Exploring OpenTofu with env0’s Roni Frantchi

This is Techstrong tv. Hey everyone. Welcome back here to Techstrong tv.

Uh, my next guest is Roddy Franci. Roddy is the Director of Engineering at Ed Vero. And more importantly for today's conversation, he is a founding member of Open Tofu.

For those of you not familiar with Open tofu, open Tofu is now A-C-N-C-F part of the Linux Foundation project. It was really set up, I guess, as a fork. Uh, I, I don't think Ronnie will disagree, maybe he will as a fork of, of, uh, Hashi Corps, uh, product.

And, and it came about, it's been controversial and we're going to get into it, but it came about as a result of, of HashiCorp changing the license. Um, and this is something that's been going on, right? We've seen Red Hat change some licenses lately, HashiCorp, there's been some others, but let's welcome Ronnie to our show.

Hey, Ronnie, how are you? Nice to meet you here. Hey, and I'm happy to be here.

How are you doing? Very well. So, Ronnie, I, I did my best 'cause I wanted to be even handed, right?

I didn't want to take sides. I'm the, I'm the host, the moderator, but what did I get right? What did I get wrong?

In your words, how did we get here to open Tofu? Right. So, um, I think you got most of it, right?

Um, I think, um, generally the, the drive really behind Open tofu, it, it started as a manifesto, right? Kind of as a pledge to a HashiCorp, um, kind of also acknowledging some of the things that mentioned, uh, that kind of drove them towards staking turf from away from being open source and making its source available. Um, it is, it is definitely difficult for a company to maintain an open source.

There's definitely an a heads there. Um, they've mentioned how, um, essentially, um, taco providers such as M zero and others, uh, are profiting off of that, um, uh, open, uh, open source, um, in a similar fashion to, to how they do in expanding and providing a platform and service to, to, to better deliver and manage their infrastructures, code tools. Um, and kind of the pledge originally was yeah, we totally get that.

Um, and, and, and again, there's those sites with story, right? Because M zero stands has been the contributor to, to, um, the community in TER projects like og. And, uh, we know that from our peers as well.

At Grant Works, we have committed, uh, Terra Grants, which is a huge open source project, right? So there, there's been been tons of contributions from, um, different companies who have pledged for open tofu, um, towards making this community brick, of course, users all over the world of community to making this community made. Um, on the other hand, yes, there is an overhead of maintaining that and being aiming terror or solving terror.

Kinda the pledge was, we get that. Um, how about we kind of go, you know, the Google way and how they've done that to contribute Kubernetes to the UX foundation and the CNC platform, right? Um, you can contribute open source that the company has founded and basically passed it on to a vendor neutral approach where young company is not the only one or sold retailer to kinda, uh, uh, increase your margins from, from that open source project, right?

But keep it open source, but not, uh, not keep it as source available at, at any given point. Um, that pledge, uh, I think remain unanswered, uh, for a while until we kind of said, okay, if that will remain unanswered for a long while, I think it was publishing kind of an, as an open letter to, to HashiCorp and, and, uh, and the founders, um, it's been listed in Forbes Magazine, then also looking for a comment about that. Nothing came back.

Basically we heard nothing back. Um, and at that point, I think the community decided, okay, this is kinda was part of the pledge. We may, we are looking to maintain Terraform open source as much as we can, right?

So if that means that how she will not answer the pledge, that is fine. We'll carry it on from here and make sure the Terraform has any open source future. Um, the community and its users will continue to have an open source equivalent of Terra Home, uh, the kick and maintain.

Uh, and this is kind of where, how it started, how we got there. Um, and it's been, it's been a, a monumental success. I think we've seen that.

We've seen, uh, Hudson community all over. Um, we've been accepted to the Linux Foundation, which was kind of the core of what we're doing, but from the beginning, what we were asking from HashiCorp, Hey, this should be not in the hands of N zero or, or Space Lift or turn brands or any of these vendors. This should be really, um, a vendor mutual project where everyone can really, uh, carry on in their business and, and carry on the open source project for them.

And this is what we did, which is now part of the foundation. We've had our first open tofu day, uh, in, in Q Con eu, which, which turned out to be a huge turnout crowd, uh, was really excited to, to, to having what, um, and this is where we are today, really. Um, Absolutely.

So as we were talking off camera before we started, you know, my experience in this type of thing is from the security world where I've been a member 25 years, and back in the day, maybe 2004, 2005, I had started a security or co-founded a security company outta Boulder, Colorado called Still Secure. And we, we had intrusion prevention network access control, vulnerability management back then, many providers under the hood were using open source tools such as the Snort IPS, which Marty Rash and the Sourcefire team had pioneered, uh, as the vulnerability scanner were No, Jason Rod Gula from Tenable were, were maintaining that. And, you know, they both had the same issues that Hasi did, right?

Which was primarily they had to compete with companies that were leveraging the open source tools that they themselves were supporting. Mm-Hmm. They were financing the open source tools, solely financing it, though other people might have contributed code or whatever, but they were financing it and then it was being used against them, so to speak.

Now, that was a very different time though in open source, Ronnie, that's what I call during what I call the big brother era of open source, where you had like one company that would own an open source project, right? They'd own the ip, though it was still open source, and they ran that project with their own benefit, basically. I mean, yes, they did it for the good of the community, but it was for their own and solely own benefit.

Right. And that didn't work. Right.

Go ahead. Right. No, I, I totally connected.

And, and also by the way, it's, it's, it's been very apparently Terra, I think, and in terms of, of how the community, uh, accepts contribution into that project, right? Um, some contributions such as, uh, state encryption, which has now made it to open to and few others have been kind of offered an alternative in the commercial product. And that, that kind of point puts the, the company lead or the vendor behind the Yeah.

Makes them say, Hey, I mean, why would we promote that? And it's, and it's been kind of silently. And again, they didn't say, whoa, it's No, it's not, it's real Issue, right?

Yeah. We see this, even I, I remember having this discussion with Deb Brody, uh, the CEO of GitLab, GitLab's Open source people contribute code to GitLab all the time. Who owns the code?

If I contribute code to it, there's, I'm in essence signing my IP rights to the code that I wrote over to the project, told her. Right. Now, some people don't mind doing that, but when you become a significant contributor of code and all the code that you wrote, you don't own, you can't necessarily use it unless someone else is gonna give you permission that that becomes trouble.

Right. And, and, and an issue, and I think that's one of the issues here, but like I, as I was saying before, open Source has change. The open source models have changed since 2004, 2005.

We've gone from this Big Brother era to what I call the foundation era. We have all these foundations, the Linux Foundation, cloud Native Computing Foundation, CD Foundation, eclipse, Apache, there, there's many of them. And the idea behind it is it allows companies and contributors to all lay on an even keel on an even plane.

And then from that base, open source, people can build what they want. Right? But everybody starts at this base, and then you go your way, this way or that way.

Yeah. Clearly, Hashi, Hashi did not, though they were supporters of CNDF and everything else, they didn't buy into that model, right? Right.

They sold that, they opened this lock, stock, and barrel. Right? Exactly.

And, and again, the, the, there's some concern there. I mean, I think this is one of the reasons why we see huge blooms of projects under the CN Cs, right? And this is why this is been our target.

And, and like I said, there, there's very foundation that we've, by the way we've opened Tofu has been approached by several, I won't mention names, but they actually approached by several. And then, um, and then, and, and we can see it that all the CN CCF Foundation, Kubernetes and BU cd, and there's plenty more out there that that totally bloom and, and, and, uh, are not at all risk as we've seen here, of becoming vendor locked, um, very quickly, right? Because essentially, really the only thing that Hashi changed is that, right?

A very minor, uh, added essentially like a very minor, um, uh, item into the license, right? A very minor limiting item. But then it becomes, okay, so now at this point, it means that for a cloud solution that revolves around anything Terra from IS building or maybe maybe also in the future in other products as well, it also, by the way, also issue for Vault.

And we've seen that with Open Bow in that movement. Um, so there's some risk there that, and we've seen that right now you are ba basically becoming a vendor lock to, um, a commercial solution. So you pick a framework and open source framework that works well for you.

But then as you kind of, uh, start getting more mature with that framework, then you're looking for a solution. You, you realize that your vendor locked to only one commercial solution around that open source framework, which is not open source anymore, right? Um, and I think that this is kind of becoming even an even greater issue when you look at, um, acquisition, right?

IBM just bought HashiCorp, and then it makes other cloud vendors realize, okay, well wait second, this affect us. And we see this kind of shift in movement, right? All of the open source projects between Brew GitLab, um, Alpine kind of withdrawal their, um, um, um, ability to install or use Terra or Terra phone templates by default, you need to actually add that repository as as a third party because it is no longer open source.

Um, mm-Hmm. And it may have moved open to in return, right? You see this also migration coming from big vendors, uh, Oracle this just the other week had, you know, uh, moved its cloud vendor platform to use Open Tofu instead of Terraform and encouraged their users to upgrade to the version that use Open Tofu instead of Terra, uh, precisely because of that reason, right?

You becoming kind of, they're starting to realize the, the, the issue of becoming locked under a given vendor and when using that framework, um, and as they hear that it's, uh, there is an open source on that is a drop in replacement. It is managed and governed by CNC Linux Foundation more precisely, um, that becomes more appealing to, um, basically this is a, a better time to ship right now, right? I mean, right now the projects are totally, um, it, it, um, kind of interoperable, right?

It's, you can switch between Terraform to open tofu, give it a ride, give a try, and then switch back simply by changing the keyword, the command in which you're invoking the program. Um, so yes, there are opt-in features that exist in open Tofu, and you can start using them, like I mentioned, said description. And we look at, we're looking for other enhances, but right now there's a totally opt-in, so you can easily switch back and forth.

Um, I think this is kind of been a, a major drive in the huge community adoption we're seeing from both enterprises and, and the Absolutely, you know, even before the Big Brother era of open source, there was what I call the cathedral and the bazaar, right? For anyone who's not, who really wants to understand open source and kind of the background on it, read that book. It's a great book.

Um, and this goes back to one like Dr. Richard Stallman and a lot of the founders of the modern open source software movement were, were doing. But one of the things that came out of that era was don't mess with the licenses, right?

The OSI, the open source initiative, they approved, I had, I I, back then it was six or seven licenses, but they were approved licenses to ensure this even playing field that people can rely upon the software, that they were gonna be able to use it, that they weren't going to get their, the rug pulled out from under them, right? That they weren't going to get locked in what have you. And so, a tenant of open source, and I lived through this firsthand, again, back in the early two thousands, is for it to be open source, you gotta use an open source.

OSI approved license. You can't make up licenses, right? Because once we start changing a word here and there, and the lawyers get involved in that aspect of it, you don't have that foundation under you.

You don't, that rug could be pulled out and, and Exactly. So that's an important aspect of what makes open source open source. Yes, there's a community, yes, the source code is available, but yes, there's a, an approved license that governs the use of the software.

If you make modifications, you gotta put it back into the community, right? It doesn't have to be accepted into the main trunk, but you've gotta make it put back in and, and, and these kinds of things. So, you know, the fallout of this one though has been pretty remarkable, right?

Because I, I've been a fan of Mitchell Hashimoto for as long as I've been, you know, since I first became aware of HashiCorp over 10, 12 years ago, 10 years ago at least. Mitchell was a teenager almost, I think at that point. Yeah.

Still. Um, now of course, he left Hashi in December. How much of this was he on board with, I, I'm not gonna speculate, but clearly the outcry from the community here, it wasn't just your normal fork, right?

Another good friend of mine, right? JK KO Que was the person who fork hudsons it into Jenkins, Right? Mm-Hmm.

If you remember, Jenkins is more than popular, right? For Yeah, exactly. I'd say it's been, it's had some decent success.

Um, Yeah. But I don't know if it was as controversial as, as Open Tofus become, uh, there's been a lot of pushback on Hasi, and I think the result of it is, as we've seen Hasi been sold, or, you know, there's a, a deal on the table with IBM here, uh, but it really might have affected their, their valuation and everything, right? Yeah, exactly.

So I, I mean, again, no stipulations. We don't know what came before, what, right? Whether they, the changes should be acquired or they've been acquired, um, after changing or, you know, it wasn't in, in the, out of the talks and all, so we don't know.

Um, but, but yes, there's definitely kind of a fallout and, and, and it has been con controversial. This is mostly because this is such a popular project, right? And so many people u are using it and, um, the opinion can be different.

Um, and you can look at it from any angle here and say, um, like, we, we empathize with, with, with HashiCorp side of Yeah, right? We, we really value their, uh, everything they've put into the project and everything they've did for this community, um, thus far. And, and again, until the, the license changed, this has been a huge, um, um, upside for everyone, I think.

Um, so we understand there, and we also, we are also a commercial vendor. We understand that commercial vendors have the reasons to change licenses. Um, but on the other hand, we also realize that, um, and, and again, the kind of been, um, what's been assert by the community and the, and the, and the most of the feedbacks was that, um, when you deploy your infrastructure to production by so many companies and enterprises, and, uh, they've given their con voting confidence to an open source project in using it, then contributing back to it, uh, all the benefits, I think basically turf would, would not have made it to, um, to where it is and it's popularity without, without its audience, without its users, without its community.

That's it. It has been built. Um, so I think one of the reasons that this has been kind of such a backlash is, um, that there has been a big portion that kind of fed be trade right in, in saying we've, we put so many efforts and we've, we've betted basically we're confident that we're using an open source.

We have alternatives. We can use it however we think we, we want to use it. We can deploy it however we think we want to deploy it, whether it being in one vendor or or another.

It's fine. And, and you know that it's not a monopoly. And you know that the commercial vendor will not just, you know, double the prices of using its cloud platform.

We sell offering, because you're locked into their, basically they will be the only way to, uh, govern and manage and, and deploy your telephone code in, in an effective and scalable way. Um, and then when, when that happens, uh, you can see exactly what happened here, right? There've been a huge and vast community that says, Hey, this, we, we started with this being an open source.

We want to continue using it as an open source. We will look for an open source alternative. Um, and this is exactly how, how it came to be.

Excellent. Roddy, we're past our 15 minutes. I want to, uh, thank you for coming on and kind of setting the record straight here on Open Tofu.

You know what we didn't mention for people who wanna go download it or read more or get involved, what's the website? Absolutely. So you can check us out at open tofu uh, dot org.

Um, and you can, sorry, you can download us via brewing stall or whatever platform we're using. Uh, we're Jonathan, the Slack community. org.

Um, that's it coming up soon with tons of cool features. Check us out on GitHub too. Absolutely.

That's it. Alrighty. Hey Ronnie, thanks for coming on Tech Trunk tv.

We'll see you soon. Take care, and best of luck with Open Tofu. Thank you.

See you soon. Bye-Bye. All right, we're gonna take a break here on Tech Trunk tv.

We'll be back in just a moment.