HashiCorp Under IBM, Part 1: The RUM Meter, the Vault Client Census, and OpenTofu

Transcript

Full narration of the briefing. Click a section heading to jump the player to that moment.

Two histories, both yours 0:00

HashiCorp carries two recent histories, and both belong to the buyer. The first is the license change: the twenty twenty three move from open source to the Business Source License produced the loudest fork of the decade, OpenTofu, Linux Foundation backed, Terraform compatible, production proven, plus OpenBao on the Vault side. Core infrastructure as code is free again, permanently. The second is the acquisition: HashiCorp closed into IBM in early twenty twenty five, joining Red Hat.

I am Tom, Claire is with me, and this is part one of the VendorBenchmark HashiCorp playbook: the two meters, the fork, and the estate math.

Governance premium, pipeline commodity 0:50

What HashiCorp sells at a premium is the governance layer around the pipeline: policy enforcement, role based access at scale, private registries, drift detection, audit trails. What it does not sell exclusively is the pipeline itself, plan and apply with state storage, which OpenTofu and a field of commercial automation platforms deliver at a fraction of the managed platform's price, with production credibility. The stratification, which workspaces need governance and which need a pipeline, is the estate's honest map, and the vendor's price applies only to the first tier. The trust deficit the license change created makes that file land with force.

The two meters 1:32

Now the meters, two of the most definition sensitive in software. HCP Terraform bills by resources under management, a count of objects in your state files. That makes state hygiene literally billing hygiene: zombie resources, decommissioned stacks never removed, dead resources surviving refactors, and noise from undisciplined imports inflate the invoice until someone prunes, and the meter only counts upward. Vault bills by unique clients, and ephemeral workloads, Kubernetes pods, CI jobs, short lived functions, can explode that count by an order of magnitude when identity design is careless.

Entity deduplication, auth method architecture, and batch tokens bring it back to earth.

The estate, worked 2:22

The illustrative estate: about one point one million a year. Four hundred fifty thousand of HCP Terraform against a forty five thousand resource commit, five hundred thousand of Vault Enterprise across clusters and roughly twelve thousand counted clients, and one hundred fifty thousand of Consul, with the renewal proposing one point three million under new owner pricing. Hygiene re derives the meters. The state audit finds thirteen thousand resources of zombies, and the prune lands the real estate at thirty two thousand, documented before and after.

The client census finds churn, and the dedup re measures the estate at seven thousand five hundred genuine clients.

Define the meters in writing 3:03

Both meters get the payments playbook treatment: the definition and the measurement methodology written into the order form, because a meter without a written definition is a number the vendor counts alone. For resources: the billable resource definition with stated exclusions, the commit sized to the pruned count plus planned growth, burst at committed rates, rollover, and true downs. For clients: the unique client definition, the deduplication treatment, the measurement window, and your right to the underlying data, with disputes resolved against the written method. Prepared buyers prune twenty to thirty five percent before the commit and deduplicate thirty to fifty percent of the client count.

The workspace map 3:48

The stratification finishes part one. Forty percent of workspaces map to the governance tier, where Sentinel policies and role based access genuinely run, and sixty percent to plain pipelines, where the fork file prices the tier at a fraction whether or not a single workspace moves. The Vault estate splits the same way: dynamic secrets, PKI, and cross cloud brokering at Vault's premium; cloud siloed static secrets priced by the native managers already in your cloud bills. Part two covers the IBM mechanics, the December close, and the separable paper rule.

More briefings at redresscompliance dot com slash research videos.