Best Infrastructure as Code Tools in 2026: Terraform, OpenTofu, Pulumi and Crossplane Compared

Two dates explain infrastructure as code in 2026. On 10 December 2025 HashiCorp deprecated the Cloud Development Kit for Terraform and archived the repository read-only, ending the idea that you would write AWS resources in TypeScript and have Terraform apply them. On 31 March 2026 the legacy HCP Terraform free plan reached end of life, and every organization still on it was moved onto a resource-metered tier.

The tool everybody standardized on is now a licensed IBM product with a meter attached, and the fork it created has spent three years shipping features it does not have. Every price below came from the vendor's own pricing page in August 2026, and both code samples were run on a laptop with Terraform 1.5.7 and OpenTofu 1.12.5, real terminal output included.

Three Layers, Three Separate Decisions

Most comparisons fail because they treat "IaC tool" as one choice. It is three, and you can mix them freely.

The engine reads your configuration and calls cloud APIs: Terraform, OpenTofu, Pulumi, Crossplane. The runner executes it with credentials and an audit trail: GitHub Actions, Atlantis, Terragrunt, a managed platform. The state layer is whoever holds the file mapping your config to real resource IDs, and whether it is encrypted. Teams get burned on the third one, because state is where database passwords and private keys end up in plain text.

A perfectly reasonable 2026 stack is OpenTofu as the engine, GitHub Actions as the runner and an encrypted S3 bucket as the state layer, at a software cost of zero.

Quick Comparison

Layer 1: The Engines

Terraform, Now an IBM Product

The default, and not open source. Terraform moved to the Business Source License 1.1 in August 2023; 1.5.7 was the last MPL 2.0 release. IBM completed its $6.4 billion acquisition of HashiCorp on 27 February 2025, and the pricing page now carries an "an IBM Company" logo.

Development did not slow. Terraform 1.14 added list resources in .tfquery.hcl files with a terraform query command that finds unmanaged cloud resources and generates import blocks for them. Terraform 1.15 followed on 29 April 2026 with dynamic module sources and a deprecated attribute on variables and outputs, and Stacks reached general availability as terraform stacks. Current stable is 1.15.8.

The genuinely new thing is agent access: HashiCorp's Terraform MCP server reached general availability on 13 June 2026 as an open source project, exposing the registry and your workspaces to any Model Context Protocol client, so a coding agent writes against your approved modules instead of inventing resource arguments.

OpenTofu, the Fork That Kept Shipping

Same HCL, MPL 2.0, and features Terraform does not have. OpenTofu forked from Terraform 1.5, sits under the Linux Foundation and became a CNCF sandbox project on 23 April 2025. Harness, Gruntwork, Spacelift, env0 and Scalr pledged nineteen full-time engineers for at least five years, which is why the pace held.

Where they diverged: OpenTofu shipped early variable evaluation in 1.8 back in August 2024, roughly twenty months before Terraform's dynamic module sources. Version 1.11 added ephemeral values that never reach state or plan files, plus an enabled meta-argument for the zero-or-one resource case that count = var.x ? 1 : 0 handles so awkwardly. Version 1.12.0, on 14 May 2026, added dynamic prevent_destroy and destroy = false for dropping a resource from state without destroying the real object.

The feature with no Terraform counterpart is end-to-end state encryption:

hcl
Copy
terraform {
  required_providers {
    random = {
      source  = "opentofu/random"
      version = "~> 3.7"
    }
  }
}

resource "random_password" "db" {
  length  = 24
  special = true
}

Bash
Copy
export TF_ENCRYPTION='key_provider "pbkdf2" "demo" {
  passphrase = "correct-horse-battery-staple-42"
}
method "aes_gcm" "secure" {
  keys = key_provider.pbkdf2.demo
}
state {
  method = method.aes_gcm.secure
}'
tofu init && tofu apply -auto-approve

After the apply there is no resource type, no attribute name and no password in the state file:

text
Copy
$ head -c 220 terraform.tfstate
{
  "serial": 1,
  "lineage": "f5eef38f-9591-b94e-149d-f59e05a9828e",
  "meta": {
    "key_provider.pbkdf2.demo": "eyJzYWx0IjoiOHlzaFdLUHdZSEpYdEloYmNRZHBBMHdTMHhzVFhRVFpzblY0WWFvVnBwQT0iLCJpdGVyYXRpb25zIjo2MDAwMDAsImhhc

$ grep -c 'random_password' terraform.tfstate
0

That meta blob decodes to a PBKDF2 salt and 600,000 iterations. Change the passphrase and the next command fails with decryption failed for all provided methods. Drop the encryption block and OpenTofu reports Unsupported state file format, which is exactly what Terraform 1.5.7 says about the same file. That is the practical shape of the fork: not a license argument, a file your other tool cannot open.

Pulumi, Betting on Agents

For teams who would rather write TypeScript, Python, Go or C# than HCL. Co-founder Joe Duffy said in May 2026 that language models now perform over 20 percent of infrastructure deployments on the platform, up from virtually zero a year earlier, and that he expects it to pass 50 percent within the year. The May release added a Neo CLI, GitHub and Slack apps, scheduled agent tasks delivered as pull requests, and a pulumi do command.

Pricing is per resource per month, not per run: free for one user, Team at $40 a month including credits for up to 500 resources then $0.1825 per resource, Enterprise at $400 with credits for 2,000. Neo bills $3 per million tokens. The engine and CLI are Apache 2.0, so skipping Pulumi Cloud and keeping state in a bucket is supported, minus the dashboard, RBAC and drift detection.

Crossplane, a Control Plane Instead of a Pipeline

Continuous reconciliation rather than a plan from CI. Crossplane turns cloud resources into Kubernetes objects a controller reconciles, so correcting drift is the default instead of a scheduled job. It reached CNCF graduated status on 28 October 2025, and v2.0 landed on 12 August 2025.

Version 2 made composite and managed resources both namespaced, removing v1's confusing claim indirection, and a composite resource can now compose anything including plain Kubernetes objects. Operations run function pipelines for work that is not resource creation, such as certificate rotation. The upgrade removed native patch-and-transform and ControllerConfig, so a v1 estate needs a migration plan.

It pays off when other teams consume your platform through Kubernetes APIs. With five services and one VPC, it is a control plane you now have to operate.

Layer 2: The Runners

Free and Self-Hosted

Terragrunt hit 1.0 on 30 March 2026 with a backwards compatibility guarantee across CLI flags, HCL configuration and serialized output, which for a tool this embedded in CI is the headline feature. MIT licensed, around 9,800 stars, and its Stacks group units into versioned entities so a large estate stops being a directory tree of copy-pasted backend blocks.

Atlantis is still the reference pattern: plan output posted on the pull request, apply on a comment, so the audit trail is the PR and credentials never leave your infrastructure. Digger rebranded to OpenTaco in November 2025, keeping an MIT core at roughly 5,000 stars, and now ships a self-hosted state backend with access control, version history and rollback behind an HCP Terraform compatible interface.

What the Managed Platforms Cost

HCP Terraform bills per managed resource per month: $0.10 on Essentials, $0.47 on Standard, $0.99 on Premium, free up to 500 managed resources with unlimited users and a surprisingly complete feature set including SSO and policy as code. The resource ceiling is what bites, and migration off the legacy plan is not reversible.

Spacelift covers the most engines (OpenTofu, Terraform, Terragrunt, Pulumi, Kubernetes) and keeps a free two-user tier, but its entry paid plan is now Starter+ at $20,000 per year on annual commitment. Scalr went the other way with per-run pricing: 50 free runs a month, then $0.99 each, no per-user or per-resource charges. env0, now trading as env zero, gives 250 runs and 30 environments free.

The shape of the meter matters more than the rate. At 1,000 managed resources, HCP Terraform is $100 a month on Essentials and $470 on Standard, Pulumi Team is about $131, and Scalr at 100 runs a month is $99 no matter how many resources those runs touch.

Layer 3: Who Holds the State

This is the decision teams make by accident. Three options: a bucket you own with encryption enabled, a vendor's hosted state as part of a platform plan, or OpenTaco's self-hosted backend speaking the HCP Terraform protocol so applications and CI need no change if you move.

Two constraints worth knowing before you choose. State contains credentials in plain text unless something encrypts it, which is why OpenTofu's TF_ENCRYPTION above matters more than it looks. And encryption is a one-way door between engines: Terraform cannot read an OpenTofu-encrypted state file, so decrypt before any return trip.

How to Pick

Starting fresh in 2026: OpenTofu with GitHub Actions and encrypted remote state. It is a superset of the Terraform you would otherwise learn, costs nothing, and needs no license review.

Large existing Terraform estate: stay put unless the resource meter or the license forces the move, at which point the migration below is genuinely low risk.

Your team resents HCL: Pulumi, self-hosting state if you do not want the per-resource bill. Do not pick Crossplane just to avoid HCL.

Building a platform other teams consume: Crossplane v2, and budget for operating a control plane.

Paying HCP Terraform above 500 resources: price Scalr's per-run model and OpenTaco's self-hosted state against your bill. Per-resource billing punishes exactly the estates that are stable and well factored.

Migrating to OpenTofu in About 15 Minutes

1. Install OpenTofu. brew install opentofu, then confirm tofu version reports 1.12.x. Everything here was checked against 1.12.5.
2. Back up state first. Copy terraform.tfstate outside the repository or snapshot the remote backend. This is the only irreversible part.
3. Run tofu init in the unchanged directory. No file edits needed: OpenTofu resolves hashicorp/* provider addresses through its own registry.
4. Run tofu plan and require an empty diff. On a project whose state was written by Terraform 1.5.7, OpenTofu reported found no differences, so no changes are needed. If you get a diff, read it rather than applying.
5. Turn on state encryption before the next apply, with the passphrase in your secret manager rather than the repository.
6. Update CI and plan the exit. Swap terraform for tofu, check any wrapper that greps command output, and remember encrypted state has to be decrypted before Terraform can read it again.

Conclusion

The fork is no longer a licensing protest, it is a feature divergence with a file format you cannot read from both sides. OpenTofu has state encryption, ephemeral values and an enabled meta-argument; Terraform has Stacks, an official MCP server and the largest ecosystem in the category. Pick your engine on which gap hurts more, keep the runner and state decisions separate from it, and price the meter against your own resource count rather than the headline rate.

Related DevToolLab Tools

• Subnet Calculator - Work out CIDR ranges and usable host counts before hard-coding them into a VPC module.
• Kubernetes YAML Generator - Scaffold the manifests a Crossplane or GitOps workflow reconciles.
• YAML to JSON Converter - Turn a manifest into JSON for jq, or for yamldecode in a configuration.
• Cron Expression Parser - Check the schedule on a drift detection job or a Crossplane Operation before it runs unattended.

Related Guides

• Best Secrets Management Tools - where the credentials in your state file should actually live
• GitHub Actions Best Practices - hardening the runner layer that executes your plans
• Best MCP Servers - what else you can wire into an agent alongside the Terraform MCP server
• Non-Human Identity Security - managing the machine credentials your pipeline applies with

Prices and release versions change often. Verify current rates on each vendor's pricing page before committing to a plan.