OpenTofu Crosses CNCF Sandbox Status While HCP Terraform Caps Its Free Tier at 500 Resources: What a BSL-Free IaC Layer Actually Buys a Cluster-API Fleet

HashiCorp has changed the deal on Terraform users twice in three years. In August 2023, it relicensed the open-source binary from MPL 2.0 to the Business Source License, restricting who could build a competing product on top of it. On March 31, 2026, HCP Terraform's legacy free plan — unlimited managed resources, gated only by user count — went end-of-life, replaced by a "free" tier capped at 500 managed resources and paid tiers running $0.10 to $0.99 per resource per month above that.

Neither change breaks a self-hosted platform's ability to keep running terraform apply against its own infrastructure. But both are the same signal: the tool underneath your provisioning layer is now owned by IBM, and the terms move when IBM decides they move. OpenTofu — the Linux Foundation-governed fork that split from Terraform the day the BSL switch was announced — reached CNCF Sandbox status in April 2025, ships state encryption and provider for_each that Terraform's open binary still doesn't have, and now runs in production at Fidelity, Capital One, and Boeing. For a platform whose entire pitch is owned infrastructure with no vendor who can change the terms underneath it, that's not a marginal technical upgrade. It's the more consistent choice. Here's the concrete case, including where it isn't yet a clean win.

What the BSL actually restricts — and what it doesn't​

Most explanations of Terraform's license change lean on vague dread. The actual text is narrower than that, and worth reading precisely before deciding it matters to you.

HashiCorp's BSL 1.1 permits "all non-production and production usage" of Terraform, with one carve-out: you can't offer a "competitive offering" — a product sold to third parties, including via paid support, that significantly overlaps a HashiCorp commercial product. The license separately defines "embedded" to cover shipping Terraform's code inside a competing product, or requiring Terraform to be downloaded for that competing product to run.

Read closely, that means: a platform team running Terraform or OpenTofu internally to provision its own infrastructure — the exact use case for a Cluster-API fleet's bootstrap layer — was never restricted by the BSL in the first place. The license targets companies like Spacelift, Scalr, env0, and Harness, whose products are a hosted Terraform-execution layer sold in competition with HCP Terraform. If your roadmap never includes reselling Terraform-as-a-service to third parties, the BSL's actual legal bite doesn't reach you.

So what's the real argument for OpenTofu, if not "the license makes Terraform illegal to use"? Two things, and they're both about optionality, not compliance:

1. A vendor that's relicensed once can do it again. The BSL terms themselves — the exact competitive-use carve-out — are HashiCorp's to redraw at the next major version, the way IBM redrew HCP Terraform's free-tier resource limits in March 2026 without touching the CLI's license at all.
2. The commercial product wrapped around the open tool keeps getting less generous, and a growing platform is exactly the kind of user that outgrows a resource cap it didn't expect.

That second point has a number attached to it. Keep reading.

Where IaC actually sits in a Cluster-API fleet​

It's worth correcting a common assumption before going further: Cluster API Provider Hetzner (CAPH) doesn't run on Terraform. It's a native Go controller that reconciles HCloudMachine and HetznerBareMetalMachine custom resources by calling the Hetzner Cloud and Robot APIs directly, continuously, the same way any Kubernetes controller reconciles state — no terraform apply in the loop, no drift only caught at the next scheduled run.

Terraform or OpenTofu's actual job sits one layer below that: the one-shot bootstrap that has to exist before Cluster API has anything to reconcile. That's a small, static set of resources — a Hetzner network and subnets, firewall rules, a DNS zone, an object-storage bucket to hold state and Velero backups, a KMS key, the initial management-cluster load balancer. Cluster API takes it from there, managing every Machine and MachineDeployment in the fleet through its own control loop, not an IaC tool's.

That distinction matters for sizing the actual decision. A fleet's bootstrap-IaC layer isn't tracking thousands of dynamically created tenant resources — those are Cluster API's job, and a PaaS's own controllers handle per-tenant DNS records, certificates, and ingress rules directly against the relevant APIs, not through a Terraform state file. What OpenTofu vs. Terraform decides is the tool provisioning the handful of foundational resources everything else stands on.

The concrete feature delta in 2026​

Terraform's open-source binary hasn't shipped a major CLI feature since the BSL switch; HashiCorp's engineering investment has gone into HCP Terraform's paid tiers instead. OpenTofu spent that same window shipping directly into the open CLI:

None of these exist in Terraform's open binary today. State encryption is the one that matters most for a bootstrap layer holding the state file for a fleet's network, firewall, and KMS configuration: Terraform users get equivalent protection only by leaning on a backend's server-side encryption (S3 SSE, for instance), which protects the object at rest in that specific backend but not the state contents in transit or in a local plan file.

The ecosystem gap has closed too. As of mid-2026, OpenTofu's own registry lists more than 3,900 providers and 23,600 modules — including the hetznercloud/hcloud provider a Cluster-API-based platform's bootstrap layer would actually use — up from a common "still catching up" narrative from 2024. Provider compatibility is no longer the practical blocker it once was.

The concrete cost delta​

HCP Terraform's new free tier — 500 managed resources, unlimited users — replaced a plan that had no resource ceiling at all. Run the numbers both ways for a bootstrap-IaC layer sized the way the section above describes:

• A single-region fleet — one network, a handful of subnets and firewall rules, one DNS zone, one state bucket, one KMS key, one load balancer — lands around 30-80 tracked resources. That stays comfortably inside the new free cap either way; this isn't where the cost argument bites.
• A multi-region fleet with compliance-driven segmentation — separate networks and firewall policies per region, per-region DNS zones and load balancers, additional KMS keys for tenant-data-residency requirements — realistically runs 500-2,000 tracked resources once a platform is operating in three or four regions with real access controls. That crosses HCP Terraform's free cap and lands in its $0.10-$0.99-per-resource-per-month paid tiers: $50-$1,980 a month, recurring, for the privilege of remote state hosting on a resource set a self-hosted OpenTofu backend — an object-storage bucket on the same owned Hetzner fleet, with native state encryption and no per-resource meter — handles for the cost of the bucket itself, cents a month.

The point isn't that every team crosses that line immediately. It's that the free tier's ceiling is now a real number a growing multi-region platform will eventually hit, on a resource count that was never metered before March 2026 and could be re-priced again. A self-hosted OpenTofu backend has no equivalent ceiling to plan around.

Who's already made the bet​

This isn't a hypothetical migration. IBM closed its $6.4 billion acquisition of HashiCorp on February 27, 2025, and roughly two months later, on April 23, 2025, OpenTofu was accepted into the CNCF as a Sandbox project — notably, with the CNCF Governing Board granting a special exception to accept an MPL-2.0-licensed project, since CNCF policy otherwise requires Apache 2.0. That's a foundation whose entire credibility rests on vendor-neutral governance choosing to bend its own rule for this specific fork, in the immediate aftermath of Terraform's steward changing hands.

The clearest production case study is Fidelity Investments: more than 50,000 state files and 4 million-plus cloud resources across 2,000+ applications, migrated with roughly 70% of projects moved in two quarters — reported by Fidelity's own team as an organizational rollout problem, not a technical rewrite, since OpenTofu tracks Terraform's HCL syntax and state format closely enough to be a drop-in swap for most modules. Capital One is cited as moving specifically to avoid BSL uncertainty. Boeing, AMD, Oracle (for its E-Business Suite Cloud Manager), and VMware's Tanzu division are named as production adopters in industry coverage, though those citations are secondary-sourced compared to Fidelity's own published account and worth treating with correspondingly less certainty. A 2026 State of IaC survey put OpenTofu at roughly 12% adoption among IaC practitioners overall, with another 27% planning to evaluate or expand its use — a fork, not a fringe experiment, three years post-split.

What OpenTofu still doesn't have​

The honest gaps are real, and they're the reason some enterprises still run a "dual-engine" hedge — Terraform for HCP-dependent workflows, OpenTofu for everything else — rather than switching outright:

• Terraform Stacks, HCP Terraform's mechanism for deploying multiple related configurations (a VPC, a database, an app cluster) as one coordinated unit with dependency-aware ordering, has no OpenTofu equivalent and lives exclusively in HCP Terraform's Plus and Enterprise tiers.
• Sentinel, HashiCorp's policy-as-code engine for HCP Terraform and Terraform Enterprise, has no direct OpenTofu counterpart (Open Policy Agent covers similar ground, but it's a separate integration, not a built-in).
• The day-two ecosystem is thinner — fewer Stack Overflow answers, fewer third-party tutorials, fewer engineers with OpenTofu-specific troubleshooting experience versus over a decade of accumulated Terraform knowledge.

The actual recommendation​

None of those three gaps land on a bootstrap-only IaC layer. Stacks solves coordinated multi-config deployment across environments — a problem a handful of static foundational resources, applied once per region, doesn't have. Sentinel solves organization-wide policy enforcement across many teams' Terraform runs — a problem a single platform team's own bootstrap configuration, reviewed like any other pull request, doesn't have either. The features Terraform still leads on are aimed at a much bigger, messier IaC estate than the one a Cluster-API fleet's provisioning layer actually is.

For that specific layer — the network, the DNS zone, the state bucket, the KMS key, the things Cluster API itself needs before it can take over — OpenTofu in 2026 gives up nothing a bootstrap configuration needs, ships state encryption and provider for_each the BSL binary still doesn't have, and removes a per-resource metering line item that didn't exist before March 2026 and could move again. Default new tooling and documentation to it. Keep Terraform on the table only for the specific case an existing module genuinely depends on an HCP-exclusive feature — and audit whether that dependency is load-bearing before assuming it is.

Bex.co is the open-source, AI-native Render alternative — push a git repo, get a running HTTPS service on machines you own. Its own Cluster-API fleet's bootstrap layer runs on OpenTofu for exactly the reasons above: no per-resource meter, no license a single vendor can redraw, and state encryption without a paid add-on. Star the repo on GitHub or deploy your first app today.

Sources​

• HashiCorp Licensing FAQ
• Business Source License 1.1
• Continuing HCP Terraform's enhanced free tier experience
• End of Life Notice for HCP Terraform Legacy Free Plan
• State and Plan Encryption | OpenTofu
• OpenTofu Registry
• IBM closes $6.4B HashiCorp acquisition | TechCrunch
• Fidelity Investments Shares Its Migration Story from Terraform to OpenTofu | OpenTofu
• Fidelity's OpenTofu Migration: A DevOps Success Story Worth Studying | Harness
• OpenTofu becomes a CNCF sandbox project
• OpenTofu | CNCF
• What is the Cluster API Provider Hetzner | CAPH Docs
• Provider: Hetzner Cloud - hetznercloud/hcloud - OpenTofu Registry.