aws_kms"
keys {
name = "aws_key"
kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
}
}
}
# Azure Key Vault
encryption {
state {
method = "azurerm_key_vault"
keys {
name = "azure_key"
key_vault_key_id = "https://myvault.vault.azure.net/keys/mykey/version"
}
}
}
# GCP KMS
encryption {
state {
method = "gcp_kms"
keys {
name = "gcp_key"
kms_crypto_key = "projects/PROJECT_ID/locations/LOCATION/keyRings/RING/cryptoKeys/KEY"
}
}
}
安全存储密钥:
# 切勿提交密钥
echo "TOFU_ENCRYPTION_KEY=xxx" >> .env
echo ".env" >> .gitignore
# 使用 CI/CD 密钥
# GitHub:仓库设置 → 密钥
# Azure DevOps:流水线 → 变量 → 密钥
定期轮换密钥:
# 生成新密钥
NEW_KEY=$(openssl rand -base64 32)
# 添加到备用密钥,更新配置
# 迁移状态
tofu init -migrate-state
备份未加密状态:
# 在启用加密之前
terraform state pull > backup-unencrypted.tfstate
# 启用加密
tofu init -migrate-state
# 验证
tofu state pull # 在后端应该是加密的
Terraform 1.5+(单次导入):
import {
to = azurerm_resource_group.example
id = "/subscriptions/.../resourceGroups/my-rg"
}
OpenTofu 1.7+(循环导入):
# 导入多个资源组
locals {
resource_groups = {
"rg1" = "/subscriptions/.../resourceGroups/rg1"
"rg2" = "/subscriptions/.../resourceGroups/rg2"
"rg3" = "/subscriptions/.../resourceGroups/rg3"
}
}
import {
for_each = local.resource_groups
to = azurerm_resource_group.imported[each.key]
id = each.value
}
resource "azurerm_resource_group" "imported" {
for_each = local.resource_groups
name = each.key
location = "eastus"
}
Terraform 1.5.x:
# terraform 块中不允许使用变量
terraform {
required_version = ">= 1.5.0" # 仅静态值
backend "azurerm" {
resource_group_name = "terraform-state" # 仅静态值
storage_account_name = "tfstate"
}
}
OpenTofu 1.7+:
# terraform 块中允许使用变量
variable "environment" {
type = string
}
terraform {
required_version = ">= 1.7.0"
backend "azurerm" {
resource_group_name = "terraform-state-${var.environment}"
storage_account_name = "tfstate${var.environment}"
key = "${var.environment}.tfstate"
}
}
OpenTofu 1.8+(模块源):
variable "module_version" {
type = string
default = "v1.0.0"
}
module "networking" {
source = "git::https://github.com/org/module.git?ref=${var.module_version}"
# 动态模块版本!
}
# 1. 备份现有状态
terraform state pull > backup.tfstate
# 2. 安装 OpenTofu
brew install opentofu
# 3. 测试兼容性
tofu init
tofu plan
# 4. 切换到 OpenTofu
alias terraform=tofu # 可选:保持肌肉记忆
# 5. 验证一切正常
tofu apply
# 1. 生成加密密钥
ENCRYPTION_KEY=$(openssl rand -base64 32)
echo "TOFU_ENCRYPTION_KEY=$ENCRYPTION_KEY" >> .env.production
# 2. 创建加密配置
cat > .tofu <<EOF
encryption {
state {
method = "aes_gcm"
keys {
name = "prod_key"
passphrase = env.TOFU_ENCRYPTION_KEY
}
}
plan {
method = "aes_gcm"
keys {
name = "prod_key"
passphrase = env.TOFU_ENCRYPTION_KEY
}
}
}
EOF
# 3. 带加密迁移
source .env.production
tofu init -migrate-state
# 4. 验证加密
tofu state pull # 状态现在在后端是加密的
# .github/workflows/terraform.yml
name: 基础设施
on: [push, pull_request]
jobs:
opentofu:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: 设置 OpenTofu
uses: opentofu/setup-opentofu@v1
with:
tofu_version: 1.8.0
- name: 初始化
run: tofu init
env:
TOFU_ENCRYPTION_KEY: ${{ secrets.TOFU_ENCRYPTION_KEY }}
- name: 计划
run: tofu plan
env:
ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
TOFU_ENCRYPTION_KEY: ${{ secrets.TOFU_ENCRYPTION_KEY }}
- name: 应用
if: github.ref == 'refs/heads/main'
run: tofu apply -auto-approve
env:
ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
TOFU_ENCRYPTION_KEY: ${{ secrets.TOFU_ENCRYPTION_KEY }}
所有 Terraform 命令在 OpenTofu 中工作方式相同(只需将 terraform 替换为 tofu):
# Terraform # OpenTofu
terraform init → tofu init
terraform plan → tofu plan
terraform apply → tofu apply
terraform destroy → tofu destroy
terraform state → tofu state
terraform import → tofu import
terraform validate → tofu validate
terraform fmt → tofu fmt
terraform output → tofu output
OpenTofu 社区:
Terraform 社区:
| 因素 | Terraform | OpenTofu |
|---|---|---|
| 许可证 | BSL(专有) | MPL 2.0(开源) |
| 状态加密 | 通过 HCP Terraform(付费) | 内置(免费) |
| 企业功能 | HCP Terraform(Stacks、HYOK) | 社区替代方案 |
| 治理 | HashiCorp/IBM | Linux 基金会 |
| 支持 | 商业支持可用 | 社区驱动 |
| 创新 | HCP 导向 | 社区导向 |
| 成本 | 免费 CLI,付费云 | 完全免费 |
| 兼容性 | 向前兼容 | Terraform 1.5.x 兼容 |
在以下情况从 OpenTofu 开始:
在以下情况继续使用 Terraform:
易于切换:
此技能为 terraform-expert 代理提供了全面的 OpenTofu 知识。
每周安装次数
80
仓库
GitHub 星标数
21
首次出现
2026年1月24日
安全审计
安装于
opencode65
gemini-cli63
codex62
cursor58
claude-code57
github-copilot56
MANDATORY: Always Use Backslashes on Windows for File Paths
When using Edit or Write tools on Windows, you MUST use backslashes (\) in file paths, NOT forward slashes (/).
Examples:
D:/repos/project/file.tsxD:\repos\project\file.tsxThis applies to:
NEVER create new documentation files unless explicitly requested by the user.
OpenTofu is the open-source fork of Terraform, created in 2023 after HashiCorp changed Terraform's license from MPL 2.0 to BSL (Business Source License). OpenTofu is stewarded by the Linux Foundation and maintains full compatibility with Terraform 1.5.x while adding community-driven features.
Terraform (HashiCorp):
OpenTofu:
OpenTofu 1.7 Features:
OpenTofu 1.8 Features (Latest):
Terraform Advantages:
100% Compatible:
Migration Path:
Open-Source Requirements:
State Encryption Needed:
Cost Optimization:
Community-Driven:
Enterprise Features Required:
Enterprise Support:
Advanced Features:
Established Ecosystem:
# Check Terraform version
terraform version
# Must be 1.5.x or compatible
# Check provider versions
terraform providers
# All providers compatible (same registry)
Windows:
# Chocolatey
choco install opentofu
# Scoop
scoop install opentofu
# Manual
# Download from https://github.com/opentofu/opentofu/releases
macOS:
# Homebrew
brew install opentofu
# Manual
curl -L https://github.com/opentofu/opentofu/releases/download/v1.8.0/tofu_1.8.0_darwin_amd64.tar.gz | tar xz
sudo mv tofu /usr/local/bin/
Linux:
# Snap
snap install opentofu --classic
# Debian/Ubuntu
curl -fsSL https://get.opentofu.org/install-opentofu.sh | sh
# Manual
wget https://github.com/opentofu/opentofu/releases/download/v1.8.0/tofu_1.8.0_linux_amd64.tar.gz
tar -xzf tofu_1.8.0_linux_amd64.tar.gz
sudo mv tofu /usr/local/bin/
# Navigate to Terraform directory
cd /path/to/terraform/project
# Initialize with OpenTofu (non-destructive)
tofu init
# Validate configuration
tofu validate
# Generate plan (compare with Terraform plan)
tofu plan
If NOT using state encryption:
# State is compatible - no migration needed
# Just switch from 'terraform' to 'tofu' commands
# Verify state
tofu show
If ENABLING state encryption:
# Configure encryption in .tofu file
cat > .tofu <<EOF
encryption {
state {
method = "aes_gcm"
keys {
name = "my_key"
passphrase = env.TOFU_ENCRYPTION_KEY
}
}
plan {
method = "aes_gcm"
keys {
name = "my_key"
passphrase = env.TOFU_ENCRYPTION_KEY
}
}
}
EOF
# Set encryption key
export TOFU_ENCRYPTION_KEY="your-secure-passphrase"
# Migrate state (automatically encrypts)
tofu init -migrate-state
GitHub Actions:
# Before (Terraform)
- uses: hashicorp/setup-terraform@v3
with:
terraform_version: 1.5.0
# After (OpenTofu)
- uses: opentofu/setup-opentofu@v1
with:
tofu_version: 1.8.0
# Or manual install
- name: Install OpenTofu
run: |
curl -fsSL https://get.opentofu.org/install-opentofu.sh | sh
tofu version
Azure DevOps:
# Before
- task: TerraformInstaller@0
inputs:
terraformVersion: '1.5.0'
# After
- task: Bash@3
displayName: 'Install OpenTofu'
inputs:
targetType: 'inline'
script: |
curl -fsSL https://get.opentofu.org/install-opentofu.sh | sh
tofu version
GitLab CI:
# Before
image: hashicorp/terraform:1.5.0
# After
image: ghcr.io/opentofu/opentofu:1.8.0
Basic Encryption:
# .tofu or terraform.tf
encryption {
state {
method = "aes_gcm"
keys {
name = "primary_key"
passphrase = env.TOFU_STATE_ENCRYPTION_KEY
}
}
}
Key Rotation:
encryption {
state {
method = "aes_gcm"
keys {
# New key
name = "key_v2"
passphrase = env.TOFU_KEY_V2
# Old key (for decryption)
fallback {
name = "key_v1"
passphrase = env.TOFU_KEY_V1
}
}
}
}
Cloud KMS Integration:
# AWS KMS
encryption {
state {
method = "aws_kms"
keys {
name = "aws_key"
kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
}
}
}
# Azure Key Vault
encryption {
state {
method = "azurerm_key_vault"
keys {
name = "azure_key"
key_vault_key_id = "https://myvault.vault.azure.net/keys/mykey/version"
}
}
}
# GCP KMS
encryption {
state {
method = "gcp_kms"
keys {
name = "gcp_key"
kms_crypto_key = "projects/PROJECT_ID/locations/LOCATION/keyRings/RING/cryptoKeys/KEY"
}
}
}
Store Keys Securely:
# Never commit keys
echo "TOFU_ENCRYPTION_KEY=xxx" >> .env
echo ".env" >> .gitignore
# Use CI/CD secrets
# GitHub: Repository Settings → Secrets
# Azure DevOps: Pipeline → Variables → Secret
Rotate Keys Regularly:
# Generate new key
NEW_KEY=$(openssl rand -base64 32)
# Add to fallback, update configs
# Migrate state
tofu init -migrate-state
Backup Unencrypted State:
# Before enabling encryption
terraform state pull > backup-unencrypted.tfstate
# Enable encryption
tofu init -migrate-state
# Verify
tofu state pull # Should be encrypted in backend
Terraform 1.5+ (Single Imports):
import {
to = azurerm_resource_group.example
id = "/subscriptions/.../resourceGroups/my-rg"
}
OpenTofu 1.7+ (Loop Imports):
# Import multiple resource groups
locals {
resource_groups = {
"rg1" = "/subscriptions/.../resourceGroups/rg1"
"rg2" = "/subscriptions/.../resourceGroups/rg2"
"rg3" = "/subscriptions/.../resourceGroups/rg3"
}
}
import {
for_each = local.resource_groups
to = azurerm_resource_group.imported[each.key]
id = each.value
}
resource "azurerm_resource_group" "imported" {
for_each = local.resource_groups
name = each.key
location = "eastus"
}
Terraform 1.5.x:
# Variables NOT allowed in terraform block
terraform {
required_version = ">= 1.5.0" # Static only
backend "azurerm" {
resource_group_name = "terraform-state" # Static only
storage_account_name = "tfstate"
}
}
OpenTofu 1.7+:
# Variables allowed in terraform block
variable "environment" {
type = string
}
terraform {
required_version = ">= 1.7.0"
backend "azurerm" {
resource_group_name = "terraform-state-${var.environment}"
storage_account_name = "tfstate${var.environment}"
key = "${var.environment}.tfstate"
}
}
OpenTofu 1.8+ (Module Sources):
variable "module_version" {
type = string
default = "v1.0.0"
}
module "networking" {
source = "git::https://github.com/org/module.git?ref=${var.module_version}"
# Dynamic module version!
}
# 1. Backup existing state
terraform state pull > backup.tfstate
# 2. Install OpenTofu
brew install opentofu
# 3. Test compatibility
tofu init
tofu plan
# 4. Switch to OpenTofu
alias terraform=tofu # Optional: maintain muscle memory
# 5. Verify everything works
tofu apply
# 1. Generate encryption key
ENCRYPTION_KEY=$(openssl rand -base64 32)
echo "TOFU_ENCRYPTION_KEY=$ENCRYPTION_KEY" >> .env.production
# 2. Create encryption config
cat > .tofu <<EOF
encryption {
state {
method = "aes_gcm"
keys {
name = "prod_key"
passphrase = env.TOFU_ENCRYPTION_KEY
}
}
plan {
method = "aes_gcm"
keys {
name = "prod_key"
passphrase = env.TOFU_ENCRYPTION_KEY
}
}
}
EOF
# 3. Migrate with encryption
source .env.production
tofu init -migrate-state
# 4. Verify encryption
tofu state pull # State is now encrypted in backend
# .github/workflows/terraform.yml
name: Infrastructure
on: [push, pull_request]
jobs:
opentofu:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup OpenTofu
uses: opentofu/setup-opentofu@v1
with:
tofu_version: 1.8.0
- name: Init
run: tofu init
env:
TOFU_ENCRYPTION_KEY: ${{ secrets.TOFU_ENCRYPTION_KEY }}
- name: Plan
run: tofu plan
env:
ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
TOFU_ENCRYPTION_KEY: ${{ secrets.TOFU_ENCRYPTION_KEY }}
- name: Apply
if: github.ref == 'refs/heads/main'
run: tofu apply -auto-approve
env:
ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
TOFU_ENCRYPTION_KEY: ${{ secrets.TOFU_ENCRYPTION_KEY }}
All Terraform commands work identically in OpenTofu (just replace terraform with tofu):
# Terraform # OpenTofu
terraform init → tofu init
terraform plan → tofu plan
terraform apply → tofu apply
terraform destroy → tofu destroy
terraform state → tofu state
terraform import → tofu import
terraform validate → tofu validate
terraform fmt → tofu fmt
terraform output → tofu output
OpenTofu Community:
Terraform Community:
| Factor | Terraform | OpenTofu |
|---|---|---|
| License | BSL (Proprietary) | MPL 2.0 (Open Source) |
| State Encryption | Via HCP Terraform (paid) | Built-in (free) |
| Enterprise Features | HCP Terraform (Stacks, HYOK) | Community alternatives |
| Governance | HashiCorp/IBM | Linux Foundation |
| Support | Commercial support available | Community-driven |
| Innovation | HCP-focused | Community-focused |
| Cost | Free CLI, paid cloud | Completely free |
| Compatibility |
Start with OpenTofu if:
Stay with Terraform if:
Easy to Switch:
This skill provides comprehensive OpenTofu knowledge for the terraform-expert agent.
Weekly Installs
80
Repository
GitHub Stars
21
First Seen
Jan 24, 2026
Security Audits
Gen Agent Trust HubFailSocketPassSnykPass
Installed on
opencode65
gemini-cli63
codex62
cursor58
claude-code57
github-copilot56
Capacitor推送通知插件教程:iOS/Android集成Firebase与APNs实现推送
72 周安装
ActiveCampaign自动化集成指南:通过Rube MCP实现CRM与营销自动化
72 周安装
通过Rube MCP实现Make自动化:集成Composio工具包管理场景与操作
72 周安装
Microsoft Teams自动化指南:通过Rube MCP实现频道消息、聊天与会议管理
72 周安装
Electrobun 最佳实践:TypeScript + Bun 跨平台桌面应用开发指南
72 周安装
ATXP Memory:AI代理记忆管理工具 - 云端备份与本地向量搜索
72 周安装
| Forward-compatible |
| Terraform 1.5.x compatible |