LWN: Comments on "HashiCorp, Terraform, and OpenTF"

HashiCorp, Terraform, and OpenTF

danielthompson — Mon, 04 Sep 2023 11:02:44 +0000

Thanks for the clarification and the behind the scenes view w.r.t. the CLA page in the Ansible docs.

To be honest I'm completely stumped at how I ended up thinking Ansible was Apache 2.0! I think I must have been looking at a plugin rather than anything that anyone would normally call Ansible. I guess I'll just have to take a mea cupla and move on.

Pulumi a viable Terraform alternative?

mbunkus — Wed, 30 Aug 2023 10:20:02 +0000

I've looked at Pulumi several times over the past years and always found it intriguing. Given the current situation, I did so again. Unfortunately it still seems to lack behind Terraform significantly wrt. the number of infrastructure providers that're supported (what Terraform calls "providers"). If I understand things correctly, I could not migrate a single one of my currently active, Terraform-based projects to Pulumi due to one or more infrastructure provider not being supported by Pulumi. Sure, if you're into the usual huge, mostly American providers, Pulumi seems to have you well covered, but outside of that things don't look so good.

I know there's this thing called "Pulumi Terraform Bridge" which claims to be able to "adapt any Terraform Provider built using the Terraform Plugin SDK for use with Pulumi"[1]. Reading its README, it still seems to require actual coding work for each and every provider to be used this way? It isn't a tool for end-users to just install & then be able to use one of the Terraform providers. Is that correct? I'd be delighted to be proven wrong here!

I'd really love to have an alternative to Terraform as I firmly believe that competition pretty much always benefits us end-users. At the moment I don't see it to be an alternative for me.

[1] https://github.com/pulumi/pulumi-terraform-bridge

HashiCorp, Terraform, and OpenTF

spacefrogg — Sun, 27 Aug 2023 15:17:07 +0000

> That's silly: you're getting compensated by being able to use software for free which otherwise might never have been made.

It's not you who makes the rules about proper compensation but society or, more direct, the law maker. They have devised many rules that govern the exchange of work and value. It's nice that it works for you, but it's totally besides my point either.

> The idea that the community is getting the short end of the stick here is ridiculous.

I never said that, but other people seem to feel that way.

> And they're not even going private, the source remains public.

It doesn't matter that the source code remains public. What matters, is, that they now claim private control over a property which they gained (and now comes my claim) by improper means. It doesn't matter that a copy of this property remains public. I am sure we agree that software can constitute private company property and that the discriminating factor is precisely and only legal control over and not singular possession of that software.

> They don't pay taxes on software they build internally either.

Wrong again. They pay their workers writing this internal software, who pay taxes on their income. They also pay company/corporate tax (at least in any civilized country) to be able to legally hire workers in the first place. Of course, a company pays taxes for (almost) everything it does.

> Of course, if you're in a position where you're spending hours writing code for Hashicorp while not deriving any benefit yourself, then you're not being smart.

I never said that either. I said that giving away your workforce for free for the benefit of a privately owned company makes it harder for people to sell theirs in the same market. And it circumvents processes that are in place to benefit society as a whole (, because it is actually a good thing to pay taxes), leaving the world in a worse state than before.

HashiCorp, Terraform, and OpenTF

IanKelling — Sat, 26 Aug 2023 14:37:22 +0000

I appreciate the article. Regarding bait and switch, it fits fine with the definition, see #2 at https://www.merriam-webster.com/dictionary/bait%20and%20s...: "the ploy of offering a person something desirable to gain favor (such as political support) then thwarting expectations with something less desirable"

HashiCorp, Terraform, and OpenTF

IanKelling — Sat, 26 Aug 2023 14:33:35 +0000

I think it is a combination of both, the agreements made with the original copyright holders, plus being a 501c3 makes those agreements stronger for a bunch of reasons.

Fork?

Herve5 — Sat, 26 Aug 2023 07:50:38 +0000

Ah : as expected, https://lwn.net/Articles/942770/

HashiCorp, Terraform, and OpenTF

jezuch — Sat, 26 Aug 2023 06:28:08 +0000

My coworkers in the SaaS division use Pulumi and swear by it. Its update model seems more reasonable.

HashiCorp, Terraform, and OpenTF

Cyberax — Fri, 25 Aug 2023 20:38:23 +0000

I have no problem with HashiCorp. It's annoying, but it's not anything outrageous. And I contributed several small TF providers.

In exchange, I got the benefits of using Terraform's many other providers.

> It distorts the "market" towards the less-fortunate competition. I would even argue that HashiCorp should have made itself an immediate candidate for a tax audit, because they now claim private ownership of large amounts of code, that clearly needed even larger amounts of work hours to produce, which they never paid taxes for, or workers' benefits etc pp; but nobody is willing to talk about this apparently

This is just ridiculous. HashiCorp hasn't made the code suddenly private, it's still available under the MPL. You can go and fork it, and people did just that.

HashiCorp, Terraform, and OpenTF

kleptog — Fri, 25 Aug 2023 18:55:30 +0000

> You are giving your time away for a company without proper compensation.

That's silly: you're getting compensated by being able to use software for free which otherwise might never have been made. The idea that the community is getting the short end of the stick here is ridiculous: I beleive the total economic value created by people using tools like Terraform far exceeds the money earned by Hashicorp.

Even if Hashicorp goes completely private, it's still a net win for the community in the end. And they're not even going private, the source remains public and even reverts to MPL after a while.

Which is why saying business are getting away with not paying taxes on open-source software is kinda silly. They don't pay taxes on software they build internally either. Business pay taxes on the value they create. (In a way a VAT does actually tax the value created by using Terraform despite never paying for it.)

Of course, if you're in a position where you're spending hours writing code for Hashicorp while not deriving any benefit yourself, then you're not being smart. But I doubt there are many people in such a position.

HashiCorp, Terraform, and OpenTF

spacefrogg — Fri, 25 Aug 2023 10:49:33 +0000

Then, there is a valuable lesson to be learnt, here. Do not contribute to company-owned open-source projects for free.

Contributing to company-owned code is detrimental on various levels:
It distorts the "market" towards the less-fortunate competition. I would even argue that HashiCorp should have made itself an immediate candidate for a tax audit, because they now claim private ownership of large amounts of code, that clearly needed even larger amounts of work hours to produce, which they never paid taxes for, or workers' benefits etc pp; but nobody is willing to talk about this apparently. There are reasons why there are so many rules regarding competition, ownership and obtaining ownership, and heavily contributing to company-owned code bases circumvents all these rules.

You are giving your time away for a company without proper compensation. There are, again, rules that prohibit you from doing that (even if you really want to) in other places. You see a loop hole, here. You giving your work away for free fucks up everybody else's work experience a bit more, because it makes it harder for everyone to negotiate according to their worth (if that really needs saying). If there really is an asshole in this game, it's not HashiCorp.

It is detrimental to society, because the company can make the project private, leaving it (or, now, its fork) without proper governance. That is, what everybody immediately notices and is talking about.

HashiCorp, Terraform, and OpenTF

spmfox — Fri, 25 Aug 2023 00:01:10 +0000

Thank you, this clarifies it for me.

HashiCorp, Terraform, and OpenTF

rfontana — Thu, 24 Aug 2023 23:14:49 +0000

The Ansible core engine is mostly licensed under GPL version 3, not a permissive license.

HashiCorp, Terraform, and OpenTF

rfontana — Thu, 24 Aug 2023 23:11:29 +0000

Red Hat lawyer here. The Ansible CLA is not a real CLA. It is a statement of policy on licensing of contributions that is basically redundant with "inbound=outbound". This "CLA" was created by Ansible the company prior to the Red Hat acquisition. Red Hat Legal actually asked the Ansible team to get rid of it to have Ansible be in line with other Red Hat-maintained projects (which don't use CLAs or non-CLAs called CLAs, with this one exception), but for reasons that are not clear to me they are taking a long time to follow up on this request. :)

Why did Ansible call something that was not a CLA a CLA? I have supposed they wanted to tell VCs that they had a CLA while simultaneously not actually having a real CLA, but that is pretty much pure speculation and the real answer may be less interesting.

HashiCorp, Terraform, and OpenTF

jwarnica — Thu, 24 Aug 2023 19:33:33 +0000

> remove any uncertainty about their true intentions

That is impossible.

What one should do, is actually read the licenses of the software, contribution agreements, and support agreements, and understand what you are getting.

"Hope" should not be part of your strategy of getting what you want.

A different example is that I've worked, as a consultant, with several commercially supported products that were killed off, RHV as a particular example. I can assure everyone that customers who paid for (say) 3 years of support got that; almost everyone was expecting it to be around longer. People *hoping* for it to be around longer got hurt, people "planning" on it being around for exactly as long as their support contract was for got what they planned on.

It is perfectly fair to not like some friend, or business, which regularly plays promise vs hope game with you. But to further torture the analogy there is a difference between you "hoping" you friend will help you move, and them "promising" to help you move and flaking out.

I suppose expecting all your commercial contacts, and personal friends to promise you they will be assholes is a way to go, but some true understanding of the promises they are making may be a more happy life.

HashiCorp, Terraform, and OpenTF

kleptog — Thu, 24 Aug 2023 12:54:27 +0000

Which just demonstrates it's a trust issue. If you start from the position that all commercial companies are untrustworthy by definition, then there is no way that Hashicorp can win. This article essentially says: "It changed now, perhaps the worst case scenario is also possible so lets assume it will happen and work from there. The fact it didn't change in the last 10 years proves nothing.".

There is a certain irony in that is it as hard for Hashicorp to enforce this licence as it is for the kernel developers to enforce the GPL, or for any other free-software project to enforce their licence.

A less charitable reading is that the free-software community and competitors free-rode the investors and developers of Hashicorp and the moment Hashicorp tries to do something about it, the community takes the ball and runs off. I don't see any winners emerging here.

HashiCorp, Terraform, and OpenTF

gtirloni — Thu, 24 Aug 2023 10:58:21 +0000

Exactly. Every time I suggest these companies should have been proprietary from the start to remove any uncertainty about their true intentions, I'm met with shock. It seems people prefer to operate on wishful thinking (or they realize these companies wouldn't even exist today if it wasn't for the companies that have sprung up from the FOSS license)

HashiCorp, Terraform, and OpenTF

paulj — Thu, 24 Aug 2023 10:48:10 +0000

I get that, that's not quite what I'm saying. I'm saying it should be reasonable that the original authors and the maintainers - who have put the most work in - get an 'edge' over others when it comes to commercial exploitation.

The problem is that if we *take away* (by making CLAs and what not taboo) ability for original authors to profit from things from things like side-licensing, is that we're saying the original authors can only profit by doing consulting and support work. The problem with that is that other entities, big ones especially (the kinds with consulting arms, and ability to take existing code and brute-force hack at it without much regard for past or future), come along and just step in and take over whatever consultation and support work was available. Leaving less for the original authors.

If we suppose the "market" of revenue generating activities for original authors of Free Software, to exploit the "R&D" effort they put into creating that Free Software, is composed of:

1. Side licensing
2. Support contracts
3. Contract development

It's fair to say that #2 is intrinsically more difficult for small entities (individuals, etc.) to provide, given there is usually a contractual response time. So that activity is inherently one that is easier and more efficient for large entities to exploit than small. While large entities can do both 2 and 3, and can and /do/ use that revenue to fund R&D, arguably small entities (individuals) independent of large entities have made out-size contributions to the development of /new/ Free Software (not least because many of the large entities have little motivation to allow engineers to open-source new software, indeed many large software entities are actively hostile to any internally developed software being released under Free Software licences).

If you take 1 away (by social taboos, etc.), then the small entities are (realistically) left with just 3.

How are small entities supposed to make a living off writing /new/ Free Software, other than by going to work for the big entities who do 2 and 3 and hopefully be lucky enough to also do some of the interesting R&D?

The number of such entities who /actively/ support releasing new R&D as Free Software is a very low number, and a miniscule proportion of the software generating industry.

This represents a complete failure of the economics of Free Software to me. Much of the Free Software world - if this article is representative - seems to be hostile to small entities being able to make a living off their Free Software work, unless they go work for the soulless, big corporates (how's that working out, RedHatters?).

HashiCorp, Terraform, and OpenTF

danielthompson — Thu, 24 Aug 2023 10:46:18 +0000

In general signed CLAs are most poisonous to copyleft projects than to permissively licensed projects (although IMHO signed CLAs stunt the community of all projects). That is simply because permissively licensed projects can be taken proprietary by anyone rather than just the beneficiary of the CLA. Ultimately that means for permissively licensed projects the community needs to be more worried about who own any trademarks (and in some cases patents) rather than who benefits from the CLA.

In this case of ansible: it is permissively licensed, the CLA is implied (rather than signed), the CLA does not contradict the Apache 2.0 patent revocation clauses (because the implied CLA only talks about granting an irrevocable copyright license) and specifically mentions "pursuant to the license of the project" (e.g. Apache 2.0).

Therefore I would approximate it to "by contributing you agree that either you or your employer own the copyright and that you have the authority from the copyright holder to license the code you contribute under Apache 2.0.". To be clear I do not know *exactly* what the legal effect of Apache 2.0 plus the implicit Ansible CLA and, in particular, I don't know the legal consequences to me of being wrong about copyright ownership would be. Likewise I don't know if there are corners of the ansible codebase that use a different license. Personally I feel that the area of ambiguity or small enough that I'm "happy" and I would therefore be happy to work with the above approximation rather than ask a lawyer for a better approximation ;-) .

HashiCorp, Terraform, and OpenTF

mb — Thu, 24 Aug 2023 10:25:42 +0000

Commercial exploitation of Free Software is not a problem at all. Every developer knows that commercial exploitaition is explicitly allowed. So the developers agree to it.
If you do not agree to it, choose a non-commercial license.
It's not a problem of Free Software. It's yours.

HashiCorp, Terraform, and OpenTF

paulj — Thu, 24 Aug 2023 09:24:35 +0000

This is a definite problem in Free Software.

Some small entity (company or even an individual) puts a lot of their resources (time, etc.) into building and/or maintaining some Free Software. While many other entities - some possibly large and well resourced - incorporate that into other or wider business ventures and make money off it, while not giving back anything to said small entity. It happens again and again.

I think one possibly answer to this is for the Free Software community to *favourably* recognise a situation that gives users the freedom of modification, while still giving the original copyright holders some kind of advantage over commercial exploitation - e.g. ability to sell other licences.

This article though contains the opposite of that attitude. It's an attitude that fails to address the above problem. Which I wonder means it reinforces the problem of Free Software being a very very poor path for a software developer to go down - not good for anyone who is not of independent means (or is kept by someone) and needs to keep a roof over other the heads of other family members, and put food on the table. That situation is not healthy for Free Software in the longer run.

Fork?

rsidd — Thu, 24 Aug 2023 09:06:27 +0000

(OT) That's what HTML-formatted comments are for.
https://en.wikipedia.org/wiki/Fork_(software_development)

HashiCorp, Terraform, and OpenTF

elaforma — Thu, 24 Aug 2023 08:36:34 +0000

Clause 2 of the ICLA is a pretty broad grant of a copyright license.

HashiCorp, Terraform, and OpenTF

daniels — Thu, 24 Aug 2023 07:40:11 +0000

HashiCorp does far more than TerraForm though. There’s Vault for secret management, Boundary for a sort of mediated VPN, Consul for network bridging, Vagrant for VM fleets, Packer for image generation, and more. You could very easily be prevented from using something because of something else completely unrelated you happen to work on.

HashiCorp, Terraform, and OpenTF

ssmith32 — Thu, 24 Aug 2023 06:48:27 +0000

Theoretically, this bothers me.

Practically, it bothers me not all, because Terraform, in my opinion, slots quite nicely into Churchill's oft-quoted evaluation of democracy.

In other words, it doesn't bother me, because now there is a glimmer of hope that we'll get something better than a system where changes are usually made in the same as fashion iptable rule modifications (or old Perl scripts):

"Hmmm... you know, once I spent a couple weeks diving into this, and I kinda remember understanding it at the time - but let's just copy and paste this thing off our repo/the Internet/etc, and tweak it a little, and see if it works"

"Oh, it got wedged trying to update a module again. Oh well, tear down all the resources, and try again - oh wait, delete only works from the command line.. well, there goes my day"

HashiCorp, Terraform, and OpenTF

medicalwei — Thu, 24 Aug 2023 04:51:22 +0000

I actually don't see a license transfer clause in Apache iCLA. It is more like a certificate of origin + patent agreement.

HashiCorp, Terraform, and OpenTF

Conan_Kudo — Thu, 24 Aug 2023 03:18:48 +0000

The ASF is an actual public-benefit charity like the FSF is. That's what makes it slightly more secure.

HashiCorp, Terraform, and OpenTF

PengZheng — Thu, 24 Aug 2023 02:26:15 +0000

> But it seems to miss the fact that part of what protects Linux from problems of this sort is that it has no CLA which grants some organization the ability to relicense contributions.

IIRC, Apache Software Foundation's iCLA also has such terms.
How is Apache Foundation different from HashiCorp in this regard?

HashiCorp, Terraform, and OpenTF

Cyberax — Wed, 23 Aug 2023 23:19:50 +0000

One thing that really annoys me, is that Terraform is a project that is made possible by a huge community that supports and contributes modules and providers.

HashiCorp wants to control Vault or Consul? OK. They are the main contributors, it's their code, they can do whatever they want.

HashiCorp, Terraform, and OpenTF

gmgod — Wed, 23 Aug 2023 21:18:53 +0000

Probably a very naive question but given that the majority of contributions are provided by hashicorp employees and that, unless you want to sell a product with hashicorp's product included, you can still modify the code as you see fit and deploy that to your heart's content, isn't that a bit of a strong reaction?

When you build a "code-available" product you want to live off of, it seems very unwise to provide all your code to your competitors while not requiring anything back or preventing them to make money out of the product at all.

If I recall correctly, ElasticSearch really got shafted by AWS that way: AWS kept improving their product based on public code and built more and more private features atop of that. That did not go well.

There are only 3 ways to avoid the situation of working for your competitors in software dev: you either go proprietary, strongly copyleft or you use a license that prohibits use in a commercial product.

As much as I would love a world where the MPL and a forever thriving community is all you need to push a piece of software to excellence and keep it there, it is not realistic. The premises are not even realistic.

So would it have better for them to go AGPL? Or proprietary? I find it quite disingenuous to call it a bait and switch when provided with CLAs: everyone was informed. So yes it's a shame it's not MPL anymore. If *I* had to choose, I would say MPL but they are the owner of their code and they have clear CLAs, no tomfoolery there, just disappointment.

Given all the options though, I feel this is the least worse.

HashiCorp, Terraform, and OpenTF

andrewsh — Wed, 23 Aug 2023 20:50:27 +0000

Please somebody fork Vault.

HashiCorp, Terraform, and OpenTF

spmfox — Wed, 23 Aug 2023 20:23:41 +0000

I read the Ansible CLA but it's not clear to me if it would allow a relicense like this or not. Does anyone know?

https://docs.ansible.com/ansible/latest/community/contrib...

HashiCorp, Terraform, and OpenTF

fw — Wed, 23 Aug 2023 20:04:22 +0000

For true charity organizations (e.g. US 501(c)(3) organizations), such as the Free Software Foundation (FSF) or Python Software Foundation (PSF), the "public benefit" nature of their charters would likely make it impossible to change their code to a non-FOSS license.

I don't think this is accurate. I do not think there's any legal requirement that software that is provided for public benefit needs to be licensed under an OSI-compatible license (or any similar criteria), or that such organizations align with the free culture movement more generally. For example, IEEE is a 501(c)(3) organization (according to Wikipedia), and yet they are against free dissemination of knowledge, and their policies makes it hard to use much of their output for open-source development.

What's different for for the FSF and the PSF is that their agreements enable relicensing, but deliberately incorporate some constraints on future licenses.

The PSF CLA can be viewed here. The future licensing constraint is in the CLA proper instead of a semi-unrelated preamble, so I expect that it's much effective. The FSF copyright assignment is similar, but I don't think the text is publicly available.

HashiCorp, Terraform, and OpenTF

iabervon — Wed, 23 Aug 2023 19:50:24 +0000

Doesn't HashiCorp's FAQ imply the existence of a big corporation that competes with one of their commercial offerings, which would presumably like to continue to do what they're doing, and would therefore follow an OpenTF fork if one happened?

I can't help but conclude that, if the community creates an OpenTF that's different from future Terraform, $BIGCORP can only provide integration with OpenTF, not Terraform, if they want to sell support for it, so any customers of $BIGCORP aren't going to have any use for buying Terraform support from HashiCorp.

Fork?

barryascott — Wed, 23 Aug 2023 19:39:29 +0000

https://en.wikipedia.org/wiki/Fork_(software_development)

The (software_development) is part of the url but lwn thinks it is not valid to have () in a url.

HashiCorp, Terraform, and OpenTF

NightMonkey — Wed, 23 Aug 2023 17:07:41 +0000

This directly impacts me, as I started using Terraform Open Source (and patterns it enables) as part of my work in 2015, and have been using it ever since (though K8s is making it less and less relevant for me). My hope is that there will be a combination of a fork and a non-profit foundation to back up the community and support its growth and evolution.

I have had the pleasure of discussing issues and learning with a core developer of Terraform and HCL who works for HashiCorp. I hope that they have a soft landing, and that they are able to continue their work without having their hands tied by their current employer. They really understand the goals of IaC, and are very creative in how they tackled creating an amazing administrative orchestrative framework for API-wrapped services.

Fork?

Herve5 — Wed, 23 Aug 2023 16:36:24 +0000

Naive reader here, but my immediate thought was : "fork?"