opentofu

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

OpenTofu

Overview

概述

OpenTofu is an open-source infrastructure as code tool that uses HCL (HashiCorp Configuration Language) to declaratively manage cloud infrastructure. It is a community-driven fork of Terraform, fully compatible with existing Terraform providers and modules, with exclusive features like native state encryption. Pulumi provides an alternative IaC approach using general-purpose languages (TypeScript, Python, Go) instead of HCL.

When to use: Managing cloud infrastructure declaratively, provisioning multi-cloud resources, enforcing infrastructure consistency across environments, encrypting state at rest (OpenTofu), using familiar programming languages for IaC (Pulumi).

When NOT to use: One-off scripts better suited to CLI tools, application-level configuration management (use Ansible/Chef), container orchestration logic (use Kubernetes manifests), simple static hosting (use platform-native tools).

OpenTofu是一款开源的基础设施即代码工具，使用HCL（HashiCorp配置语言）声明式管理云基础设施。它是社区驱动的Terraform分叉版本，完全兼容现有Terraform提供商和模块，具备原生状态加密等独有特性。Pulumi则提供了另一种IaC实现思路，使用通用编程语言（TypeScript、Python、Go）而非HCL来编写配置。

适用场景： 声明式管理云基础设施、部署多云资源、保障跨环境基础设施一致性、实现静态状态加密（OpenTofu）、使用熟悉的编程语言编写IaC（Pulumi）。

不适用场景： 更适合用CLI工具实现的一次性脚本、应用层配置管理（请使用Ansible/Chef）、容器编排逻辑（请使用Kubernetes清单）、简单静态托管（请使用平台原生工具）。

Quick Reference

快速参考

Pattern	Tool / Command	Key Points
Initialize project	`tofu init`	Downloads providers, initializes backend
Preview changes	`tofu plan`	Shows diff without applying
Apply changes	`tofu apply`	Provisions/updates resources
Destroy resources	`tofu destroy`	Tears down managed infrastructure
Import resource	`tofu import <addr> <id>`	Brings existing resource under management
State encryption	`terraform.encryption` block	OpenTofu-exclusive, AES-GCM with key providers
Remote backend	`backend "s3"` / `backend "gcs"`	Store state in cloud storage with locking
Workspaces	`tofu workspace new <name>`	Isolated state per environment
Module usage	`module "name" { source = "..." }`	Reusable infrastructure components
Output values	`output "name" { value = ... }`	Expose values for other configs or CI
Variable files	`terraform.tfvars` / `-var-file`	Environment-specific variable overrides
Pulumi new project	`pulumi new typescript`	Scaffold TypeScript IaC project
Pulumi preview	`pulumi preview`	Shows planned changes
Pulumi deploy	`pulumi up`	Provisions/updates resources
Pulumi config	`pulumi config set key value`	Stack-scoped configuration
Pulumi secrets	`pulumi config set --secret key val`	Encrypted config values
Pulumi stacks	`pulumi stack select <name>`	Switch between environments
Automation API	`LocalWorkspace.createOrSelectStack()`	Programmatic stack management

模式	工具 / 命令	核心要点
初始化项目	`tofu init`	下载提供商、初始化后端
预览变更	`tofu plan`	展示变更差异，不会实际执行
应用变更	`tofu apply`	部署/更新资源
销毁资源	`tofu destroy`	拆除受管理的基础设施
导入资源	`tofu import <addr> <id>`	将现有资源纳入管理范围
状态加密	`terraform.encryption` 块	OpenTofu独有特性，采用AES-GCM加密和密钥提供商
远程后端	`backend "s3"` / `backend "gcs"`	将状态存储在带锁机制的云存储中
工作区	`tofu workspace new <name>`	每个环境对应独立状态
模块使用	`module "name" { source = "..." }`	可复用的基础设施组件
输出值	`output "name" { value = ... }`	暴露值供其他配置或CI使用
变量文件	`terraform.tfvars` / `-var-file`	特定环境的变量覆盖
新建Pulumi项目	`pulumi new typescript`	生成TypeScript IaC项目脚手架
Pulumi预览变更	`pulumi preview`	展示计划执行的变更
Pulumi部署	`pulumi up`	部署/更新资源
Pulumi配置	`pulumi config set key value`	栈范围的配置项
Pulumi密钥	`pulumi config set --secret key val`	加密的配置值
Pulumi栈	`pulumi stack select <name>`	在不同环境之间切换
自动化API	`LocalWorkspace.createOrSelectStack()`	编程式管理栈

Common Mistakes

常见错误

Mistake	Correct Pattern
Storing state locally in team environments	Configure remote backend (S3, GCS, Azure Blob) with state locking
Hardcoding provider credentials in HCL	Use environment variables or provider-specific auth chains
Using `tofu apply` without reviewing plan	Run `tofu plan -out=plan.tfplan` then `tofu apply plan.tfplan`
Editing state manually	Use `tofu state mv` , `tofu state rm` , or `tofu import`
Ignoring `.terraform.lock.hcl`	Commit lock file for reproducible provider versions
Using `count` for complex conditional resources	Prefer `for_each` with maps for stable resource addressing
Sharing one workspace for all environments	Use separate workspaces or backend config per environment
Putting secrets in `terraform.tfvars`	Use `sensitive = true` variables, vault, or environment variables
Pulumi: creating resources outside component classes	Wrap related resources in ComponentResource for reuse
Pulumi: not awaiting async operations	Ensure all resource operations complete before stack export
Skipping `tofu plan` in CI/CD	Always plan and require approval before apply in pipelines
Not using `-target` carefully	Prefer full plans; `-target` can leave state inconsistent

错误	正确做法
团队环境下本地存储状态	配置带状态锁的远程后端（S3、GCS、Azure Blob）
在HCL中硬编码提供商凭证	使用环境变量或提供商专属的认证链
未审核计划就执行 `tofu apply`	先运行 `tofu plan -out=plan.tfplan` ，再执行 `tofu apply plan.tfplan`
手动编辑状态文件	使用 `tofu state mv` 、 `tofu state rm` 或 `tofu import`
忽略 `.terraform.lock.hcl` 文件	提交锁文件以保证提供商版本可复现
复杂条件资源使用 `count` 参数	优先使用带映射的 `for_each` 保证资源地址稳定
所有环境共用同一个工作区	每个环境使用独立的工作区或后端配置
将密钥存入 `terraform.tfvars`	使用带 `sensitive = true` 标记的变量、密钥保管库或环境变量
Pulumi：在组件类外创建资源	将相关资源封装到ComponentResource中以便复用
Pulumi：未等待异步操作完成	确保所有资源操作完成后再导出栈输出
CI/CD中跳过 `tofu plan` 步骤	流水线中始终先执行计划，应用变更前需要审批
未谨慎使用 `-target` 参数	优先执行全量计划； `-target` 可能导致状态不一致

Delegation

任务委派

Infrastructure pattern discovery: Use
```
Explore
```
agent
IaC code review: Use
```
Task
```
agent
Drift detection analysis: Use
```
Task
```
agent

If the
amazon-web-services
skill is available, delegate AWS resource patterns to it. If the
docker
skill is available, delegate container infrastructure patterns to it. If the
github-actions
skill is available, delegate CI/CD pipeline patterns to it.

基础设施模式探索：使用
```
Explore
```
Agent
IaC代码审核：使用
```
Task
```
Agent
漂移检测分析：使用
```
Task
```
Agent

若已启用
amazon-web-services
技能，请将AWS资源模式相关任务委派给它。若已启用
docker
技能，请将容器基础设施模式相关任务委派给它。若已启用
github-actions
技能，请将CI/CD流水线模式相关任务委派给它。

References

参考资料

HCL syntax, resources, data sources, and providers
Modules, composition, and reusable infrastructure
State management, remote backends, and locking
State encryption with OpenTofu-exclusive key providers
Variables, outputs, and environment configuration
Workspaces and multi-environment setups
Import existing infrastructure and migration patterns
Pulumi TypeScript and Python SDK patterns
Pulumi stacks, config, secrets, and automation API
CI/CD integration and drift detection

HCL语法、资源、数据源与提供商
模块、组合与可复用基础设施
状态管理、远程后端与锁机制
OpenTofu专属密钥提供商实现状态加密
变量、输出与环境配置
工作区与多环境部署
现有基础设施导入与迁移模式
Pulumi TypeScript与Python SDK模式
Pulumi栈、配置、密钥与自动化API
CI/CD集成与漂移检测