January 2019 Summaries

Consul version 1.4.0 introduces an improved Access Control List (ACL) system designed to secure various aspects of Consul, including the UI, HTTP API, CLI, service communications within a datacenter, and node communications. The ACLs can be configured to fit security requirements and threat models by grouping rules into policies and associating them with tokens. To migrate to this new system, users must update their ACL tokens after upgrading to Consul 1.4.0 or newer. A recommended approach for setting up ACLs is to follow the Bootstrapping ACLs Guide on HashiCorp's Learn site, which outlines a six-step process for enabling ACLs on servers and clients. To create a secure datacenter, each node and service should have its own privileges, and operators must take further actions beyond the initial steps outlined in the guide. For more information on the ACL system, users can refer to the overview ACL documentation and the ACL Rules documentation.

Terraform is a tool that leverages infrastructure as code to safely and efficiently provision infrastructure, providing speed and efficiency benefits over legacy provisioning solutions. It has features such as Sentinel policy as code, Terraform module registry, and HashiCorp Vault integration to improve security posture. Sentinel allows users to define policies that are enforced against infrastructure during the plan and apply phases of a Terraform run, preventing provisioning of out-of-policy infrastructure. The Terraform module registry ensures all infrastructure is meeting best practices by providing standardized modules for infrastructure components. Additionally, the Vault integration secures sensitive credentials used to build infrastructure by encrypting them with dynamic credential generation, making it difficult for unauthorized parties to access them. By leveraging these features, organizations can improve their infrastructure security posture and achieve a range of goals such as limiting oversized cloud deploys and ensuring proper tagging.

The Consul team has released version 1.4.2, which addresses a regression issue impacting Nomad users and provides an update for those already on 1.4.1. The new release is recommended to be upgraded directly from the current version of 1.4.1 due to its importance in resolving this critical issue.

The Hashicorp Learn platform has released new training content focused on education for operators, featuring two tracks: Day 1: Deploying Your First Datacenter and Day 2: Advanced Operations. The platform offers a self-guided learning experience with beginner introductions progressing into intermediate and advanced topics, suitable for desktop, tablet, or mobile devices. This release includes recommendations for setting up production-ready datacenters, securing agents, and maintaining healthy datacenters, as well as hands-on labs and a video demonstration on securing applications using Consul Connect in a Kubernetes cluster.