Terraform Alternatives for Enterprises: Pulumi, OpenTofu, CDKTF, Crossplane — Who Migrates and Why

You are here because one of three things happened: the Business Source License switch in 2023 spooked your legal team and the review never quite closed; IBM closed its $6.4 billion acquisition of HashiCorp in February 2025 and your procurement department wants to know what that means for renewals; or you just discovered that CDK for Terraform — one of the four names in every "Terraform alternatives" search result — was archived by HashiCorp in December 2025 and no longer exists as a maintained product. This page is the buyer's answer: who should actually migrate, to what, and what it costs as of October 2026.

Every price and product fact below was verified against vendor pages, GitHub APIs, or official documentation on 2026-10-14. Prices change; treat every number as a snapshot and re-verify before you sign anything.

The 30-Second Version

What Changed Since You Last Looked

The "Terraform alternatives" market of 2026 is not the market of 2023, and most comparison content on the internet still describes the older one. Four things moved:

• IBM owns Terraform. The acquisition closed on February 27, 2025 at $35 per share — a $6.4 billion enterprise value, per IBM's announcement. The LICENSE file in hashicorp/terraform now names "International Business Machines Corporation (IBM)" as the Licensor under Business Source License 1.1. Terraform development itself has not slowed: v1.16.5 shipped October 2, 2026, and v1.17.0 is in release-candidate as of October 7. The change is not technical; it is commercial — who negotiates your renewal, and what portfolio it belongs to.
• CDK for Terraform is dead. HashiCorp archived the repository on December 10, 2025, stating plainly that CDKTF "did not find product-market fit at scale." The last release, v0.21.0, dates to June 4, 2025. The repo is read-only, 389 issues remain open and will never be worked, and no compatibility updates are coming — meaning generated HCL will progressively drift from newer provider schemas. HashiCorp explicitly encourages community forks; a planning repo exists but no credible successor has emerged at time of writing. If CDKTF appears on any alternatives list as a live option in 2026, that list is stale.
• OpenTofu found its footing. The fork — created August 2023 after the BSL switch, MPL-2.0, now at 30,486 GitHub stars versus Terraform's 49,910 — shipped v1.13.0 on September 30, 2026 with Windows ARM64 support, planning improvements that reduce unknown-value churn, and early experiments in built-in linting and "symbol libraries" (shared value/function collections importable from module sources). It also carries one feature Terraform has never shipped: native state and plan encryption. The v1.13 notes are explicit that it is the last series supporting 32-bit CPUs, and WinRM provisioning is gone.
• HCP Terraform restructured its plans. The old Standard/Plus tiering is gone; today it is Free (up to 500 managed resources), Essentials (pay-as-you-go per managed resource-hour), and Standard/Premium (contact sales), on top of contract-based "Flex" consumption pricing. The pay-as-you-go worked example in HashiCorp's own docs prices 1,000 continuously-managed resources at about $98/month. The concurrent-runs ceiling is the real tier boundary: Free gets 1 remote run, Essentials 3, Standard 10, Premium 200.

The Framework Most Buyers Get Wrong: You Are Buying Two Different Products

"Terraform alternatives" conflates two independent layers. The engine reads your code, computes a plan, and talks to cloud APIs. The control plane stores state, queues runs, enforces policy, and gives your team a UI. You can swap either without touching the other, and most of the pain people attribute to "Terraform" actually lives in the control plane they paired with it.

                LANGUAGE / ENGINE            CONTROL PLANE (state, runs, policy)
                ------------------------------------------------------------------
 HCL lineage    Terraform CLI (BSL/IBM)     HCP Terraform (Essentials PAYG / quote)
                OpenTofu (MPL-2.0)           Spacelift ($20k/yr entry)
                                             env0, Scalr (per-apply / per-run)
                                             or self-managed: S3 + CI, $0 license

 Code lineage   Pulumi (Apache-2.0)          Pulumi Cloud (Free/$40/$400/$2,000)
 (TS/Py/Go/…)                                or any CI system + object storage

 K8s-native     Crossplane (Apache-2.0)      your cluster IS the control plane;
 (no plan/apply)                            Upbound if you want it managed

 DEAD           CDKTF — archived 2025-12-10, was a code-to-HCL *compiler*,
                not a control plane; exit = Pulumi or handwritten HCL

Every credible 2026 migration decision decomposes into two questions: which engine do we write infrastructure in, and who runs state and runs for us. Answer them separately.

The Comparison Table

Pulumi: The Only Credible Home for Code-First Teams (and the CDKTF Exit)

Pulumi is an Apache-2.0 engine where you define infrastructure in TypeScript, Python, Go, C#, Java, or YAML, with real functions, loops, classes, and package managers instead of HCL's template and module system. The engine is genuinely open source — no BSL games — and the commercial tier (Pulumi Cloud) is optional: the free tier and open-source CLI work against self-managed state backends, though self-hosting Pulumi Cloud itself is an Enterprise-edition feature.

Why an enterprise picks Pulumi: your application engineers already write TypeScript or Python, your infrastructure code can live in the same repos, get the same code review, tests, and IDE support, and your platform team can publish versioned components as ordinary packages. This is the product CDKTF was trying to be. If your estate is in CDKTF constructs, Pulumi is the least-bad landing zone — the mental model (real language, typed resources) transfers; the API does not, so budget a real rewrite, module by module.

Honest weaknesses: migration from a large HCL estate is a genuine rewrite, not a conversion — anyone telling you otherwise is selling something. Pulumi's resource model is its own, so the enormous Terraform module ecosystem only reaches you through provider bridging, and module-level reuse is weaker in practice than the "150 clouds" marketing implies. And Pulumi Cloud's pricing is credit-metered with expiration, which behaves badly if you do not model it (below).

Pricing (as of 2026-10-14 — verify with pulumi.com/pricing): Free forever for individuals (1 user, 500 workflow minutes); Essentials $40/month (40 credits, up to 500 managed resources included); Pro $400/month (400 credits, 2,000 resources, SSO, enforced policy, drift detection); Enterprise $2,000/month (2,000 credits, 4,750 resources, SCIM, self-hosting option). Overage: $0.1825 per managed resource-month on Essentials, $0.365 on Pro, $0.5475 on Enterprise. Secrets are metered separately ($0.50–$1.00/secret/month by tier), workflow minutes cost $0.01 beyond the included pool, and unused credits expire monthly.

OpenTofu: The Drop-In Answer for License-Anxious HCL Teams

OpenTofu is the community fork created in August 2023 after HashiCorp's BSL switch, governed by the Linux Foundation, MPL-2.0 from the first commit. The pitch for enterprises is boring in the best way: same CLI verbs, same HCL, same provider protocol, same registry modules — with a state-encryption feature Terraform has never matched. You change one word in your CI pipeline and a lockfile entry.

Why an enterprise picks OpenTofu: it removes the entire license conversation for $0 in engine cost, keeps your existing modules and provider investments, and adds encrypted state at rest (key providers, per-stack methods) — which Terraform proper still delegates to the control plane or leaves to backend features. The v1.13.0 release (Sept 30, 2026) shows a project spending its innovation budget on planning ergonomics (new functions that reduce unknown-value churn), built-in linting experiments, and symbol libraries — features aimed at module authors, exactly where Terraform's ecosystem lives. Governance is the other sell: a Linux Foundation project with a public TSC cannot be acquired out from under you. Ask anyone who just watched IBM absorb their vendor.

Honest weaknesses: compatibility is a promise under strain, not a law of nature. Symbol libraries are explicitly experimental and, once adopted, would fork your modules away from Terraform readability. The fork's one governance crisis is instructive: in August 2024 the OpenTofu Registry removed providers under a sanctions-driven policy (issue #817, 150 comments), the revert PR was closed unmerged, and the community carried the argument for weeks. A foundation guarantees the license; it does not guarantee your providers never get de-listed. Also know the edges before you commit a fleet: v1.13 drops WinRM provisioners, is the last line to support 32-bit CPUs, and requires macOS 13+.

Pricing (as of 2026-10-14): the engine is $0, permanently. Your costs are the control plane you pair with it — self-managed state on S3 plus CI minutes (roughly a dollar a month in object storage for a typical state footprint), or a commercial wrapper (Spacelift, env0, Scalr — all support OpenTofu natively and treat it as a first-class engine, Spacelift most visibly).

Crossplane: When Your "Alternative" Is Actually a Platform Rebuild

Crossplane (Apache-2.0, CNCF graduated October 2025) answers a different question than the others. It is not a Terraform replacement; it is a framework for building Kubernetes-style infrastructure APIs where a control loop continuously reconciles desired state — no plan/apply, no state file, and no "apply window." Developers request infrastructure by creating custom resources; the platform team defines compositions that map those requests to real cloud resources.

Why an enterprise picks Crossplane: self-service without granting cloud console access, day-two operations (drift is repaired automatically, not merely detected), and a single API surface for everything your platform offers. The Upjet toolchain compiles the same Terraform providers you already use into Kubernetes CRDs, so the provider ecosystem — Terraform's biggest moat — is largely reachable. If your organization is already committed to Kubernetes as the platform substrate, Crossplane is the natural place to put infrastructure, and Upbound sells a managed control-plane service on top (Standard from $1,000/month plus consumption — $1.0950 per resource-month for the first tier, declining with volume; Enterprise and Business Critical are quote-only).

Honest weaknesses: this is the highest-effort option on the page, by a wide margin. A Crossplane migration is a platform engineering project — designs, compositions, provider upgrades, RBAC — typically measured in quarters, not sprints. Reconciliation also changes your failure model: a bad composition continuously re-applies itself, and debugging happens in events and conditions rather than a plan output. v2.0 removed claims and moved to namespaced composite resources, so blog-era guidance is partially obsolete — budget for current docs, not 2023 tutorials. The v2.4 line is current and active: v2.4.1/v2.3.6 and older branches received a coordinated same-day patch on September 15, 2026, and v2.4.2 shipped September 22.

Pricing (as of 2026-10-14 — verify with upbound.io/pricing): framework $0 open source; Upbound Standard starts at $1,000/month with consumption minimums, per-resource billing at $1.0950/resource-month for the first 10K tier, discounting at volume; Business Critical and self-hosted options are custom-quoted.

Staying on Terraform: The Option Nobody Writes About

The honest alternative most license-anxiety articles skip: do nothing, deliberately. The BSL's Additional Use Grant permits production use; the restriction targets competing hosted offerings. If you are not reselling a Terraform-hosting service, your legal exposure is minimal, and every version converts to MPL 2.0 four years after release — the 2023-era v1.6.0 is nearly at its change date. Terraform under IBM remains an actively developed engine: v1.16.0 (Aug 2026) added provider planned-private-data storage, ephemeral value persistence via terraform_data store blocks, and import blocks inside modules; v1.17.0 is in release-candidate. The control plane, HCP Terraform, has a Free tier (500 resources) and metered Essentials; Standard/Premium are quote-gated, and that quote-gate is the real cost unknown. IBM's acquisition closed Feb 27, 2025; two years in, the product has not been enshittified — the risk is long-term portfolio drift, not a cliff.

Who should stay: any team whose current setup works and whose license concern is precautionary. Who should not: teams already at a renewal inflection with HCP Terraform contract pricing, or those with a hard open-source-only procurement mandate.

The Control-Plane Layer: What OpenTofu Buyers Actually Pay For

If you swap the engine to OpenTofu, you still need state management, run orchestration, policy, and drift detection. Four credible commercial options support it as a first-class engine:

For most OpenTofu adopters the honest recommendation is: start self-managed or on Scalr's free tier, graduate to Spacelift or env0 when you need governance features you cannot build in a quarter. We compared the same decision across Pulumi Cloud, HCP Terraform, and Spacelift at 1,000/3,000/10,000 resources in our Pulumi vs Spacelift analysis.

Worked Costs at Three Estate Sizes (October 2026 List Prices)

List prices, continuous full-month operation (720 hours), no discounts, rounded to the dollar. "Resources" means resources under management; for run-based vendors the count depends on your apply frequency, so treat those rows as different units — we include them because buyers compare them anyway.

Three readings fall out of this table. First, at pure resource-metering HCP Terraform remains the cheapest managed control plane per resource — roughly 3x cheaper than Pulumi Cloud at the same count — which is exactly why the Standard tier's quote-gate matters: the moment you need policies, cost estimation, or more than three concurrent runs, the public math ends. Second, OpenTofu's engine price is $0, so your real bill is whatever control plane you put on top, and self-managed state is absurdly cheap if you already run CI. Third, the governance-heavy platforms (Spacelift, Upbound) are not competing on price — they are selling capabilities you would otherwise build. Nobody should pick Spacelift to save money on state storage.

Migration Mechanics: What Actually Moves

TERRAFORM HCL -> OPENTOFU        days   swap binary, re-run plan, diff state,
                                        update CI + lockfile; watch for HCL
                                        features that diverged post-1.6
TERRAFORM HCL -> PULUMI           months full rewrite into a language;
                                        import existing resources via `pulumi
                                        import`; per-module cutover
CDKTF -> PULUMI                   months constructs do not convert; rewrite
                                        per-stack, same mental model
TERRAFORM -> CROSSPLANE           quarters compositions, XRDs, provider
                                        upgrades, RBAC design; pilot on one
                                        service first
ANY -> HCP TERRAFORM STAY         none   renegotiate contract at renewal;
                                        audit IBM roadmap twice a year

One mechanical note for OpenTofu adopters with a state history: because Terraform and OpenTofu state are compatible, the safe path is a single tofu apply against a copied state file with a plan that shows zero diffs — then flip CI. Teams that skip the zero-diff verification on day one are the teams that find drift two months later.

The Bottom Line

If you are a CDKTF shop: start migrating to Pulumi now. The repo is archived, no compatibility fixes are coming, and every quarter of delay adds provider drift to the HCL you will eventually rewrite anyway.

If you are HCL-fluent and license-anxious: switch the engine to OpenTofu. It is a days-long technical change with a permanent $0 license, state encryption as a bonus, and the Linux Foundation holding the governance keys. Pair it with self-managed state or Scalr to start, Spacelift or env0 when governance demands arrive. Read our deeper engine comparison in OpenTofu vs Terraform: what 1.13 actually changes.

If you are building an internal platform on Kubernetes: evaluate Crossplane as the infrastructure layer of that platform — but go in eyes-open that it is a platform build, not a tool install, and v2-era design is the only guidance worth reading. Our Crossplane vs Terraform deep dive covers the paradigm trade in detail.

If none of these pressures apply to you: staying on Terraform is a defensible answer. The BSL permits your production use today, each release opens to MPL in four years, and development velocity under IBM has not slowed. Put a calendar reminder on your HCP Terraform renewal and the Terraform roadmap twice a year — the risk is slow drift, not a cliff.

Nobody in 2026 should be starting new work in CDKTF, and any comparison article that still lists it as a live option was written before December 2025 and can be safely ignored.

Sources & Notes on Verification

Every price on this page was pulled from the vendor's own pricing page, release data from the GitHub Releases API, and license terms from the repositories' LICENSE files, all on 2026-10-14. HashiCorp's own pricing pages sit behind bot protection that blocks automated fetches; where we cite HCP Terraform rates we use HashiCorp's developer documentation worked examples ($0.0001359 per managed resource-hour) and label quote-gated tiers as such. Spacelift's $20,000 Starter+ figure is displayed without a period qualifier on its pricing page; it is an annual contract per the vendor's own docs and our prior verification. Env0 and Upbound Enterprise tiers are custom-quoted — we do not estimate them.