Summary
future work covers custom rules and broader policy checks. TFLint already offers plugin-based static analysis, including cloud-provider checks. The op…
News
OpenTofu 1.13 Lets Module Authors Reduce Unknown Values at Plan Time
Oct 26, 2026
2
min read
Follow us on
OpenTofu released version 1.13 with functions that help module authors resolve more expressions during planning. Type and value hints can unblock plans when count or the keys used by for_each would otherwise remain unknown. The planner can determine how many resource instances to create without knowing all their eventual attributes, which can remain unknown until apply.
Martin Atkins, an OpenTofu maintainer, proposed the design in an RFC and merged the implementation in August. In an earlier issue, the reporter, csar398, wanted to retain YAML input but could not plan when the decoded value controlled count. yamldecode can return different types, including a null value, so an unknown input gives the planner neither a known type nor a non-null guarantee. Explaining the limitation, Atkins wrote: "... this is just too complex a situation for OpenTofu to infer automatically itself."
The convert function converts values to a specified type, giving a yamldecode result a known object type even when the YAML input is unknown. For conditional resources, combining that conversion with assumenotnull lets a count expression based on nullness resolve to zero or one while the object's contents remain unknown. The author must ensure that the generated YAML always represents an object of the specified type and never a null value. If a value unknown during planning later violates that guarantee, OpenTofu reports an error during apply.
Terraform shipped its equivalent convert function first, in version 1.15. Atkins later wrote in an OpenTofu issue that "Terraform has an equivalent feature with syntax exactly like what I proposed here", and the project decided to match its design.
Experimental linting runs four built-in warning rules, including core:unused-variable and core:count-instead-enabled. The -lint=all flag enables them with tofu validate, tofu plan or tofu apply. In their linting proposal, the maintainers describe the feature as their most-voted request; future work covers custom rules and broader policy checks. TFLint already offers plugin-based static analysis, including cloud-provider checks.
The opt-in Symbol Libraries experiment shares functions and type definitions through *.sym.hcl files. Libraries cannot directly access resources, data sources or provider functions, although callers can pass resource values into library functions. The team hopes to stabilise the feature in version 1.14.
Version 1.13 removes Windows Remote Management (WinRM) support from the remote-exec and file provisioners, changes base64gzip output bytes, requires macOS 13 Ventura or later, and is the last series with official 32-bit builds. It also adds Windows on ARM64 packages. Existing WinRM configurations need migration, and the Go library change behind base64gzip can trigger resource updates despite equivalent decompressed output.
OpenTofu shortened its development cycle to align with Go releases and supports the 1.13.x series until 1 August 2027. The project released version 1.13.2 on 21 October. Its two security changes address excessive CPU use during tofu init when connecting to an attacker-controlled HTTP/2 server and filter compromised intermediate certificates. The patch also fixes applying saved plans that use symbol libraries.
About the Author
Mark Silvester
The InfoQ Newsletter
A round-up of last week’s content on InfoQ sent out every Tuesday. Join a community of over 250,000 senior developers.
View an example
Source: InfoQ
