opentofu/CHANGELOG.md

1.9.0 (Unreleased)

UPGRADE NOTES:

• Using the ghcr.io/opentofu/opentofu image as a base image for custom images is deprecated and this will be removed in OpenTofu 1.10.

  Please refer to https://opentofu.org/docs/main/intro/install/docker/ for instructions on building your own image.

NEW FEATURES:

• for_each in provider configuration blocks: An alternate (aka "aliased") provider configuration can now have multiple dynamically-chosen instances using the for_each argument:

  provider "aws" {
    alias    = "by_region"
    for_each = var.aws_regions
  
    region = each.key
  }
  

  Each instance of a resource can also potentially select a different instance of the associated provider configuration, making it easier to declare infrastructure that ought to be duplicated for each region.

• -exclude planning option: similar to -target, this allows operators to tell OpenTofu to work on only a subset of the objects declared in the configuration or tracked in the state.

  tofu plan -exclude=kubernetes_manifest.crds
  

  While -target specifies the objects to include and skips everything not needed for the selected objects, -exclude instead specifies objects to skip. OpenTofu will exclude the selected objects and everything that depends on them.

ENHANCEMENTS:

• provider blocks now support for_each. (#2123)
• The new -exclude planning option complements -target, specifying what to exclude rather than what to include. (#1900)
• State encryption key providers now support customizing the metadata key via encrypted_metadata_alias. (#2080)
• OpenTofu will now prompt for values for input variables needed for early evaluation. (#2047)
• Various commands now accept -consolidate-warnings and -consolidate-errors options to enable or disable OpenTofu's summarization of diagnostic messages. (#1894)
• -show-sensitive option causes tofu plan, tofu apply, and other commands that can return data from the configuration or state to unmask sensitive values. (#1554)
• tofu console now accepts expressions split over multiple lines, when the newline characters appear inside bracketing pairs or when they are escaped using a backslash. (#1875)
• Improved performance for large graphs when debug logs are not enabled. (#1810)
• Improved performance for large graphs with many submodules. (#1809)

BUG FIXES:

• templatefile no longer crashes if the given filename is derived from a sensitive value. (#1801)
• Configuration loading no longer crashes when a module block lacks the required source argument. (#1888)
• The tofu force-unlock command now returns a relevant error when used with a backend that is not configured to support locking. (#1977)
• Configuration generation during import no longer crashes if an imported object includes sensitive values. (#1986, #2077)
• .tfvars files from the tests directly are no longer incorrectly loaded for non-test commands. (#2039)
• tofu console's interactive mode now handles the special exit command correctly. (#2086)
• Provider-contributed functions are now called correctly when used in the validation block of an input variable declaration. (#2052)
• Sensitive values are now prohibited in early evaluation of backend configuration and module source locations, because otherwise they would be exposed as a side-effect of initializing the backend or installing a module. (#2045)
• tofu providers mirror no longer crashes when the dependency lock file has missing or invalid entries. (#1985)
• OpenTofu now respects a provider-contributed functions' request to be called only when its arguments are fully known, for compatibility with functions that cannot handle unknown values themselves. (#2127)
• tofu init no longer duplicates diagnostic messages produced when evaluating early-evaluation expressions. (#1890)
• tofu plan change description now includes information about configuration blocks generated using a dynamic block with an unknown for_each value. (#1948)
• Error message about a provider type mismatch now correctly identifies which module contains the problem. (#1991)
• The yamldecode function's interpretation of scalars as numbers now conforms to the YAML 1.2 specification. In particular, the scalar value + is now interpreted as the string "+" rather than returning a parse error trying to interpret it as an integer. (#2044)

INTERNAL CHANGES:

• The Makefile now includes build and help targets. (#1925, #1927)
• The Makefile is now configured to allow only POSIX standard make syntax, without implementation-specific extensions. (#1811)

Previous Releases

For information on prior major and minor releases, see their changelogs:

• v1.8
• v1.7
• v1.6